Short answer:
If your Microsoft 365 tenant uses Microsoft Entra Privileged Identity Management (PIM), you may be unable to deploy or manage Office add-ins through Centralized Deployment, even after activating the correct admin role. This is a Microsoft known issue and is not specific to the Xink Outlook add-in.
Some Microsoft 365 administrators may see permission-related errors when trying to deploy, update, remove, or manage Office add-ins from the Microsoft 365 admin center.
This can affect the deployment of the Xink Outlook add-in, but the issue is related to Microsoft’s Office add-in deployment service and how it handles PIM-enabled admin roles.
Who is affected?
This issue may affect Microsoft 365 tenants where administrators use Microsoft Entra Privileged Identity Management (PIM) to activate admin roles before managing Office add-ins.
For example, an administrator may activate the required role through PIM and then go to:
- Microsoft 365 admin center
- Settings > Integrated apps
- Office Add-ins or Centralized Deployment
Even though the role appears to be active, Microsoft may not correctly honor the PIM-enabled permission during the add-in deployment or management flow.
Symptoms
You may experience one or more of the following:
- You cannot deploy the Xink Outlook add-in through centralized deployment.
- You cannot update or remove an existing Office add-in.
- The Microsoft 365 admin center shows a permission or authorization error.
- The admin role was activated through PIM, but the deployment flow still behaves as if you do not have sufficient permissions.
- Role-based access control (RBAC) authorization fails during add-in deployment or management.
Cause
Microsoft has confirmed a known issue where PIM-enabled admin roles are not correctly honored when deploying or managing Office add-ins through centralized deployment.
This means the Microsoft 365 admin center may return a false permission denial, even when the administrator has activated the required role through PIM.
This issue is not caused by the Xink Outlook add-in, the Xink manifest, or your Xink account configuration.
Microsoft status
Microsoft lists the issue as:
- Status: Open
- Tracking ID: 11126536
- Impact: Admins are unable to deploy Office Add-ins via centralized deployment when using PIM-enabled admin roles.
You can review Microsoft’s current status here:
Microsoft: Office Add-ins known issues - PIM-enabled tenants
Workaround
Microsoft’s recommended workaround is to avoid using a PIM-enabled role if you are blocked by this issue.
As a temporary workaround, ask an administrator with the required role assigned as an active, non-PIM role to deploy or manage the Office add-in.
After the add-in has been deployed successfully, you can continue using your normal security and role management process for ongoing administration.
Recommended actions
- Confirm whether your tenant uses Microsoft Entra Privileged Identity Management (PIM) for admin roles.
- Confirm whether the affected administrator activated their role through PIM before managing Office add-ins.
- If deployment fails, ask an administrator with a required active admin role that is not PIM-activated to try the deployment.
- Check the Microsoft known issues page for updates to tracking ID 11126536.
- If needed, open a support case with Microsoft and reference the Microsoft tracking ID.
Important note about the Xink Outlook add-in
The Xink Outlook add-in depends on Microsoft’s Office add-in deployment framework. If Microsoft Centralized Deployment is blocked by a tenant-level permission issue, Xink cannot override that Microsoft permission check.
Once Microsoft Centralized Deployment accepts the administrator permissions, the Xink Outlook add-in can be deployed as normal.
