Configure Outlook object model prompt when sending mail
This per-user `REG_DWORD` value controls how the Outlook Object Model Guard in classic Outlook responds when an untrusted program attempts to send an item programmatically.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\outlook\security\promptoomsend
This per-user REG_DWORD value controls how the Outlook Object Model Guard in classic Outlook responds when an untrusted program attempts to send an item programmatically.
The value data has the following meanings:
0: Outlook automatically denies the send call.1: Outlook prompts the user to approve each protected send call.2: Outlook automatically approves the send call.3: Outlook bases prompting on computer security. A prompt appears when the antivirus software status reported by Windows is inactive or out of date.
When a prompt is displayed, approval applies only to the send call that triggered it. Subsequent programmatic send calls can generate additional warnings.
Notes
Security
A value of 2 removes user confirmation for protected send calls. Any program capable of automating Outlook in the user's context can therefore send mail through the Outlook object model without approval for the individual operation. Malicious software could use this behavior to send messages without the user's knowledge.
The setting does not grant administrative privileges or additional mailbox permissions. The calling program remains limited to the Outlook profiles, accounts, and sending permissions available to the signed-in user.
A value of 0 blocks these send calls regardless of whether the calling program is legitimate or malicious. Values 1 and 3 retain user-controlled or security-status-dependent oversight of the operation.
Possible side effects
With a value of 0, applications and automation solutions that send messages through protected Outlook object-model methods might fail. Outlook blocks the call and can return the MAPI_E_NOT_SUPPORTED error.
With a value of 1, the user must approve every affected send operation individually. The send warning includes a five-second delay before the user can allow the operation, which can substantially delay or interrupt bulk and automated processes.
With a value of 3, visible behavior can change when Windows reports a different antivirus status, such as after security software expires or its monitoring becomes inactive.
Notes
This value belongs to Outlook's administrative programmatic-security policy. Outlook applies the setting only when the parent Outlook Security Mode policy is configured to use Outlook Security Group Policy. Otherwise, Outlook handles untrusted programmatic send attempts according to the Programmatic Access setting in the Trust Center.
The setting governs protected send operations performed through the Outlook object model. It does not generally allow or block other APIs or message-delivery mechanisms.
Microsoft documentation
Microsoft Learn: Outlook Object Model Security Warnings
Microsoft Learn: Security Behavior of the Outlook Object Model
Microsoft Learn: Information for administrators about e-mail security settings in Outlook