With Outlook 2016 for Mac, there are exposed APIs that are accessible via AppleScript, ObjC, or JavaScript. These APIs are great for automation on a Mac! Unfortunately, from an enterprise/administrative standpoint, these are not feasible solutions for deployment.

With the introduction of WordMail for the compose editor in Outlook 2016 for Mac (15.22), a script warning was introduced, stating: "A script is attempting to send a message. Some scripts can contain viruses or otherwise be harmful to your computer, so it's important to verify that the script was created by a trustworthy source. Do you want to send the message?"

The dialog presented allows the user to select a checkbox that says: "Don't show this message again".

It then allows the user to click either "Send" or "Cancel".

The message implies that this dialogue is to allow the specific script that is running to establish some sort of trust. Unfortunately, this is not true - any time that same script interacts with Outlook, the user must press "Send" or "Cancel" again.

As for the checkbox, here is where there is a disconnect: if the user checks the box, ALL warnings for scripts will be suppressed. This is not a great way to handle security for scripts from an administrative perspective. On Windows, there is the Trusted Publishers Store, which allows administrators to impose strict limitations for add-ins; however, there is not a comparable management framework for Outlook 2016 for Mac. This request is comprised of three parts:

1) It would be great if there were the ability to whitelist specific scripts/app bundles by either signature or location to allow administrators to suppress this dialogue for only specific scripts that will interact with Outlook 2016 for Mac (or other Office for Mac applications).

2) The message should be changed to show that the checkbox, if checked, will apply to ALL scripts. Alternatively, the action of the checkbox could be changed to programmatically establish trust for the specific script that prompted the dialogue.

3) This whitelisting feature can be managed remotely, securely, and without user interaction.

We've written an application which interacts with the user's inbox on GMail, and we're adding support for Outlook.com users too.

As our app depends on the user having an inbox, we need to display an error when the user tried to login with a microsoft account they created for another domain. For example - if I create a Microsoft Account with a @gmail.com email address.

Trying to fetch email from GMail's API with a Google account wiith a Microsoft address returns an error, which allows to ask the users to try logging in with an alternative account.

Doing the opposite appears to cause Outlook to create an outlook_<SOME_GUID>@outlook.com email address, which cannot receive email, but will allow login to the outlook.com interface and even allow sending email out impersonating the user's sign in address. Really this scenario should just return an error without creating an outlook inbox.

I have been trying now for a FREAKING WEEK! to achieve this, using the EWS SOAP based system is absolutely disgusting.

In the managed API, or even better through the graph api, can we have a function to move/copy (is EWS, "Export" and "Upload") without having to use this horrid EWS SOAP based system?

Its so painful, I just cant get my head around. Stuff just doesnt work and the doco is horrible. I have been trying to do OAuth with EWS, and I dont know what the hell the issue is, but nothing works. Is there any doco to help me resolve, nope. Is there much good info on stack exchange, nope. I have set all correct headers one could set, nothing works.

In the end I will be going with a third party library that makes this so simple, Rebex. But I cannot understand why Microsoft has made it so hard to get a mail message from one box to another. I mean, if this was sharepoint, I can do a rest call to an item in one site collection, get its contents, and create a new document, pumping in my source contents into that new document in a completely different site collection. I know SP is not Exchange. but why is exchange so bloody frustrating and limited?

Can you please do something about it?

When creating a mail folder, you are able to specify the parent of the folder, but if you want to create a folder for other content types, such as appointments, tasks, etc., you cannot specify the parent of the folder if the parent is a normal folder. If you create a calendar called My Calendar, it will get created somewhere, but you have no control over where it gets created.

Similarly, there is no way to list folders of specific content types within a parent folder. For example, there is no way to list the calendar folders within a parent folder called "My Folder". This causes two issues:

1. Say you've got two calendars: "\MyFolders1\MyCalendar" and "\MyFolders2\MyCalendar", and then you use the REST API to return the calendars, you'll get two records called "MyCalendar", but you'll have no idea which one is which (unless of course you've got them added to different calendar groups).

2. The REST API only provides limited support for online archives. When you request mail folders, you can specify a Well Known Folder name. There are well known folder names for the root of the online archive, so using the well known names it is possible to traverse the mail folder hierarchy of the online archive mailbox. Since you can't specify a parent folder when requesting a Calendar, there is no way to access a calendar created on the online archive. The API only returns calendars existing within the main mailbox.