How to Centrally Disable Microsoft 365 Desktop Add-Ins for All Users
Question details
An IT administrator needs a method to centrally remove or disable specific desktop add-ins across all users without blocking the ability to install other add-ins.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Managing organization-wide add-in deployments and restrictions to maintain security policies.
- Observed behavior
- Microsoft 365 lacks a single built-in setting to selectively block specific add-ins (like the TeamViewer Outlook add-in) globally while allowing others, requiring alternative administrative workarounds.
Ensure you have global administrator or security administrator privileges in Microsoft Entra ID, and access to the Group Policy Management Console if you plan to deploy registry changes.
Block Add-in Access Using Microsoft Entra ID Conditional Access
The most effective and secure way to disable specific cloud-connected add-ins globally is to block the associated application in Microsoft Entra ID.
Microsoft 365 does not provide a native toggle to block specific third-party add-ins for all users without affecting others. However, if the add-in relies on a cloud application to function, you can cut off its access entirely using Conditional Access policies.
Log in to the Microsoft Entra admin center (formerly Azure AD) using an account with administrator permissions.
Go to 'Protection' in the left-hand menu, click on 'Conditional Access', and then select 'Policies'.
Click 'New policy' and provide a descriptive name, such as 'Block TeamViewer Add-in Access'.
Under the 'Users' section, select 'All users' to apply this globally, or select specific groups if you only want to disable the add-in for certain departments.
Under 'Target resources', select 'Cloud apps', click 'Select apps', and search for the specific cloud application associated with the add-in you wish to block.
Under 'Access controls', select 'Grant', choose 'Block access', and finally toggle 'Enable policy' to 'On' before saving.
Disable the Add-in via Windows Registry Deployment (GPO)
You can use Group Policy to deploy a registry key change that forces a specific desktop add-in to load in a disabled state for targeted users.
Looking for a Simpler Alternative to Microsoft 365?
Managing intricate add-in policies, deployments, and access configurations in Microsoft 365 can be overwhelming for IT administrators. WPS Office offers a highly compatible, free, and lightweight alternative to Microsoft Office. It provides familiar productivity tools without complex cloud add-in dependencies, ensuring a smooth transition for your entire organization.
- 1. Download WPS Office: Visit the official WPS website to download the free or enterprise version tailored to your system.
- 2. Deploy to Your Team: Run the lightweight installer on local machines or deploy it globally without worrying about complex add-in management.
- 3. Open Existing Files: Seamlessly open, edit, and save your existing Microsoft Office documents with perfect format retention.
Frequently Asked Questions
Can I block all Microsoft 365 add-ins globally through the Admin Center?
Yes, in the Microsoft 365 Admin Center, you can navigate to 'Settings' > 'Org settings' > 'User owned apps and services' and uncheck the option that allows users to access the Office Store. This prevents new add-in installations entirely.
What does LoadBehavior=2 mean in the Windows Registry?
In the context of Office add-ins, setting the LoadBehavior registry value to 2 forces the application to load the add-in in a disabled state, preventing it from running automatically when the Office application (like Outlook or Word) starts.
Will blocking a cloud app in Entra ID physically uninstall the desktop add-in?
No, blocking the cloud application via a Conditional Access policy only prevents the add-in from authenticating and fetching data. It does not remove the add-in's files from the computer or hide its buttons from the Office ribbon interface.
