The default behavior is that if something goes wrong with the Safeguard Send for Microsoft 365 add-in during processing, such as a network error or a timeout, then Outlook will block the email from being sent and show an error message. However, this behavior can be changed by following the instructions below. You can choose to either allow the email to be sent without the add-in running or to cancel the email and return to the compose window. You can also choose to show a warning message before sending or canceling the email. These options can help you avoid losing or sending an email that has not been verified by the add-in.
Safeguard Send for Microsoft 365 should run for any users who have it installed. However, if users are required to run the add-in to meet compliance standards, then the group policy Block send when web add-ins can’t load must be set to Enabled on each applicable machine because by default, the on-send policy is disabled. Administrators can enable the on-send policy by ensuring the user’s group policy setting Block send when web add-ins can’t load is set to Enabled. To disable the policy for a user, the administrator should set it to Disabled.
To manage this policy setting, you can do the following:
Download the latest Administrative Templates tool.
Open the Local Group Policy Editor (gpedit.msc).
Navigate to User Configuration > Administrative Templates > Microsoft Outlook 2016 > Security > Trust Center.
Select the Block send when web add-ins can’t load setting.
Open the link to edit policy setting.
In the Block send when web add-ins can’t load dialog window, select Enabled or Disabled as appropriate then select OK or Apply to put the update into effect.
These instructions are also detailed at https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/outlook-on-send-addins?tabs=windows#install-outlook-add-ins-that-use-on-send. The article also discusses how to change the default behavior when using Outlook on the Web and on Macs (neither of which are covered here in this article).
You can also directly edit the registry. This is useful if you are familiar with using GPO.
Use this registry key if:
- You have perpetual Office licenses (2016/2019/2021)
- You manage Office through traditional on-premises Group Policy
- You’re not using Microsoft 365 Apps for Enterprise subscription
HKEY_CURRENT_USER\Software\Policies\Microsoft\office\16.0\Outlook\Addins\BlockSendifWebAddinFails
And use this registry key if:
- You have Microsoft 365 Apps for Enterprise (Office 365 ProPlus) subscriptions
- Your organization uses Azure AD and users sign into Office with Microsoft 365 credentials
- Your IT department manages Office through the Cloud Policy Service at config.office.com
HKEY_CURRENT_USER\Software\Policies\Microsoft\Cloud\office\16.0\Outlook\Addins\BlockSendifWebAddinFails
Set it to a value of zero (0).
It may not be present, and if not add it and it will be respected. Once set to zero, that setting allows for email to go through. When sending a message, you will get that status info bar that Safeguard Send is working on the message, then a brief status message about the draft being saved and shortly after that the message will send.
It’s possible that you need to set both registry locations if you have a mixed environment.
All of the above applies to those situations where Outlook cannot communicate with the add-in for any reason, such as a network error or timeout. However, it may be the case (as rare as it may be) that Outlook successfully calls the add-in but the add-in encounters an issue and fails to render the warning prompt. This could be due to the dialog already being opened in another window, or problems with permissions. The default in this case is to allow the message to be sent. If instead blocking the email is preferred, please enter a support ticket from the administrators’ dashboard referencing this article (just the URL) and the defaults needed, and the issue will be addressed.
Next Steps:
How to Use Safeguard Send for Microsoft 365 Effectively: Limitations and Solutions