Microsoft 365 add-ins are not automatically safe or unsafe. Their risk depends on what the specific add-in can access, how its web service handles information, and whether you or your organization approve its use. Before installing one, check its requested permissions against the feature you need and read its privacy policy. A Marketplace listing provides useful safeguards and disclosures, but it is not a guarantee that an add-in is suitable for every account or type of data.
How Microsoft 365 add-ins work
Office Add-ins combine a manifest, which declares information such as permissions, with a web application that contains the add-in’s code and logic. Microsoft describes Office Add-ins as web content running in a browser control or iframe, with a runtime separate from the Office client. Depending on the add-in’s capabilities and declared access, it may read or write information in the active document or mail item. Its web code can also change over time.
As an Amazon Associate I earn from qualifying purchases.
This means there are two practical questions: what Office data can the add-in access, and what does the service hosting it do with information it receives? A permission declaration helps answer the first; the add-in’s privacy policy and the provider’s disclosures help assess the second. Neither alone tells you everything about downstream data use.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What can an Office add-in access?
The add-in’s manifest declares its Office access. Permission levels determine which subset of Office JavaScript APIs is available to it, so they are meaningful boundaries—not just routine installation wording. Microsoft recommends that add-ins request only the minimum access needed. For example, Microsoft’s documentation says write-document permission allows writing selected data but does not provide the document-reading methods. Microsoft’s Office Add-in permission guidance explains the model.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Compare the requested access with the feature. If a feature appears to need only a narrow interaction but the add-in requests broader access, pause and ask the publisher or your administrator why. The answer may depend on the add-in’s design, but unexplained breadth is a reason to investigate rather than approve automatically.
Can an Outlook add-in read your emails?
It depends on the Outlook permission it requests. Microsoft’s Outlook permission guidance distinguishes access to the current item from broader mailbox access. Restricted permission is limited to the current item. Read-item permission can expose personally identifiable information on that item, including sender and recipient names and email addresses. Read/write-mailbox permission is broader and requires administrator privilege to install. Microsoft’s Outlook permission documentation describes these scopes.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check the exact permission displayed for the add-in, then consider whether it fits the task. An add-in that works with a particular message may need access to details on that item; that is not the same as having broad mailbox access. Also review the provider’s privacy policy to understand how the add-in’s service handles information it receives.
Office permissions and Microsoft Entra consent are separate
An add-in’s Office manifest permissions are not the only possible access decision. The add-in or a connected application may also request Microsoft Entra permissions to access organizational data. Depending on the permission and the tenant’s settings, that request may require user or administrator consent. Users cannot approve permissions that require administrator consent.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If a work account presents an Entra consent prompt, treat it as a separate decision from the Office add-in permission request. Follow your employer’s policy and ask the administrator when the requested access is unclear; do not approve a prompt simply because you have already installed an add-in. Microsoft’s user consent guidance explains how organizations can restrict consent, including allowing it only for applications from verified publishers.
What Marketplace checks do—and do not—tell you
Microsoft Marketplace submissions must meet baseline requirements that include SSL communication, proof of developer identity, a contractual agreement, and a compliant privacy policy. Microsoft also says users can review an add-in’s privacy policy and requirements before installing; Outlook add-ins that interact with mailboxes surface their requested permissions. See Microsoft’s Office Add-in Marketplace requirements and its privacy and security guidance.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These checks and disclosures are useful signals, not a universal safety certification. SSL protects communication in transit; it does not, by itself, establish how a provider stores, uses, or shares data after receiving it. Marketplace availability also does not establish that an add-in meets your employer’s rules or is appropriate for sensitive information. Microsoft advises caution with unknown add-ins.
Recommended Free Tools
How to assess an add-in before installing it
- Confirm the publisher and the listing. Make sure you have found the intended add-in and, if you are using a work account, check whether your organization approves it.
- Read the permission request. Match each requested Office permission to the feature you plan to use. In Outlook, distinguish current-item access from broader mailbox access.
- Read the privacy policy. Look for what information the add-in’s service receives and how it says that information is handled. Consider any connected services the policy describes.
- Review any separate Entra prompt. Treat application consent as a distinct request. If the scope is unclear or the prompt conflicts with workplace policy, stop and contact your administrator.
- Reassess the fit for your data. A permission may be technically valid yet inappropriate for the sensitivity of the document, message, or account you intend to use.
What organizations can control
Administrators can deploy add-ins to named users, groups, or everyone, and can manage Marketplace access. Microsoft recommends a phased rollout, starting with a small group of business stakeholders and IT staff before wider deployment. Microsoft’s add-in deployment guidance covers centralized assignment.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Organizations can also configure Microsoft Entra consent settings to limit which applications users may authorize. Microsoft recommends restricting user consent to verified-publisher applications as one way to reduce malicious-app risk. These controls let IT review and manage adoption rather than relying only on individual installation decisions.
Can an add-in change after you install it?
Yes. An add-in’s hosted web code can change without a corresponding change to its manifest permission declaration. That means an unchanged permission listing does not prove that every part of the add-in’s behavior has remained identical.
Some changes to an administrator-deployed manifest—such as requested permissions, scopes, or events—require administrator consent again before users receive the update. That does not mean every code change triggers a new permission prompt. Microsoft describes the update and consent distinction in its Office Add-in update guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to compare two add-ins for the same job
Microsoft’s guidance supports comparing add-ins on concrete access and governance questions; it does not rank specific add-ins head to head. Use these points to make a practical comparison:
Quick Recap
- Permission and scope: What document or mailbox access does each request?
- Feature fit: Does the feature plausibly need that level of access?
- Publisher and disclosure: Is the publisher identifiable, and is the privacy policy clear about the service’s data handling?
- Separate consent: Does either add-in request Microsoft Entra access, and who must approve it?
- Organizational approval: Does your organization permit the add-in and control its deployment?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
