{
  "id": "CB-M365-DEVICE-014",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-014",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-014.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-014.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-014",
    "title": "Open legacy Office file formats in Protected View",
    "finding": {
      "title": "Legacy Office file formats open outside Protected View",
      "description": "Old binary Word, Excel and PowerPoint formats, whose parsers are prone to memory corruption, open with full editing even from trusted locations."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365-apps",
      "baseline-security-mode",
      "cloud-policy",
      "protected-view",
      "file-block"
    ],
    "description": "Two Baseline Security Mode settings are turned on in the Microsoft 365 admin center:\n\n- **Open ancient legacy formats in Protected View and disallow editing**: Word 2 and earlier,\n  Word 6.0 and Word 95 binary documents, Excel 2 to 4 worksheets and macrosheets, and Excel 4\n  workbooks open read-only in Protected View; saving in these formats is blocked;\n- **Open old legacy formats in Protected View and save as modern format**: Word 97 to 2003\n  binary documents, PowerPoint 97-2003 files, Excel 95 to 2003 workbooks and legacy converters\n  open in Protected View; users can edit after leaving Protected View and must save in a modern\n  format.\n\nBoth settings also enable the Cloud Policy policies **File Block includes trusted files** and\n**File Block includes external link files**, so trusted locations do not bypass the block.\n",
    "rationale": "The parsers for these binary formats date from the 1990s and early 2000s and remain a frequent\ntarget for memory corruption exploits delivered as email attachments. Protected View opens the\nfile in a sandbox without active content, which contains an exploit attempt. Few organizations\nstill create files in these formats, so the operational cost is low.\n",
    "impact": "Users opening old binary files see them in Protected View; ancient formats cannot be edited, and\nold formats must be saved as .docx, .xlsx or .pptx. In Excel, new external links to these formats\nreturn `#BLOCKED` and existing links stop refreshing. Business processes that still produce .xls\nor .doc files (exports from old applications) must be identified with the impact reports and\nconverted, or excluded through a scoped Cloud Policy configuration.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Security & privacy** > **Baseline security\n   mode**.\n3. Check that **Open ancient legacy formats in Protected View and disallow editing** and **Open\n   old legacy formats in Protected View and save as modern format** are both turned on.\n4. In the Office Cloud Policy service (https://config.office.com), **Customization** > **Policy\n   Management**, review any higher-priority policy configuration that sets the file block\n   policies of these formats to another value: each must be a documented, scoped exception.\n5. Fail if either setting is off, or if an exception applies to all users.\n"
    },
    "remediation": {
      "manual": "1. In **Settings** > **Org settings** > **Security & privacy** > **Baseline security mode**,\n   download the impact reports of both settings to find users and processes that still open or\n   save legacy formats.\n2. Convert recurring legacy files to modern formats, or prepare a scoped Cloud Policy exception\n   for the processes that cannot change yet.\n3. Turn on both settings. Role: Office Apps Administrator.\n4. Alternative: configure the file block policies listed in the Microsoft pages (for example\n   **Word 97 binary documents and templates** set to **Allow editing and open in Protected\n   View**) in the Office Cloud Policy service. No PowerShell cmdlet exists.\n",
      "rollback": "Turn the settings off in Baseline security mode, or set the Cloud Policy file block policies back\nto not configured.\n"
    },
    "references": [
      {
        "title": "Open ancient legacy formats in Protected View and disallow editing",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/open-ancient-legacy-formats-protected-view-disallow-editing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Open old legacy formats in Protected View and save as modern format",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/open-old-legacy-formats-protected-view-disallow-editing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1203"
      },
      {
        "framework": "mitre-attack",
        "id": "T1566.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-013",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}