Description
Two Baseline Security Mode settings are turned on in the Microsoft 365 admin center:
- Block files from opening with insecure protocols: Microsoft 365 apps refuse to open files from HTTP or FTP locations (Cloud Policy policy Block Insecure Protocols);
- Block files from opening with FPRPC protocol: apps never fall back to FrontPage Server Extensions RPC and use HTTPS instead (Cloud Policy policy Restrict Apps from FPRPC Fallback).
In both cases users can no longer override the behavior in the Trust Center.
Rationale
HTTP and FTP carry document content, and sometimes credentials, in clear text: anyone on the network path can read or modify them, or inject a malicious document. FrontPage RPC is a decades-old authoring protocol with a history of exploitable flaws. Microsoft 365 apps already block FPRPC by default; enforcing both settings removes the user override and the remaining cleartext paths.
Impact
Documents published on plain HTTP or FTP servers no longer open from Office; move them to HTTPS, SharePoint or OneDrive. Old intranet servers that only support FrontPage extensions stop working for file opens. Run the Baseline Security Mode impact reports first.
Audit
- Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
- Browse to Settings > Org settings > Security & privacy > Baseline security mode.
- Check that Block files from opening with insecure protocols and Block files from opening with FPRPC protocol are both turned on.
- In the Office Cloud Policy service (https://config.office.com), Customization > Policy Management, check that no policy configuration with a higher priority than the tenant one sets Block Insecure Protocols or Restrict Apps from FPRPC Fallback to Disabled.
- Fail if either setting is off or overridden for a group of users.
Remediation
- In Settings > Org settings > Security & privacy > Baseline security mode, open each setting and download its impact report; move the listed documents to HTTPS locations.
- Turn on Block files from opening with insecure protocols and Block files from opening with FPRPC protocol. Role: Office Apps Administrator.
- Alternative: in the Office Cloud Policy service, set Block Insecure Protocols and Restrict Apps from FPRPC Fallback to Enabled in a policy configuration targeting all users. No PowerShell cmdlet exists.
Rollback
Turn the settings off in Baseline security mode, or set the Cloud Policy policies back to not configured.
References
- Block insecure protocols for file opens Microsoft, vendor-doc, accessed 2026-10-24
- Block FPRPC protocol for file opens Microsoft, vendor-doc, accessed 2026-10-24
- Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SC-8 | related |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1557 |
| MITRE ATT&CK | T1203 |
Related controls
- related
CB-M365-DEVICE-012Block Basic authentication prompts in Microsoft 365 apps - related
CB-M365-DEVICE-014Open legacy Office file formats in Protected View
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
