Set Outlook object model custom actions execution prompt
This `REG_DWORD` value determines how classic Outlook for Windows responds when a custom action is executed through the Outlook object model.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\outlook\security\promptoomcustomaction
This REG_DWORD value determines how classic Outlook for Windows responds when a custom action is executed through the Outlook object model. Custom actions extend Outlook functionality and can, for example, be triggered by a rule.
The value data has the following meanings:
0– Automatically deny execution.1– Prompt the user to allow or deny execution.2– Automatically approve execution.3– Prompt according to the computer's security state. The policy template identifies this as the default behavior.
Notes
Security
Custom actions can invoke security-sensitive Outlook object model operations. Among other capabilities, a custom action can reply to messages in a way that bypasses the programmatic send protections that would otherwise apply.
Value 2 removes the user-confirmation boundary. Untrusted or compromised code could consequently invoke a suitable custom action without a security prompt, potentially sending messages or accessing Outlook data exposed to that action. It does not grant general administrative privileges or unrestricted access to all Outlook data.
Value 1 leaves the decision to the user, so protection also depends on the user correctly recognizing and evaluating the requesting action. Value 0 blocks the affected actions entirely. With value 3, Outlook considers the security state reported by Windows; in particular, antivirus status can affect whether a warning is displayed.
Possible side effects
Value 0 can prevent rules, custom forms, or other Outlook extensions from working when they depend on custom actions executed through the Outlook object model. Value 1 can interrupt automated workflows with recurring confirmation prompts.
Notes
This is a per-user setting from the administrative templates for classic Outlook for Windows. The 16.0 registry branch is shared by Outlook 2016 and later classic desktop releases based on the same Office version family.
Outlook must be set to use the Outlook security Group Policy for subordinate security values of this type to be evaluated. Without that parent security setting, promptoomcustomaction might have no effect.
Microsoft documentation
Microsoft Learn: Information about e-mail security settings in Outlook
Microsoft Support: Warnings about a program accessing Outlook or sending email
Microsoft Download Center: Administrative Template files for Microsoft Office