Android app directory · Productivity

Microsoft Outlook managed configuration for Android

These are the managed configuration keys Microsoft documents for Outlook on Android, what each one does and how to roll them out. Many keys carry an Intune name, but Microsoft lists them as delivered through the Android Enterprise channel, so any EMM that can push app restrictions can send them. Microsoft's Exchange documentation holds the complete list, including the contact sync field keys.

Package name com.microsoft.office.outlook

Deploy Microsoft Outlook with Nomid Book a demo

Developer: Microsoft Corporation
Keys on this page: 24 documented
Works on: Work profile, Fully managed
Last checked: 2026-11-03

Common setups

Common Microsoft Outlook setups

Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.

Company mailbox only

Pre-fill the work account and stop people from adding a personal mailbox to the same app. Replace the address with a per-user value if your EMM supports variables.

{
  "com.microsoft.outlook.EmailProfile.EmailAddress": "user@example.com",
  "com.microsoft.outlook.EmailProfile.EmailUPN": "user@example.com",
  "com.microsoft.outlook.EmailProfile.AccountType": "ModernAuth",
  "com.microsoft.intune.mam.AllowedAccountUPNs": "user@example.com"
}

Keep mail inside the work profile

For personal phones with a work profile: do not copy contacts or calendar to the native apps, block external images, stop people changing those settings and prevent sharing of the inbox and calendar.

{
  "com.microsoft.outlook.Contacts.LocalSyncEnabled": false,
  "com.microsoft.outlook.Contacts.LocalSyncEnabled.UserChangeAllowed": false,
  "com.microsoft.outlook.Calendar.NativeSyncEnabled": false,
  "com.microsoft.outlook.Calendar.NativeSyncEnabled.UserChangeAllowed": false,
  "com.microsoft.outlook.Mail.BlockExternalImagesSetting": 0,
  "com.microsoft.outlook.Mail.BlockExternalImagesSetting.UserChangeAllowed": false,
  "com.microsoft.outlook.Mail.BlockSharing": true,
  "com.microsoft.outlook.Calendar.BlockSharing": true
}

Signed and encrypted mail

For teams that exchange sensitive mail: switch on S/MIME, require signing and encryption, stop people changing those settings and give Outlook a directory to find recipients' certificates.

{
  "com.microsoft.outlook.Mail.SMIMEEnabled": true,
  "com.microsoft.outlook.Mail.SMIMEEnabled.UserChangeAllowed": false,
  "com.microsoft.outlook.Mail.SMIMEEnabled.SignAllMail": true,
  "com.microsoft.outlook.Mail.SMIMEEnabled.SignAllMail.UserChangeAllowed": false,
  "com.microsoft.outlook.Mail.SMIMEEnabled.EncryptAllMail": true,
  "com.microsoft.outlook.Mail.SMIMEEnabled.EncryptAllMail.UserChangeAllowed": false,
  "com.microsoft.outlook.Mail.SMIMEEnabled.LDAPHostName": "ldaps://ldap.example.com:636"
}

Managed configuration

Microsoft Outlook managed configuration keys

Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.

Key	Type	What it does	Example
Account setup and allowed accounts
`com.microsoft.outlook.EmailProfile.EmailAddress`	Email address	Pre-fills the mailbox address so people do not have to type it when they first open Outlook.	`user@example.com`
`com.microsoft.outlook.EmailProfile.EmailUPN`	User principal name or username	Sets the sign-in name Outlook uses to authenticate the account. Most tenants use the same value as the email address.	`user@example.com`
`com.microsoft.outlook.EmailProfile.AccountType`	Text: ModernAuth	Tells Outlook which authentication model the account uses. The only documented value is ModernAuth.	`ModernAuth`
`com.microsoft.intune.mam.AllowedAccountUPNs`	User principal names	Turns on allowed-accounts mode, so only the listed work accounts can be added to Outlook. Microsoft documents it for Android devices managed through the OS channel.	`user@example.com`
Mail behavior
`com.microsoft.outlook.Mail.FocusedInbox`	On or off	Sets whether Focused Inbox is on. It is on by default, so set false to show one plain inbox.	`false`
`com.microsoft.outlook.Mail.BlockExternalImagesSetting`	Choice: 0 always block, 1 safe senders only, 2 always load	Controls whether remote images in messages are downloaded. Blocking them stops tracking pixels from confirming that a message was opened.	`0`
`com.microsoft.outlook.Mail.BlockExternalImagesSetting.UserChangeAllowed`	On or off	Set false so people cannot change the external images setting in the app. They can change it by default.	`false`
`com.microsoft.outlook.Mail.SuggestedRepliesEnabled`	On or off	Turns suggested replies on or off for the whole app. People can change it unless you also set com.microsoft.outlook.Mail.SuggestedRepliesEnabled.UserChangeAllowed to false.	`false`
`com.microsoft.outlook.Mail.TextPredictionsEnabled`	On or off	Controls the word and phrase suggestions shown while people write a message. People can change it unless you also set com.microsoft.outlook.Mail.TextPredictionsEnabled.UserChangeAllowed to false.	`false`
`com.microsoft.outlook.Settings.DaysToSync`	Number of days, 1 to 90	Sets how many days of mail Outlook keeps on the device. A lower number saves storage on shared or low-memory hardware. People can change it unless you also set com.microsoft.outlook.Settings.DaysToSync.UserChangeAllowed to false.	`14`
Sync and privacy
`com.microsoft.outlook.Contacts.LocalSyncEnabled`	On or off	Decides whether Outlook contacts are saved to the device's own Contacts app. Off by default.	`false`
`com.microsoft.outlook.Contacts.LocalSyncEnabled.UserChangeAllowed`	On or off	Set false so people cannot change the contact sync setting. They can change it by default.	`false`
`com.microsoft.outlook.Calendar.NativeSyncEnabled`	On or off	Decides whether the Outlook calendar is written to the device's Calendar app. Documented for Outlook on Android only.	`false`
`com.microsoft.outlook.Calendar.NativeSyncEnabled.UserChangeAllowed`	On or off	Set false so people cannot change the calendar sync setting. They can change it by default. Documented for Outlook on Android only.	`false`
`com.microsoft.outlook.Mail.ExternalRecipientsToolTipEnabled`	On or off	Shows or hides the warning that appears when a message is addressed to someone outside the organization.	`true`
`com.microsoft.outlook.Mail.BlockSharing`	On or off	When true, people cannot share their inbox from the app.	`true`
`com.microsoft.outlook.Calendar.BlockSharing`	On or off	When true, people cannot share their calendar from the app.	`true`
S/MIME
`com.microsoft.outlook.Mail.SMIMEEnabled`	On or off	Turns on S/MIME signing and encryption. Certificates must already be available to Outlook on the device.	`true`
`com.microsoft.outlook.Mail.SMIMEEnabled.UserChangeAllowed`	On or off	Set false so people cannot turn S/MIME off in the app. They can change it by default.	`false`
`com.microsoft.outlook.Mail.SMIMEEnabled.EncryptAllMail`	On or off	Requires every outgoing message to be encrypted.	`true`
`com.microsoft.outlook.Mail.SMIMEEnabled.EncryptAllMail.UserChangeAllowed`	On or off	Set false so people cannot change the encryption requirement. They can change it by default.	`false`
`com.microsoft.outlook.Mail.SMIMEEnabled.SignAllMail`	On or off	Requires every outgoing message to be signed.	`true`
`com.microsoft.outlook.Mail.SMIMEEnabled.SignAllMail.UserChangeAllowed`	On or off	Set false so people cannot change the signing requirement. They can change it by default.	`false`
`com.microsoft.outlook.Mail.SMIMEEnabled.LDAPHostName`	Directory address	Points Outlook at the LDAP directory where it looks up other people's certificates.	`ldaps://ldap.example.com:636`

Permissions

Permissions Microsoft Outlook asks for

Runtime permissions people are prompted for. A Nomid policy can grant, deny or leave each one to the person using the device.

Permission	Android name	Why it asks	Common choice
Contacts	`android.permission.READ_CONTACTS`	Lets Outlook save contacts to the native Contacts app inside the work profile when contact sync is on.	Deny unless needed
Calendar	`android.permission.READ_CALENDAR`	Lets Outlook sync its calendar with the native Calendar app inside the work profile.	Deny unless needed

Permissions change between app versions. Checked in Deploying Outlook for iOS and Android app configuration settings in Exchange Online.

Deploy with Nomid

Roll Microsoft Outlook out in three steps

Step 1Add Microsoft Outlook to a policy
Find it on Google Play from the policy’s apps list and choose how it is installed.
Step 2Set its managed configuration
In the policy, set the app’s managed configuration with the keys and values from this page.
Step 3Assign the policy
Devices in the policy receive Microsoft Outlook and its configuration on their next sync.

Questions

Microsoft Outlook on managed Android

What is Microsoft Outlook's package name on Android?

com.microsoft.office.outlook. Use it to find the app when you add it to a policy, or in an adb command.

Do these keys only work with Intune?

No. Microsoft lists most of them as delivered through the Android Enterprise OS channel, so another EMM can send them as managed configuration. Keys with IntuneMAMOnly in the name need an Intune app protection policy and will not do anything on their own.

Why does the allowed accounts key have Intune in its name?

It comes from Microsoft's app management SDK. Outlook reads it from the Android restrictions bundle as well, which is why Microsoft documents it for devices managed through the OS channel. The value is a list of work account names.

Are the key names case sensitive?

Yes. Microsoft warns that the keys must be typed with the exact casing shown, or the setting will not take effect.

Manage Microsoft Outlook on your fleet

Add the app to a Nomid policy, set its configuration and choose its permissions.

Start free Book a demo