ASR Rule blocks Outlook Add-In

KW-5111 0 Reputation points
2023-07-13T11:54:01.77+00:00

Hello there

We've deployed ASR Rules via Sec. Basline for our customer. We've also installed an Outlook Plug-in (officeatwork) for managing Signatures in Outlook. On one device the ASR-Rule blocks the Outlook Add-In via "msedgewebview2.exe".

On the other device in the same tenant, same configuration everything is fine, no blocks.

How does it come? Any ideas?

Best regards

Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
417 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pavel yannara Mirochnitchenko 12,576 Reputation points MVP
    2023-07-13T12:08:15.0933333+00:00

    You can try to track ASR audit report in M365, which ASR rule causes that block and then remove that single ASR rule.

  2. Troy Nabbefeld 165 Reputation points
    2023-07-13T14:33:53.9433333+00:00

    I would deploy ASR rules via an Endpoint security Attack Surface Reduction Rules Policy. This allows you to put every rule on audit to begin with and monitor them to detect valid behaviors that shouldn't be blocked by the policy. Once you detect them, you can add per rule exclusions to each ASR rule. See screenshots below for instuctions.

    User's image

    User's image

    If the response is helpful, please click "Accept Answer" and upvote it.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.