Administrator guide: the Ascripto Outlook add-in

Last reviewed 20 October 2026

For the Microsoft 365 administrator asked to deploy the add-in, and for anyone evaluating what it reads, what it sends and where it sends it.

What it does

One add-in, two jobs. Which one it does is decided by your plan, and Ascripto tells it at every message, so a change of plan takes effect at each person’s next message with nothing to redeploy.

• On the free plan it reads. When someone opens a new message, the add-in finds the signature Outlook put in it, cuts that part out on the device, and sends it to Ascripto, which checks it against your directory. Home shows who is off-brand and why, per Outlook app.
• On a paid plan it inserts, while Set each person’s signature as they write is on in Settings → Delivery (it is unless you turn it off). On every new message, reply and forward it puts the person’s current signature in as Outlook’s own signature, so they see it while writing, in Sent Items and on their phone. Turned off, the add-in reads instead and the audit resumes.

Nobody installs anything themselves. You deploy it once, for everyone or for the groups you choose.

Deploying it

Before you start: Microsoft 365 must be connected in Ascripto (Settings → Connections). The add-in signs in with the same Ascripto application your administrator approved there, so it asks nobody for anything more.

Who can deploy it: a Global Administrator, or an Exchange Administrator who also has the Application Administrator role or may register applications. Only the administrator who deployed it, or a Global Administrator, can remove it.

1. In Ascripto, open Settings → Delivery and download the add-in’s manifest (it is also at https://outlook.ascripto.com/manifest.xml).
2. In the Microsoft 365 admin center, open Settings → Integrated apps and choose Upload custom apps.
3. Choose Office Add-in, then upload the manifest file from your device, or give the manifest’s link above instead.
4. Assign it to the entire organization, or to specific users or groups, and deploy it. Microsoft deploys to top-level groups only: members of a group nested inside another do not get it.

Then wait. Microsoft says a deployed add-in can take up to 24 hours to reach people, and up to 72 to appear in Outlook’s ribbon. The add-in does its work without being opened, at every new message; Settings → Delivery shows the first signature read or set as it arrives, so you know when it has reached someone.

Updates. The add-in’s code is served from outlook.ascripto.com and updates itself. A change to the manifest itself (its name, icons or permissions) needs an administrator to upload the new one; we will tell you before any.

What it reads and sends

When it reads (free plan)

• Only new messages, never replies or forwards, and only as the message opens, before anything is typed.
• It reads that message’s body on the device and finds the signature by the markers each Outlook app puts around it (the same ones the Ascripto relay recognises).
• It sends only that signature, at most 64 KB of its HTML, with which Outlook app it is and its version, which marker found it, and whether Outlook says a signature is switched on (Outlook for iOS cannot say).
• It sends again only when the signature has changed, or after a week, so that the person stays counted as seen.

Ascripto checks the signature against your directory: whether there is one at all, and whether it carries the person’s name, the job title and work phone the directory has, and a logo. It keeps the result and what the directory said should have been there. The signature itself is not stored or logged.

When it inserts (paid plan)

• At every new message, reply and forward it asks Ascripto for the person’s signature, naming the Outlook app it is running in, and puts the signature in with Outlook’s own signature function.
• It keeps the last signature in the add-in’s settings in the person’s mailbox, so the next message gets it at once, even before Ascripto answers. Those settings follow the person to each of their Outlook apps.
• It sends nothing about the message.

What it never reads

Mail people receive, any other message, subjects, recipients, attachments, and anything a person types. It sees the body of a new message once, as it opens, and only on the free plan.

Who it says the person is

The add-in asks Microsoft for a token for Ascripto’s own permission, access_as_user, through nested app authentication. Ascripto identifies the person by the token’s tenant and object IDs, matched to the person in your connected directory, never by an email address. The token is checked and not kept.

Where it goes

To outlook.ascripto.com, which serves the add-in and passes its two calls to your workspace’s Ascripto deployment, on Microsoft Azure in Germany West Central (Frankfurt) like the rest of the service. Calls are limited per person.

Which Outlook apps

With the relay

The add-in and the relay work together. A person sees their signature while writing, and every message is still signed on its way out, from any app. Recipients get one signature, the relay’s: it replaces Outlook’s signature block, with the add-in’s signature inside it, rather than adding a second.

When it cannot

• It never stops anyone writing or sending. If Ascripto does not answer, or Microsoft gives no token without asking the person to sign in, the add-in inserts the signature it kept, or leaves the person’s own Outlook signature where it is. A reading waits for the next new message.
• The first new message after Outlook on the web loads may be read before Outlook has put the signature in. That reading counts as couldn’t be read, apart from on-brand and off-brand, and the next one corrects it.
• While a workspace is suspended the add-in inserts nothing, and its readings are refused until the workspace is resumed. People’s own Outlook signatures stay as they are.

Seats and data

A person whose signature the add-in set at least once in the month is a seat, counted once however their mail is signed. Readings cost nothing.

For each person Ascripto keeps the latest result from each Outlook app (on-brand, off-brand or couldn’t be read, the findings with what the directory expected, which marker matched, the app’s version and when) and which apps it set their signature in; the audit’s runs are kept as on Google Workspace. They go when the person is removed from your directory and the recycle bin empties. Turning Set each person’s signature as they write on or off is recorded in your workspace’s administrator audit. Storage, retention and staff access are otherwise as in the Google Workspace guide and the DPA.

Removing it

1. In the Microsoft 365 admin center → Settings → Integrated apps, open Ascripto and remove it. It leaves people’s Outlook as Microsoft’s deployment catches up.
2. Nothing stays behind in people’s Outlook: the add-in sets the signature of each message, not their saved signatures.

To keep the audit but stop inserting, turn Set each person’s signature as they write off in Settings → Delivery instead.

Sources

• Get started with the integrated apps portal — Microsoft Learn
• Deploy Office Add-ins in the Microsoft 365 admin center — Microsoft Learn
• Activate add-ins with events — Microsoft Learn
• Nested app authentication and Outlook legacy tokens — Microsoft Learn