Outbound Guard (Outlook)

Outbound Guard is an Outlook add-in for Outlook compose and send. Offline SoftBlock covers configured pattern categories (CPR by default; email, phone, IBAN, and cards when enabled in policy). With the org Outlook package, cloud scan uses the organization's selected categories. Optional Prompt Guard AI names apply when AI is enabled. On-device name detection (Outlook) is off until an organization admin turns it on in Settings.

Policy

Open Settings → Security → Outbound Guard: start with a preset (Recommended, Onboarding mode, Law firm, Municipality, Finance, or Custom), then adjust essentials (what to protect, SoftBlock severity, trusted domains). Onboarding mode uses the Recommended detectors with send prompts off, so a pilot does not interrupt mail. Use Customize more… for allowlists, custom detectors, recipient risk rules, attachments, team profiles, and audit options. By default SoftBlock runs only when any To/Cc/Bcc recipient is outside your trusted domains.

On-device name detection (Outlook)

On-device name detection (Outlook) uses the same name-detection engine Cases uses. It is separate from Prompt Guard AI names. It is off by default.

Turn it on under Settings → Security → Outbound Guard → Customize more (allowlists, detectors, teams…) → Offline and cloud → On-device name detection (Outlook).

Scan vs Send

Scan message runs on-device name detection with a short timeout. If name detection misses or times out, the scan still completes (fail-open). Pattern detection still runs on Scan message and on Send.

Send reuses the last Scan message name-detection result only if the compose body is unchanged. If you edit the draft after Scan message, Send uses pattern detection and confidential intent only. Unlabeled names from name detection will not SoftBlock until you Scan message again.

Detect only vs SoftBlock

Each category has four actions: Off, Detect only, Clean in pane, and SoftBlock on send. Only Detect only is pane-visible only. Clean in pane and SoftBlock on send can both SoftBlock Send.

• Off: this category is not detected.
• Detect only: shows a finding in the pane so reviewers can see it. Detect only does not stop Send by itself.
• Clean in pane: Clean message can wipe these findings. Leftover findings in this category still SoftBlock Send (same send gate as SoftBlock on send).
• SoftBlock on send: SoftBlock Send according to severity and recipient rules.

SoftBlock outcomes

• Warn shows Don't Send and Send Anyway.
• Warn + reason shows Don't Send and Add reason: pick why in Guard, then Send Anyway.
• Block should show Don't Send and Open Guard: wipe in Guard, then send. On some Outlook clients (including Outlook on the web), Send Anyway may still appear. Microsoft SoftBlock only documents a Prompt User override. SoftBlock is not a Purview or mail-flow hard stop. If the add-in does not run, Outlook can still send.

When Settings → Security → Outbound Guard → Block send if Guard policy is out of date is on, SoftBlock denies Send if the cached mailbox roaming policy is older than 24 hours. Outlook shows Don't Send and Open Guard. On some Outlook clients (including Outlook on the web), Send Anyway may still appear. SoftBlock is not a Purview or mail-flow hard stop. If Guard never runs in that mailbox, Outlook can still send.

Using the Outlook pane

The Outlook pane is findings-first: Scan message lists findings at the top. Details is collapsed by default. Open Details for clean style, policy, and scan scope.

Sideload POC

On Trial, Enterprise, the Outlook-only SKU, or a Cases plan with Outbound Guard licensed on Billing, open Outbound Guard → Setup → Try without admin. Download the Outlook manifest, then open https://aka.ms/olksideload → My add-ins → Custom Addins → Add a custom add-in → Add from File. Microsoft's new Apps store cannot install custom XML; use that dialog.

If Outlook returns “Sideloading rejected by Exchange”, the tenant likely blocks user-installed custom add-ins. Use Org-wide deploy (Integrated apps), or ask an admin to enable Apps for Outlook (AppsForOfficeEnabled) and the My Custom Apps role for your mailbox.

Org-wide deploy

Download the deployment ZIP from Outbound Guard → Setup and upload the Outlook manifest in Microsoft 365 admin center → Settings → Integrated apps (Centralized Deployment). Cloud scan for your org is already in that XML. Sideload XML from Try without admin stays CPR-only.

If a downloaded package leaks, rotate Outlook access on Outbound Guard → Setup, download the ZIP again, and re-upload the XML.

Cloud scan and confidential intent

Cloud scan runs the organization's pattern set. On the org Outlook path, optional Prompt Guard AI names still apply when AI is enabled. On-device name detection (Outlook) runs only when that Settings toggle is on. Prompt Guard on the clipboard does not use the on-device Outlook name-detection path.

Confidential intent: with cloud scan, Outbound Guard can review subject and body for leaks that are not just numbers (playbooks, how we undercut competitors, unpublished pricing, credentials). High-risk intent SoftBlocks on send even when no CPR is present.

Correspondents

Maintain an org directory (citizen, client, opposing, press, authority). Own email on To/Cc is allowed. Any CPR SoftBlocks. Press and opposing escalate. Override sends once.

Attachments

Attachments are inspected on Send (PDF and Office text extract, with a timeout). Unscanned or timed-out files are a distinct outcome. SoftBlock uses the same send-gate categories as the body: Detect only in a file does not stop Send. If a file needs permanent redaction, that is a Cases job when the org is entitled.

IT Ops, Insights, and DPIA

IT Ops alerts: org admins open Outbound Guard to acknowledge or resolve flags from SoftBlock, send overrides, high finding volume, or intent. Insights shows category counts, high-risk mailboxes, and destination domains. Telemetry stores mailbox, counts, intent labels, and domains, not message bodies. Subscribe a webhook to outbound_guard.alert for SIEM.

Accountability: export a body-free DPIA pack (prevented leaks, would-have-leaked, coaching). No raw CPR.