Because Monarch is under active development, the set of features that it supports changes all the time. An assessment of the client software available last September isn’t a good basis for deciding how ready Monarch is today (this support page includes a non-exhaustive list of key Outlook features). Apart from adding features for Microsoft 365 users, work is also ongoing to make sure that Monarch can support email accounts for other mail servers.
In a related development, Message center notification MC590123 (updated 20 June) and a support article laid out Microsoft’s plan to use Monarch as the default email and calendar client for Windows 11. The kicker here is the statement that “After this change is implemented at the end of 2024, Users with a Microsoft 365 or Office 365 subscription with access to the Microsoft 365 desktop apps can use the new Outlook for Windows.” With their normal enthusiasm for new software, Microsoft will take every opportunity to make Monarch available to end users. Some would say that they will stuff Monarch down peoples’ throats, but that’s going a tad far for me.
Controls to Block or Allow Access to Outlook Monarch
With Microsoft accelerating its plans for Monarch, administrator thoughts invariably turn to the set of controls available to enable or disable the new client. Microsoft documentation covers this topic (and there’s some interesting information in the FAQ), but here are the essentials together with some PowerShell that you might find useful.
Monarch is based on OWA, so it should come as no surprise that it functions like OWA. For example, a setting is available to disable the client at the access level (what used to be the Client Access Server in on-premises servers). This command blocks access to Monarch for the Terry Hegarty mailbox (account):
To disable or enable a set of mailboxes, use either the Get-ExoMailbox (to search against mailbox attributes) or Get-User (to search against Azure AD account attributes) cmdlets and pipe the results to Set-CASMailbox:
To report the set of mailboxes enabled for Monarch, we can do something like this (unfortunately, Get-CASMailbox doesn’t support server-side filtering against OneWinNativeOutlookEnabled):
An OWA mailbox policy setting is available to block users from adding third-party email accounts (like Gmail) to Monarch. This command updates an OWA mailbox policy to disable personal accounts. The policy is effective with Monarch builds post 30 June.
Recent Outlook for Windows builds include a toggle to allow users to switch to Monarch (Figure 1). If you’re not going to allow people use Monarch, it’s a good idea to remove the tempting toggle.
Figure 1: Toggling on or off the new Outlook
To hide the toggle, add a new DWORD value in the system registry called HideNewOutlookToggle at HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options\General and set it to 1 (Figure 2). The next time Outlook restarts, the toggle is gone.
Figure 2; Registry setting to hide or reveal the try the new Outlook toggle
The change can also be made in a GPO using ADMX build 16.0.5401.1000 or later. The setting is “Hide the “Try the new Outlook” toggle in Outlook,” which sets HideNewOutlookToggle at HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Options\General to either 0 or 1, depending on if the toggle is on or off. Publishing the change via a GPO might take a little time before the client responds and disables the toggle.
Reporting Outlook Client Usage
Currently the Email Apps report in the usage reports section of the Microsoft 365 admin center doesn’t separate Monarch out from OWA when it identifies the different Microsoft clients that connect to Exchange Online (Figure 3). Hopefully, Microsoft can update the report to highlight people who use Monarch.
Figure 3: Details of Outlook clients that connect to Exchange Online
Monarch’s Coming. Are You Ready?
It seems like Microsoft has been on the journey to deliver the new Outlook for Windows forever. But let’s face it, replacing a client that’s been in use since 1997 is difficult to say the least. Code developed over decades can’t be replaced without huge engineering effort, especially when the desired outcome is a common Outlook code base that will work on multiple platforms and support faster innovation.
OWA introduces new functionality much faster than the legacy Outlook for Windows does. That’s not the fault of the older Outlook client. It is handicapped by decades of building features one step at a time. The new Outlook for Windows will eventually be a good replacement. The question is just when that time will be. In the meantime, some Outlook Monarch controls are a good thing to have.
For the powershell command you mention (Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False ) to block users from adding third party mail accounts: Will this prevent users from adding third party mailboxes in the desktop Outlook software?
Thanks for the reply Tony – do you have a suggestion for how to block users from adding mailboxes outside of our tenant to their Oulook desktop client?
Thanks for that reply Tony. I’ve read this post but I believe others are saying they’ve applied those changes and turned on the new Outlook and they can still add new accounts. I was just hoping you’d heard more from Microsoft on this.
Loading...
It’s not something I talk to Microsoft about… The post is written by an Outlook MVP and I’d be surprised if things don’t work as described. You could always contact Diane through the blog to see what she thinks.
Loading...
Thanks again for taking the time to respond. I can check with Diane to see if this method will work with the new Outlook. Here’s the post I’ve been following in the Microsoft community where people are saying the old method that worked with blocking the addition of mail accounts doesn’t work on the new outlook: https://techcommunity.microsoft.com/t5/outlook/new-outlook-opens-security-hole/m-p/3827768#M16330
Loading...
Tony Thank you for sharing this excellent article. We used registry to disable toggle on our user base for following reason.
I am not sure when this were made available but at the time when this rolled out at that time it was not available. it allowed user to add personal mailbox. I will test Powershell command (Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False) and see if it blocks other tenant mailbox. We like to block not only personal mailbox but also any third party tenant mailbox access.
Also when I used our regular support Microsoft told me to use help button of this new monarch outlook. Microsoft told us Monarch support is only provide by help button on client and it is not kind of enterprise support. I am not sure if that has changed .
Tony by running “Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False ” we can block user accessing personal account from enterprise network. how can we block same user accessing other tenant mailbox. for example if contractor working at company and we like to block access to his contracting company mailbox from his client computer?
Does any of below switch help to block other tenant mailbox access like personal mailbox access?
Tony how do we block user accessing other tenant mailbox from this new outlook client? does any of below switch help to block other tenant access like personal mailbox?
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
For the powershell command you mention (Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False ) to block users from adding third party mail accounts: Will this prevent users from adding third party mailboxes in the desktop Outlook software?
No. OWA mailbox policies have zero effect on the Outlook for Windows (Win32) client.
Thanks for the reply Tony – do you have a suggestion for how to block users from adding mailboxes outside of our tenant to their Oulook desktop client?
Amazing what you can find online… https://www.slipstick.com/exchange/prevent-users-adding-email-accounts-outlook/
Thanks for that reply Tony. I’ve read this post but I believe others are saying they’ve applied those changes and turned on the new Outlook and they can still add new accounts. I was just hoping you’d heard more from Microsoft on this.
It’s not something I talk to Microsoft about… The post is written by an Outlook MVP and I’d be surprised if things don’t work as described. You could always contact Diane through the blog to see what she thinks.
Thanks again for taking the time to respond. I can check with Diane to see if this method will work with the new Outlook. Here’s the post I’ve been following in the Microsoft community where people are saying the old method that worked with blocking the addition of mail accounts doesn’t work on the new outlook: https://techcommunity.microsoft.com/t5/outlook/new-outlook-opens-security-hole/m-p/3827768#M16330
Tony Thank you for sharing this excellent article. We used registry to disable toggle on our user base for following reason.
I am not sure when this were made available but at the time when this rolled out at that time it was not available. it allowed user to add personal mailbox. I will test Powershell command (Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False) and see if it blocks other tenant mailbox. We like to block not only personal mailbox but also any third party tenant mailbox access.
Also when I used our regular support Microsoft told me to use help button of this new monarch outlook. Microsoft told us Monarch support is only provide by help button on client and it is not kind of enterprise support. I am not sure if that has changed .
Tony by running “Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False ” we can block user accessing personal account from enterprise network. how can we block same user accessing other tenant mailbox. for example if contractor working at company and we like to block access to his contracting company mailbox from his client computer?
Does any of below switch help to block other tenant mailbox access like personal mailbox access?
AdditionalAccountsEnabled :
ChangeSettingsAccountEnabled :
ItemsToOtherAccountsEnabled :
AllowedOrganizationAccountDomains :
Tony how do we block user accessing other tenant mailbox from this new outlook client? does any of below switch help to block other tenant access like personal mailbox?
AdditionalAccountsEnabled :
ChangeSettingsAccountEnabled :
ItemsToOtherAccountsEnabled :
AllowedOrganizationAccountDomains :