Enterprise Email Security & Smart Alerts Outlook Add-in

Overview

To enhance enterprise email security and prevent accidental data leakage, I developed a comprehensive Outlook Web Add-in. The solution operates on two fronts: a headless background service that intercepts outgoing emails using Microsoft’s Smart Alerts, and an interactive taskpane that empowers users to report security incidents and access IT utilities seamlessly.

The Challenge

Enterprise organizations frequently face risks from accidental external email disclosures and delayed phishing reporting. Standard server-side Data Loss Prevention (DLP) can be slow to react, and manual phishing reporting processes are often too cumbersome for end-users, leading to underreporting.

The Solution

I engineered a client-side Outlook Add-in that integrates directly into the user's native workflow without requiring them to leave their inbox.

Key Features & Implementation

\

• Smart Alerts (Data Loss Prevention): Implemented a background runtime that listens to the OnMessageSend event. Before an email leaves the outbox, the script asynchronously fetches and evaluates the To, CC, and BCC fields against the organization’s internal domains. If an external recipient is detected, it triggers a native Outlook Smart Alert popup, warning the user and allowing them to review or cancel the send.

\

• One-Click Phishing Reporting: Built a secure, one-click reporting mechanism using MSAL.js and the Microsoft Graph API. When a user flags a phishing email, the add-in automatically extracts the raw internet headers, attachments, and email body. It then packages this data into a High-Importance email and dispatches it directly to the Security Operations Center (SOC). It also includes a dynamic severity toggle (e.g., “User Clicked Link”) to adjust the alert priority automatically.

\

• Modular Advanced UI: Designed a clean, lightweight taskpane with an “Advanced Options” toggle. To maintain performance and prevent UI bloat, secondary IT tools and manual reporting forms are loaded dynamically as isolated HTML fragments only when requested by the user.

\

• Utility Tools: Included everyday productivity features for IT staff, such as a standardized email timestamp formatter/copier and quick-access links to internal portals.

Technical Highlights

\

• Headless Background Execution: Configured the XML manifest to utilize a lightweight JavaScript-only runtime for the OnMessageSend event, ensuring zero UI lag during the send process.

\

• Asynchronous Promise Handling: Wrote robust JavaScript to handle concurrent asynchronous calls to the Office.js API (fetching To, CC, and BCC simultaneously) with built-in safety timeouts to prevent the Outlook client from freezing.

\

• Secure Authentication: Integrated Microsoft Authentication Library (MSAL) to silently acquire Graph API tokens, ensuring secure, seamless communication with Exchange without disrupting the user experience.

Impact

This add-in significantly reduced the risk of accidental external data exposure and streamlined the phishing reporting workflow, resulting in faster incident response times for the IT security team.