Open legacy Office file formats in Protected View

Description

Two Baseline Security Mode settings are turned on in the Microsoft 365 admin center:

• Open ancient legacy formats in Protected View and disallow editing: Word 2 and earlier, Word 6.0 and Word 95 binary documents, Excel 2 to 4 worksheets and macrosheets, and Excel 4 workbooks open read-only in Protected View; saving in these formats is blocked;
• Open old legacy formats in Protected View and save as modern format: Word 97 to 2003 binary documents, PowerPoint 97-2003 files, Excel 95 to 2003 workbooks and legacy converters open in Protected View; users can edit after leaving Protected View and must save in a modern format.

Both settings also enable the Cloud Policy policies File Block includes trusted files and File Block includes external link files, so trusted locations do not bypass the block.

Rationale

The parsers for these binary formats date from the 1990s and early 2000s and remain a frequent target for memory corruption exploits delivered as email attachments. Protected View opens the file in a sandbox without active content, which contains an exploit attempt. Few organizations still create files in these formats, so the operational cost is low.

Impact

Users opening old binary files see them in Protected View; ancient formats cannot be edited, and old formats must be saved as .docx, .xlsx or .pptx. In Excel, new external links to these formats return #BLOCKED and existing links stop refreshing. Business processes that still produce .xls or .doc files (exports from old applications) must be identified with the impact reports and converted, or excluded through a scoped Cloud Policy configuration.

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Settings > Org settings > Security & privacy > Baseline security mode.
3. Check that Open ancient legacy formats in Protected View and disallow editing and Open old legacy formats in Protected View and save as modern format are both turned on.
4. In the Office Cloud Policy service (https://config.office.com), Customization > Policy Management, review any higher-priority policy configuration that sets the file block policies of these formats to another value: each must be a documented, scoped exception.
5. Fail if either setting is off, or if an exception applies to all users.

Remediation

1. In Settings > Org settings > Security & privacy > Baseline security mode, download the impact reports of both settings to find users and processes that still open or save legacy formats.
2. Convert recurring legacy files to modern formats, or prepare a scoped Cloud Policy exception for the processes that cannot change yet.
3. Turn on both settings. Role: Office Apps Administrator.
4. Alternative: configure the file block policies listed in the Microsoft pages (for example Word 97 binary documents and templates set to Allow editing and open in Protected View) in the Office Cloud Policy service. No PowerShell cmdlet exists.

Rollback

Turn the settings off in Baseline security mode, or set the Cloud Policy file block policies back to not configured.

References

• Open ancient legacy formats in Protected View and disallow editing Microsoft, vendor-doc, accessed 2026-10-24
• Open old legacy formats in Protected View and save as modern format Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-013 Block file opens over HTTP, FTP and FrontPage RPC in Microsoft 365 apps
• related CB-M365-DEVICE-015 Block ActiveX, OLE Graph and OrgChart objects, and DDE server launches in Microsoft 365 apps

People and lifecycle