Home
Microsoft

Update (June 27th 2018): Centralized Deployment for Outlook add-ins is out of preview now and is generally available to Office 365 commercial customers.

 

Update (April 20th 2018): Centralized Deployment for Outlook add-ins is now available in preview to Office 365 commercial customers.

 
Outlook add-ins enable customers to access their favorite apps right in email to get more done, faster.  As we bring more add-ins in Outlook to help users be more productive, we want to ensure that Office 365 administrators have tools to quickly and easily deploy add-ins. Last year, we announced the availability of Centralized Deployment for Word, Excel and PowerPoint add-ins. Starting February 26, 2018, we will begin rolling out Centralized Deployment for Outlook add-ins, initially in preview, to Office 365 commercial customers.

 

How to get started with Centralized Deployment for Outlook add-ins?

 Administrators can deploy Outlook add-ins to individual users, groups or an organization with ease, right from the Office 365 administration center or using PowerShell scripts. Both Microsoft AppSource add-ins as well as custom add-ins built internally for use within your organization can be deployed using Centralized Deployment to tenants worldwide.

 

To deploy an add-in, go to Settings > Services & add-ins in the Office 365 admin center. 

 admin_center_new3.JPG

 

Clicking “Upload add-in” will take you to the Centralized Deployment page and then you can choose to deploy an add-in from the Office Store/AppSource or from a manifest file

 

admin_center_step2.JPG

 

You choose the right visibility for the add-in by either enabling it by default for everyone or give end users options to enable or disable it. You can choose to deploy the add-in to users, groups or your entire organization.

   

admin_center_step3.JPG

 

For more details and step by step instructions, review the documentation on Centralized Deployment.

We hope that Centralized Deployment makes it easier for you to deploy add-ins in your organization and look forward to your feedback in improving the experience further. 

 

 Frequently Asked Questions

 

Q. Can I target users and groups in Centralized Deployment?

A. Centralized Deployment supports deploying to users in top level Office 365 Groups, distribution lists and security groups. Centralized Deployment is not supported for nested groups.

 

Q. Which Outlook clients can I deploy to using Centralized Deployment?
A. 
Centralized Deployment can be used to deploy Outlook add-ins in commercial Office 365 tenants across Outlook on the web, Outlook 2013 and Outlook 2016 for Windows, Outlook 2016 for Mac as well Outlook for iOS and Android.

 

Q. What languages and worldwide Office data centers are supported?
A.
Today, we have worldwide support for Centralized Deployment for all supported Office languages. We also support the Microsoft Office sovereign datacenters for Germany.

 

Q. What type of deployment telemetry is available
A. Telemetry for IT administrators to see data about add-in deployments and usage will be available shortly in the Office 365 admin center. Developers telemetry for add-in deployments is available via  the Office ISV Seller Dashboard.

 

Q. As an administrator, how do I manage access to add-ins for my organization?
A. For easy deployment of add-ins to users, groups or your organization, we recommend administrators use Centralized Deployment. For other access controls like preventing users from accessing certain add-ins, refer to the Add-ins for Outlook TechNet article.

 

Q. Will add-in deployment via Exchange Admin Center still be supported?
A. Yes, add-in deployments via Exchange Admin Center will continue to be supported. However, we recommend customers use Centralized Deployment to deploy add-ins moving forward.

 

Q: When can I expect this feature to be live for my tenant for Outlook add-ins?

A: We’re are rolling out the feature over the next few weeks. Note that as the roll-out progresses, the admin portal may show an option to deploy Outlook add-ins, however, the feature may not be fully enabled. For now, you should continue to use the Exchange Admin Center to deploy Outlook add-ins.

 

Update (April 20th 2018): Centralized Deployment for Outlook add-ins is now available in preview to Office 365 commercial customers.

 

Update (June 27th 2018): Centralized Deployment for Outlook add-ins is out of preview now and is generally available to Office 365 commercial customers.

38 Comments
New Contributor

Thats Great News, We can now capable of pushing addins from cental location:)

 

Also, How could we monitor deployment ?


Deleted
Not applicable

Will we (admins) be able to disable some or all add-ins including default add-ins installed w/ Office?

Senior Member

Will we get a blacklist/whitelist feature? This would be very helpful.

Occasional Contributor

Will this finally support deployment to groups larger than 1000 members? This has been a real show stopper in EAC deployment.

@Miiko Kytöharju - Yes. This will support deployment to groups with more than 1000 members. Please let us know how it works for you. 

@Shantanu Deshmukh Unfortunately, there is no easy way now for you to monitor the deployment progress. This is one of the items in our backlog. Stay tuned for updates. 

@Christoph Ratavaara - can you please elaborate on the blacklist/whitelist feature? 

Senior Member

@Sreeram Ramamoorthy thank you for your response. We would like to be able to disable all Outlook Add-ins for all users/a tenant, but make exceptions for certain Add-ins/Users/Groups hence Whitelist Add-ins. As by my tests I did, this was not possible.

@Christoph Ratavaara - Though we dont have a whitelist addin feature, you can achieve the same result by the following.

 

You can disable all outlook addins using My Marketplace role. For more details, please refer to the following links

 

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/...

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/...

 

You can then use Centralised deployment to deploy the selected (whitelist) addins to the set of users/groups who you want to provide access with. These users will be able to use only the addins you provided and will not be able to install any of the outlook addins from the marketplace. Please try this out and let me know if it works.

@Deleted - 

You can disable all outlook addins using My Marketplace role. For more details, please refer to the following links

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/specify-who-can-install-and-manage-add-ins

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/add-ins-for-outlook

 

If you would like to provide only some users/groups with addin access, then you can disable all outlook addins using the above and then use Centralised deployment to deploy those addins for those select set of users. Hope this helps. 

Senior Member

Hi @Sreeram Ramamoorthy, thank you for the description. I tried this setup again:

 

User Role Policy in ECP "Add-ins Whitelisted":

[x] My ReadWriteMailbox Apps (checked)

[  ] My Marketplace Apps (unchecked)

[  ] My Custom Apps (unchecked)

 

This policy is assigned to my user.

 

Then through the O365 Admin Center I chose the "Services & Add-ins" to start the centralized deployment.

Deploy Add-In > I want to add an Add-In from the Office Store > Evernote > Optional, disabled > Deploy to group test_outlookaddins

My user is a member of the "test_outlookaddins" group (security group), top level.

 

I also tested the "Optional, enabled" and "mandatory" setting of the deployment. But nothing works, if I try to install an Add-in in Outlook (fat client) which I deployed, I always get the message "Access denied. Contact your administrator". I waited around 15 minutes every time after changing the policy or deploying an add-in.

 

Is this an expected behaviour? Otherwise I can open a case with Microsoft.

 

 

 

 

 

@Christoph Ratavaara -  There is lag before which the change synch across the users. Based on the load, it could take about 24 hours before the change will be reflected. Do you see the addins deployed now?  

Senior Member

@Sreeram Ramamoorthy Yes, now I can see the deployed add-ins! They show up under the "Managed by the Administrator" menu point. The one I set as "Enabled, mandatory" is installed and cannot be removed, this is as expected. But the others which I set as "optional, enabled/disabled" cannot be installed. When I click on install I get the message "Access denied. Contact your administrator." So there still seams to be an issue, or is this to be excpected?

 

2018-07-24 14_30_29-Add-In.png

@Christoph Ratavaara - No. This is not expected behaviour. The fix for this is in the process of rolling out and should be available soon. Thanks for your patience. 

Senior Member

@Sreeram Ramamoorthy Thank you very much for your help! Please let me know when the fix has been rolled out, so that I can test again.

Occasional Contributor

Excellent post!  

 

We are trying to role this out with RBAC.  Are there a specific roles/permissions assignment that can be used? 

 

In enterprise environments IT typically does not give "global administrator" rights to the Endpoint/Desktop Teams.

Senior Member

@Sreeram Ramamoorthy do you already haver further information about the rollout of the fix? I tested the App deployment again today and it still doesn't work as expected.

New Contributor

I am also waiting on this feature to be fixed.  Any update on the fix for the issue identified by Christoph?

@Aaron Archuleta@Christoph Ratavaara - the fix is being deployed Worldwide. It will take some time to percolate across all our deployments. If you need this expedited for your tenant/domain, please raise a ticket with your tenant/domain name and we will expedite it. 

@Kohen Dubeau - you do not need to provide administrator access to Desktop teams for them to use addins. You can refer to the below 2 documents to know more about what roles to provide your users for them to get addins.

 

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/...

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/...

 

 

Senior Member

@Sreeram Ramamoorthy - thank you for the update. Could you provide me a fix id/number/description which I can add to the support ticket?

Occasional Contributor

@Sreeram Ramamoorthy   Thank you for the links.

 

We've deployed both Administrator Roles ; Org MarketPlace App & Org Custom App; to the Desktop Team.  Verified the applied permissions with PowerShell.  They do not appear to grant the correct permissions needed.  This feature is only available to our global administrators.  There must be another role assignment or permission set that is required.

 

We have opened a support case with Premiere Support and they are also hitting dead ends.

Occasional Contributor

@Sreeram Ramamoorthy  Here is the response from Microsoft Premiere Support regarding the permissions:

 

"After researching this all day, I have determined that Global Admin access is required because the feature you want to expose requires Global Admin access to the App Store.   There is however a new feature called Privileged Identity Management which you can enable in your tenant.  This will allow you to grant Global Admin role on a timed basis, require approval, require MFA, Require an incident or ticket number, etc.  You can read more information about this at the following link

 

https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure"

 

Occasional Contributor

@Sreeram RamamoorthyI have moved our needed add-in to Centralized Deployment, but it seems there is a long delay between deploying it and it being visible in the Outlook 2016 desktop client. 90 minutes after deploying, assigning to group and enabling the add-in, it is still not visible in the client. Is there any way to speed things up?

@Christoph Ratavaara - You can mention in  the ticket that it needs to be routed to the outlook addins team. That should help it get to us. 

@Miiko Kytöharju - Yes, unfortunately, it generally takes upto 24hours for it percolate across all clients and there is not much that can be done at this point to bring it down. We will take this feedback and look at how we can reduce this turn around time. 

Occasional Contributor

@Sreeram Ramamoorthy  this worked like a charm. Well over 1000 members in a single group, app published just fine, given some time. Thanks!

@Miiko Kytöharju Best news I've heard all day! Thanks for letting me know. 

Senior Member

@Sreeram Ramamoorthy it started working for me as expected at the point when I opened the support ticket with MS. There was nothing more to do but be patient. Now the deployments work perfectly fine for all the users. Thank you very much for your help Sreeram!

Occasional Visitor

@Sreeram Ramamoorthy I have both issues mentioned above in my organization as well

#1 Permission issue : My admins have Org Marketplace Apps role enabled for them. They are able to deploy an add-in using EAC > Organization > Add-ins; But not via Centralized deployment. That page is read-only.

Also has Services & add-ins page changed to Apps?

 

#2 : User is unable to see/enable an add-in deployed using Centralized deployment if it was deployed as optional,disabled. Do we know if the fix has been deployed already?

@Sreeram Ramamoorthy or anybody - does the Exchange Organization setting (AppsForOfficeEnabled) need to be enabled (true) in order to use add-ins deployed using centralized deployment? Currently the setting it set to false in our tenant. I have deployed a single add-in to a group of users (based on a security group) and none of the users are seeing the add-in in either Outlook 2016 or OWA. This is within Exchange Online (Office 365 MTE). It's been about 5 hours since I enabled the add-in. I am not sure if it's a timing issue (since you mentioned it can take upto 24 hours) or if it's because AppsForOfficeEnabled = False in our Exchange tenant. It's not clear from the documentation if the 'AppsForOfficeEnabled' applies only to add-ins deployed using the old EAC based approach or if it also applies to centralized deployments too?

Occasional Visitor

Does Centralized Deployment work with Outlook 365 add-ins that use OnSend feature? I'm getting the following error when using the sample manifest. Is there a way to fix the manifest?

2018-10-17 11_42_22-Microsoft 365 admin center - Services & add-ins.png

@Sonal Beri - we are investigating this and will get back to you. 

 

@Stuart Chapman - This property has no dependency for Corporate Deployment.  However, if this property is disabled then users won't get any add-ins in outlook clients. We are aware of this inconsistency are looking into bridging this gap.

 

@Giedrius Gobe Have you checked the manifest against the requirements mentioned in the below document.

https://docs.microsoft.com/en-us/outlook/add-ins/outlook-on-send-addins 

Occasional Visitor

@Sreeram Ramamoorthy - were you abel to find any information for my question above?

 

Occasional Visitor

It seems Centralized Deployment does not work for paid add-ins?

Will this be available soon? - and if not, how would you easily deploy a paid add-in to an organization? 

Microsoft

@TNSHolding Unfortunately the deployment of paid add-ins isn't a scenario we support at the moment. I can say that we'll have more updates in this space later in the year around BUILD timeframe.