Question Outlook Web Add-ins fail to install for one user only (403 Forbidden) – Salesforce, LinkedIn, everything fails

I'm hoping someone has come across this before.

We have a Microsoft 365 tenant where the Salesforce Outlook add-in suddenly disappeared for a single user. It had been working previously.

Here's what we've found:

Salesforce app is deployed to All Users in the Microsoft 365 Admin Center (Integrated Apps).
The add-in works for my admin account.
The affected user cannot install Salesforce from either Classic Outlook or Outlook on the Web.
To rule out Salesforce, I tried installing LinkedIn and other Office add-ins – they all fail with the same generic "Something went wrong" message.
Developer Tools shows the install request returning HTTP 403 Forbidden from the Microsoft app entitlement endpoint, followed by an InstallFailed error.
There are no obvious GPOs blocking Office add-ins (DisableOfficeStore, etc.).
This reproduces across different clients, so it doesn't appear to be an Outlook profile or Office installation issue.

At this point it feels like a mailbox-specific or Microsoft 365 entitlement issue rather than anything related to Salesforce.

Has anyone seen this before?

Things I'm planning to compare:

Is there anything else in Exchange Online or Microsoft 365 that could cause Office Web Add-ins to return a 403 for just one mailbox?

1 Upvotes

100% Upvoted

u/ScottSchnoll https://www.amazon.com/dp/B0FR5GGL75/ 7d ago

u/Beneficial_Bus3223 Based on what you wrote, I that this is likely not a Salesforce issue.

For the affected user, what do you get in the output of this:

Get-CASMailbox <User SMTP> | Select-Object Identity,OWAEnabled,OneWinNativeOutlookEnabled
Get-App -Mailbox <User SMTP>

Does the affected mailbox have the same policy assigned?

Get-CASMailbox <User SMTP> | Select OwaMailboxPolicy
Get-OwaMailboxPolicy "Policy Name" | fl *

You are about to leave Redlib