12.5 Office web add-ins
12.5.1 Which surface uses what
| Client | Labelling | Send-time enforcement |
|---|---|---|
| Word/Excel/PowerPoint for Windows | COM add-in (agent). The web panel is optional through the catalog share. | — |
| Classic Outlook for Windows (with agent) | COM add-in | COM add-in. If the web add-in is also deployed, its send handler defers to COM. |
| New Outlook for Windows, Outlook on the web | Web add-in | Web add-in (Smart Alerts or ItemSend) |
| Word/Excel/PowerPoint for Mac | Web add-in (sideloaded by the Mac agent, or M365) | — (no save/print hook on Mac; the Mac agent prompts for a label when a file is saved) |
| Outlook for Mac | Web add-in (M365 / Exchange) | Smart Alerts (16.65+, Exchange Online) or ItemSend (16.47+, on-premises) |
| Office on the web (Word/Excel/PowerPoint) | Web add-in (M365) | — |
12.5.2 Windows trusted catalog share (desktop web panel)
Use this to offer the web task pane in Office for Windows without Microsoft 365. Configure it in Policy → Rules → Agent Rules → Web add-in catalog (Windows only; covered fully in the Rules chapter):
| Field | What it does | Default / allowed values |
|---|---|---|
| Catalog share (UNC path) | One central read-only share, for example
\\dc.contoso.com\AdaManifests. No share is created on
clients. The agent points every client’s Office trusted catalog at this
path on each sync. |
Empty = catalog hidden on clients. Must be a UNC path
(\\server\share…); local paths and https URLs are
rejected. |
| Machine-aware web panels | Gives each machine’s web panel that machine’s group policy, using a
per-machine subfolder machines\HOSTNAME with a token in the
task pane URL |
Off. Switching it on or off changes the catalog path, so users add the add-in once again. |
| Push username / Push password | Account the server uses to write the Word/Excel/PowerPoint manifests into the share (SMB, signing supported). The password is stored only on the server. | — |
| Save & push now | Saves and pushes immediately. The line below shows
Last push: OK/FAILED — <time> (<detail>). |
Also pushes on every policy publish, and every 15 minutes when the manifests changed |
Users then add the panel once per Office app: Add-ins → More Add-ins → Shared Folder → Ada Data Classification → Add. Outlook is never put in the catalog; Outlook add-ins are mailbox-deployed.
12.5.3 Outlook on the web, new Outlook and Outlook for Mac
- Generate the Microsoft 365 add-in key and download
the keyed Outlook manifest (section 12.1.8). For on-premises Exchange,
take
manifest-outlook-onprem.xml. - Deploy it:
- Exchange Online: Microsoft 365 admin center →
Integrated apps, or
New-App -OrganizationApp. - On-premises:
New-App -OrganizationApp -FileData $Data -DefaultStateForUser Enabled.
- Exchange Online: Microsoft 365 admin center →
Integrated apps, or
- On-premises OWA: enable
OnSendAddinsEnabledon the OWA mailbox policy. - Mac: push
OnSendAddinsWaitForLoad. - Verify in a test mailbox. Send an unlabelled mail: it must be stopped with “You must choose a sensitivity label before sending this email.” (section 14.4).