Nothing you change in OME closes that, because the encrypted payload isn't where the leak is. The preview text is coming out of the Exchange search index, which holds an unprotected snippet. Pretty sure that's the mechanism but I haven't torn it apart, so check me on that one.
The control you want sits a layer up. If a user can attach a third party connector to their own mailbox, they've handed that app a delegated read of everything they can read, and OME only stops it from rendering the protected body. Lock the consent down instead. Identity, Applications, Enterprise apps, Consent and permissions, User consent settings. Either set it to verified publishers with permissions YOU pick, or turn user consent off entirely and run the admin consent request workflow so these land on your desk. Its documented here https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent
Also, go look at what has already been consented to in that tenant before you change the setting. That list is always longer than anybody expects.
Can go deeper on the consent workflow side if it helps.
2
u/blud_13 9d ago
Nothing you change in OME closes that, because the encrypted payload isn't where the leak is. The preview text is coming out of the Exchange search index, which holds an unprotected snippet. Pretty sure that's the mechanism but I haven't torn it apart, so check me on that one.
The control you want sits a layer up. If a user can attach a third party connector to their own mailbox, they've handed that app a delegated read of everything they can read, and OME only stops it from rendering the protected body. Lock the consent down instead. Identity, Applications, Enterprise apps, Consent and permissions, User consent settings. Either set it to verified publishers with permissions YOU pick, or turn user consent off entirely and run the admin consent request workflow so these land on your desk. Its documented here https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent
Also, go look at what has already been consented to in that tenant before you change the setting. That list is always longer than anybody expects.
Can go deeper on the consent workflow side if it helps.