Configure Outlook object model prompt when executing Save As
This registry value controls how the Outlook object model responds when an untrusted program uses a protected `SaveAs` method to save an Outlook item to a file outside Outlook.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\outlook\security\promptoomsaveas
This registry value controls how the Outlook object model responds when an untrusted program uses a protected SaveAs method to save an Outlook item to a file outside Outlook. It governs programmatic access and does not control an interactive Save As operation initiated by the user.
promptoomsaveas is a REG_DWORD value with the following meanings:
0: Outlook automatically denies the programmatic operation.1: Outlook asks the user to approve each access attempt.2: Outlook automatically approves the programmatic operation.3: Outlook bases the prompt on the computer's security status. Access proceeds without a warning when suitable antivirus software is active and current; otherwise, Outlook prompts the user.
When the policy value is not in effect, Outlook uses the Programmatic Access setting in the Trust Center to determine the behavior.
Notes
Security
This setting protects an entry point through which a program can save Outlook items and their contents to a specified location. A value of 0 blocks this export path for untrusted programs without relying on a user decision.
A value of 2 removes that safeguard for the affected SaveAs calls. Malicious code that is already running in the user's context and can automate Outlook could consequently save Outlook items as files without a warning. The setting does not, by itself, grant general access to all Outlook data, arbitrary file access, permission to send messages, or access to other protected object-model operations.
With a value of 1, the user decides whether each attempt may proceed. Because Outlook and Windows cannot always identify the calling COM application in a way that gives the user sufficient context, prompting does not provide dependable protection if unexpected requests are routinely approved.
Possible side effects
Automatic denial can break legitimate automation, add-ins, or other programs that export Outlook items through a protected SaveAs method. The save operation then fails, and the visible result depends on how the calling application handles the failure.
Prompting for every attempt can interrupt workflows or produce repeated dialogs during bulk operations. Security-status-based behavior can also change when Outlook's assessment of the installed antivirus software changes.
Notes
The policy applies to protected SaveAs methods for Outlook object types such as messages, appointments, contacts, and tasks. It does not govern every Outlook save operation; for example, it should not be treated as a policy for Attachment.SaveAsFile.
The 16.0 policy branch is shared by the administrative templates for Microsoft 365 Apps and the supported desktop releases Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. For Outlook security policies to govern the behavior, Outlook Security Mode must also be set to use Outlook Security Group Policy.
Microsoft documentation
Microsoft Learn: Security Behavior of the Outlook Object Model
Microsoft Learn: Protected Properties and Methods
Microsoft Learn: Information for administrators about e-mail security settings in Outlook
Microsoft Download Center: Administrative Template files for Microsoft Office