michaelsanford / walled-garden-for-outlook

A compliance Add-in for Microsoft Outlook to analyse sender lists for recipients outside your organization.

Walled-Garden Add-in for Outlook

A compliance Add-in for Microsoft Outlook to analyse sender lists for recipients outside your organization.

How it Works

The Add-In will extract the sender's (From: ) organization domain to match it against all recipients.

When the email is Sent, all Recipients - in To: , CC: and BCC: - will be matched against the sender's domain.

Any recipient whose domain does not match the sender's will trigger a popup, listing each "outsider" recipient and confirming if the messgae should be send anyway.

Answering No will return to the compose window.

Answering Yes will release the message.

Installing

1. Go to Releases and choose the Latest.
2. Download the Zip and validate the checksum.
3. Run setup.exe
4. Restart Outlook to load the Add-in

Troublehooting

1. Open Outlook
2. Ensure there is no yellow warning under Slow and Disabled COM Add-ins. You can re-enable it there.
3. Navigate to File > Options (bottom-left, above Exit) > Add-ins
4. Ensure "Walled Garden for Outlook" is installed and not disabled.

ℹ️ If Outlook has disabled this add-in on your system because it was flagged as being slow to start, please file a bug.

Uninstalling

From Windows

1. Press Start
2. Type "Add or remove programs"
3. Search for "Walled Garden for Outlook"
4. Choose it and select Uninstall.

Forcing Removal in Outlook

If you have installed this Add-in using a Release package (ran a setup.exe) use the above method instead.

1. Open Outlook
2. Navigate to File > Options (bottom-left, above Exit) > Add-ins
3. Choose Manage: COM Add-ins and click Go.
4. Choose "Walled Garden for Outlook" and click Remove.
5. Restart Outlook.

Contributing

I welcome contributions and bug reports; please file an issue.

Attributions

Add-in icon courtesy bitfreak86

walled-garden-for-outlook's Issues

ItemSend can introspect multiple open mail mail items (instead of just the one being sent)

It seems that #OutlookApplication_ItemSend's Item can introspect all open mail items, and not only the one to which the Send event was invoked.

This happens if one of the open messages is a Reply, rather than a thread-initiator.

More specifically, this may happen if more than one email being composed shares the same subject.

H/T @vincentdeschenes

Flagged as Slow Add-in at load

The add-in causes a delay when loading Outlook and must be added to the Always Enabled list to prevent Outlook disabling it automatically.

Look at compile options, best practices around instantiating the plugin.

Community feedback on fixing this (including a PR) is welcome!

Project Scaffold & MVP Feature Set

MVP Feature Set

Initial Behaviour

The intent is to prevent the send from mistakenly sending emails to parties outside the intended organization.

The compliance case this add-in is intended to solve always amounts to having a recipient list with heterogeneous domains: mixing sender domain with a clients or free email service, or sending to more than one client domain.

Requirements

1. Installable VSTO Add-in scaffold - (useful doc / perhaps-outdated quickstart)
2. Hook into some useful event: add recipient, intent to send, other candidates?
3. React: display warning banner / popup.

Add tests

Simple tests

• Does it trigger on outside domains?
• Does it not trigger on internal domains?
• Test for case from #6 ?

Add to documentation that Outlook needs to be restarted after the install for the plugin to be active

Ignore AAD destination addresses in recipient check

When sending a Reply to an existing message, organization-internal addresses are pre-resolved to their AD/AAD form, which do not even contain an @ and look like this

/O=EXCHANGELABS/OU=EXCHANGE SOMETHING GROUP (XXXXXXXXXXXXXXXX)/CN=RECIPIENTS/CN=XXXXXXXXXXXXXXXXXXXXXXXXXXX-YYYYYYY

Those should simply be ignored since it is impossible (I hope) to resolve external recipients in this way.

Build and Release via CI/CD

Extremely desirable to provide traceability that the artifact available on Releases provably came from this repository.

Rules Configuration

The MVP rules engine will be extremely simple, allowing only the following:

1. Global Enable/Disable
2. Always-allow To list (or pattern)
3. Always-allow Cc list (or pattern)