Table of Contents
Outlook Monarch Controls for the New Outlook for Windows
Updated 8 November 2023
With the disclosure that Microsoft 365 Copilot will only work with the Outlook Monarch client, organizations interested in Copilot deployments might need to reassess their plans for the “new Outlook for Windows,” currently available in preview.
Because Monarch is under active development, the set of features that it supports changes all the time. An assessment of the client software available last September isn’t a good basis for deciding how ready Monarch is today (this support page includes a non-exhaustive list of key Outlook features). Apart from adding features for Microsoft 365 users, work is also ongoing to make sure that Monarch can support email accounts for other mail servers.
In a related development, Message center notification MC590123 (updated 20 June) and a support article laid out Microsoft’s plan to use Monarch as the default email and calendar client for Windows 11. The kicker here is the statement that “After this change is implemented at the end of 2024, Users with a Microsoft 365 or Office 365 subscription with access to the Microsoft 365 desktop apps can use the new Outlook for Windows.” With their normal enthusiasm for new software, Microsoft will take every opportunity to make Monarch available to end users. Some would say that they will stuff Monarch down peoples’ throats, but that’s going a tad far for me.
Controls to Block or Allow Access to Outlook Monarch
With Microsoft accelerating its plans for Monarch, administrator thoughts invariably turn to the set of controls available to enable or disable the new client. Microsoft documentation covers this topic (and there’s some interesting information in the FAQ), but here are the essentials together with some PowerShell that you might find useful.
Monarch is based on OWA, so it should come as no surprise that it functions like OWA. For example, a setting is available to disable the client at the access level (what used to be the Client Access Server in on-premises servers). This command blocks access to Monarch for the Terry Hegarty mailbox (account):
Set-CASMailbox -Identity Terry.Hegarty -OneWinNativeOutlookEnabled $False
To disable or enable a set of mailboxes, use either the Get-ExoMailbox (to search against mailbox attributes) or Get-User (to search against Azure AD account attributes) cmdlets and pipe the results to Set-CASMailbox:
Get-User -Filter {Department -eq "IT"} -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Set-CasMailbox -OneWinNativeOutlookEnabled $False
To report the set of mailboxes enabled for Monarch, we can do something like this (unfortunately, Get-CASMailbox doesn’t support server-side filtering against OneWinNativeOutlookEnabled):
Get-CasMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Where-Object {$_.OneWinNativeOutlookEnabled -eq $True} | Format-Table DisplayName, OneWinNativeOutlookEnabled
An OWA mailbox policy setting is available to block users from adding third-party email accounts (like Gmail) to Monarch. This command updates an OWA mailbox policy to disable personal accounts. The policy is effective with Monarch builds post 30 June. To block personal accounts, the Outlook profile must be first configured with an enterprise account with an Exchange Online mailbox. If not, blocks placed by Exchange Online OWA policies are ineffective.
Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False
And to report the set of mailboxes to which the OWA mailbox policy applies, run:
Get-CASMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Where-Object {$_.OWAMailboxPolicy -eq "OwaMailboxPolicy-Default"}
Turning Off the “Try the New Outlook” Toggle
Recent Outlook for Windows builds include a toggle to allow users to switch to Monarch (Figure 1). If you’re not going to allow people use Monarch, it’s a good idea to remove the tempting toggle.
To hide the toggle, add a new DWORD value in the system registry called HideNewOutlookToggle at HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Options\General and set it to 1 (Figure 2). The next time Outlook restarts, the toggle is gone.
The change can also be made in a GPO using ADMX build 16.0.5401.1000 or later. The setting is “Hide the “Try the new Outlook” toggle in Outlook,” which sets HideNewOutlookToggle at HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Options\General to either 0 or 1, depending on if the toggle is on or off. Publishing the change via a GPO might take a little time before the client responds and disables the toggle.
Removing Monarch
Because the Monarch client is fully supported for personal accounts, users might receive it as a preinstalled app on a new device or they might download the client from the Windows Store. To remove the app from a Windows image so that Windows does not install the app for new user accounts, you can remove the Outlook Monarch app package by running the Remove-AppxProvisionedPackage cmdlet. According to instructions given in MC676298 (22 September 2023), the command to remove the Monarch package is:
Remove-AppxProvisionedPackage -Path c:\offline -PackageName OutlookforWindows
To remove a previously-installed app, run the Remove-AppxPackage cmdlet.
Reporting Outlook Client Usage
Currently the Email Apps report in the usage reports section of the Microsoft 365 admin center doesn’t separate Monarch out from OWA when it identifies the different Microsoft clients that connect to Exchange Online (Figure 3). Hopefully, Microsoft can update the report to highlight people who use Monarch.
Monarch’s Coming. Are You Ready?
It seems like Microsoft has been on the journey to deliver the new Outlook for Windows forever. But let’s face it, replacing a client that’s been in use since 1997 is difficult to say the least. Code developed over decades can’t be replaced without huge engineering effort, especially when the desired outcome is a common Outlook code base that will work on multiple platforms and support faster innovation.
OWA introduces new functionality much faster than the legacy Outlook for Windows does. That’s not the fault of the older Outlook client. It is handicapped by decades of building features one step at a time. The new Outlook for Windows will eventually be a good replacement. The question is just when that time will be. In the meantime, some Outlook Monarch controls are a good thing to have.
For the powershell command you mention (Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False ) to block users from adding third party mail accounts: Will this prevent users from adding third party mailboxes in the desktop Outlook software?
No. OWA mailbox policies have zero effect on the Outlook for Windows (Win32) client.
Thanks for the reply Tony – do you have a suggestion for how to block users from adding mailboxes outside of our tenant to their Oulook desktop client?
Amazing what you can find online… https://www.slipstick.com/exchange/prevent-users-adding-email-accounts-outlook/
Thanks for that reply Tony. I’ve read this post but I believe others are saying they’ve applied those changes and turned on the new Outlook and they can still add new accounts. I was just hoping you’d heard more from Microsoft on this.
It’s not something I talk to Microsoft about… The post is written by an Outlook MVP and I’d be surprised if things don’t work as described. You could always contact Diane through the blog to see what she thinks.
Thanks again for taking the time to respond. I can check with Diane to see if this method will work with the new Outlook. Here’s the post I’ve been following in the Microsoft community where people are saying the old method that worked with blocking the addition of mail accounts doesn’t work on the new outlook: https://techcommunity.microsoft.com/t5/outlook/new-outlook-opens-security-hole/m-p/3827768#M16330
Tony Thank you for sharing this excellent article. We used registry to disable toggle on our user base for following reason.
I am not sure when this were made available but at the time when this rolled out at that time it was not available. it allowed user to add personal mailbox. I will test Powershell command (Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False) and see if it blocks other tenant mailbox. We like to block not only personal mailbox but also any third party tenant mailbox access.
Also when I used our regular support Microsoft told me to use help button of this new monarch outlook. Microsoft told us Monarch support is only provide by help button on client and it is not kind of enterprise support. I am not sure if that has changed .
Tony by running “Set-OwaMailboxPolicy -Identity OWAMailboxPolicy-Default -PersonalAccountsEnabled $False ” we can block user accessing personal account from enterprise network. how can we block same user accessing other tenant mailbox. for example if contractor working at company and we like to block access to his contracting company mailbox from his client computer?
Does any of below switch help to block other tenant mailbox access like personal mailbox access?
AdditionalAccountsEnabled :
ChangeSettingsAccountEnabled :
ItemsToOtherAccountsEnabled :
AllowedOrganizationAccountDomains :
Tony how do we block user accessing other tenant mailbox from this new outlook client? does any of below switch help to block other tenant access like personal mailbox?
AdditionalAccountsEnabled :
ChangeSettingsAccountEnabled :
ItemsToOtherAccountsEnabled :
AllowedOrganizationAccountDomains :
The “Turning Off the “Try the New Outlook” Toggle” solution sounds good… Doesn’t work!!!
The regedit setting to disable the toggle works just fine. Did you exit and restart Outlook?
“HideNewOutlookToggle”
This no longer works, adding it will launch the “new outlook” that the admin has disabled support for.
it works for me. I just set the registry value on a new PC and restarted Outlook and there’s no trace of a toggle.
Registry works for us as long as we are on windows 10. Microsoft has pushed this on windows update for windows 11 and there is powershell commands that you have to run on all windows 11 user.
I tested on Windows 11 today and the registry fix worked. What PowerShell commands do you refer to?
Look for message center article MC676298 by Microsoft. Remove-AppxProvisionedpackage needs to be run as Microsoft is going to push through windows update.
The joys of writing a blog in July when subsequent information emerges in September. For some reason, MC676298 isn’t in the message center for my tenant…
In any case, the PowerShell commands reference removing the app package from the Windows image used to populate apps for new user accounts created on a PC. I have added some text to cover this point.
Glad I was able to share some details.
It’s a community…
Hi Tony! Thanks for your great post!
Is there any relationship between the OneWinNativeOutlookEnabled and UniversalOutlookEnabled parameters? What happens if OneWinNativeOutlookEnabled = True and UniversalOutlookEnabled = False? Thanks!
OneWinNativeOutlookEnabled is the control for Monarch. According to the Set-CASMailbox documentation, “The UniversalOutlookEnabled parameter enables or disables access to the mailbox using Windows 10 Mail and Calendar.” I imagine that UniversalOutlookEnabled will be deprecated in the future.
How would you force the Monarch client by default. This new client would be great for our Citrix environment. Better than OWA.
Not yet. I imagine that this will be possible in the future after Monarch reaches general availability.