{
  "id": "CB-M365-DEVICE-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-013.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-013",
    "title": "Block file opens over HTTP, FTP and FrontPage RPC in Microsoft 365 apps",
    "finding": {
      "title": "Microsoft 365 apps can open files over insecure protocols",
      "description": "Users can open documents over cleartext HTTP or FTP, or fall back to the FrontPage RPC protocol, exposing content and credentials to interception and legacy protocol attacks."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365-apps",
      "baseline-security-mode",
      "cloud-policy",
      "insecure-protocols",
      "encryption-in-transit"
    ],
    "description": "Two Baseline Security Mode settings are turned on in the Microsoft 365 admin center:\n\n- **Block files from opening with insecure protocols**: Microsoft 365 apps refuse to open files\n  from HTTP or FTP locations (Cloud Policy policy **Block Insecure Protocols**);\n- **Block files from opening with FPRPC protocol**: apps never fall back to FrontPage Server\n  Extensions RPC and use HTTPS instead (Cloud Policy policy **Restrict Apps from FPRPC\n  Fallback**).\n\nIn both cases users can no longer override the behavior in the Trust Center.\n",
    "rationale": "HTTP and FTP carry document content, and sometimes credentials, in clear text: anyone on the\nnetwork path can read or modify them, or inject a malicious document. FrontPage RPC is a\ndecades-old authoring protocol with a history of exploitable flaws. Microsoft 365 apps already\nblock FPRPC by default; enforcing both settings removes the user override and the remaining\ncleartext paths.\n",
    "impact": "Documents published on plain HTTP or FTP servers no longer open from Office; move them to HTTPS,\nSharePoint or OneDrive. Old intranet servers that only support FrontPage extensions stop working\nfor file opens. Run the Baseline Security Mode impact reports first.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Security & privacy** > **Baseline security\n   mode**.\n3. Check that **Block files from opening with insecure protocols** and **Block files from\n   opening with FPRPC protocol** are both turned on.\n4. In the Office Cloud Policy service (https://config.office.com), **Customization** > **Policy\n   Management**, check that no policy configuration with a higher priority than the tenant one\n   sets **Block Insecure Protocols** or **Restrict Apps from FPRPC Fallback** to **Disabled**.\n5. Fail if either setting is off or overridden for a group of users.\n"
    },
    "remediation": {
      "manual": "1. In **Settings** > **Org settings** > **Security & privacy** > **Baseline security mode**,\n   open each setting and download its impact report; move the listed documents to HTTPS\n   locations.\n2. Turn on **Block files from opening with insecure protocols** and **Block files from opening\n   with FPRPC protocol**. Role: Office Apps Administrator.\n3. Alternative: in the Office Cloud Policy service, set **Block Insecure Protocols** and\n   **Restrict Apps from FPRPC Fallback** to **Enabled** in a policy configuration targeting all\n   users. No PowerShell cmdlet exists.\n",
      "rollback": "Turn the settings off in Baseline security mode, or set the Cloud Policy policies back to not\nconfigured.\n"
    },
    "references": [
      {
        "title": "Block insecure protocols for file opens",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/block-insecure-protocols-file-opens",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Block FPRPC protocol for file opens",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/block-server-extensions-protocol-file-opens",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Baseline security mode settings",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1557"
      },
      {
        "framework": "mitre-attack",
        "id": "T1203"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-012",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-014",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}