Step 1
Open the Exchange Admin Center (EAC) and log in using your admin credentials.
Step 2
Navigate to “Permissions” and click on the “User roles” tab (see figure 1).
Figure 1: The “User roles” tab. The Default Role Assignment Policy is highlighted in the center.
Step 3
Choose the “Default Role Assignment Policy” and click on the pencil icon to edit it.
Information! Settings under the default policy apply to all users. If you want to test out the settings, you can create a new policy (click on the + icon) and apply it to test users only.
Step 4
Find the following settings and change them accordingly (see figure 2):
[x] My ReadWriteMailbox Apps (checked)[ ] My Marketplace Apps (unchecked)[ ] My CustomApps (unchecked)
Figure 2: The relevant settings under “Default Role Assignment Policy”
With these settings, the user cannot install Marketplace (Store) Apps or Custom Apps.
Only the administrator can deploy add-ins which the user then can install or uninstall, the user itself has no permission to install anything from the store.
Applying the policy
After editing the policy and saving the policy, it will automatically be applied to all users.
This process can take up to 24 hours.
For instructions on how to deploy add-ins see the Outlook add-in centralized deployment guide.