ThreatPrevent
ThreatPrevent
Cyber Trust Intelligence
ThreatPrevent
Microsoft 365 integration

Outlook and Exchange Online

Add ThreatPrevent trust assessments to Outlook so users can check email addresses, domains and public IP addresses while reading or composing messages.

Read checks

Run a live trust assessment while viewing an email.

Compose protection

Warn users before sending to an Elevated or Unsafe recipient.

Organisation visibility

Owners and administrators can review assessment activity and policy.

Data processed

Indicator extraction takes place in the add-in. ThreatPrevent receives only the email addresses, domains and public IP addresses required for the assessment. The message subject and body are not sent to or stored by the ThreatPrevent API.

Before you start

  • An active ThreatPrevent organisation with Outlook integration enabled.
  • ThreatPrevent organisation owner or administrator access.
  • Microsoft 365 administrator access for central add-in deployment.
  • A test user or group for the initial rollout.
  • Supported Outlook clients with modern Office add-in support.

1. Create the Outlook deployment

Open Developer access and select Deploy Outlook. ThreatPrevent creates a separate public OAuth application with the correct PKCE grants, scopes and redirect URI. You do not need to create or configure a general OAuth application first.

The organisation-specific manifest downloads as soon as configuration completes. The dedicated Outlook application is labelled in the OAuth application list so it cannot be confused with server integrations.

2. Obtain the approved manifest

If you need another copy, select Download manifest in Developer access. It contains that organisation's public client ID and a unique Microsoft add-in identifier. Do not copy a manifest between organisations or alter its URLs, permissions or application identifier.

Open Developer access

3. Deploy in Microsoft 365

  1. Open the Microsoft 365 admin centre.
  2. Go to Settings → Integrated apps → Add-ins → Deploy Add-in.
  3. Upload the approved ThreatPrevent manifest.
  4. Assign it to a test user or test group first.
  5. Allow time for Microsoft 365 propagation, then restart Outlook or sign out and back in.
  6. After successful testing, expand assignment to the intended users or groups.

4. Verify the integration

  1. Open an existing email and select Check trust.
  2. Sign in to ThreatPrevent and approve the requested access.
  3. Confirm that sender, domain, URL-domain and public-IP results appear.
  4. Repeat the scan to confirm cached results, then use Rescan for a fresh assessment.
  5. Compose a test message and verify the warning for an Elevated or Unsafe recipient.
  6. Confirm assessment activity appears in the organisation developer controls.

Troubleshooting

  • Add-in missing: check the Microsoft 365 user assignment and allow for deployment propagation.
  • Sign-in rejected: confirm the OAuth client remains active and includes integration:exchange.
  • Redirect error: confirm the registered redirect URI exactly matches the value above.
  • User has no organisation access: confirm the user is a member of the organisation associated with the OAuth client.
  • Assessment unavailable: record the time and visible error, then contact ThreatPrevent without sending tokens or message content.

OAuth permissions

The add-in requests integration:exchange to perform message indicator assessments, openid profile email for user identity, and offline_access to maintain the signed-in session using rotating refresh tokens.