cirsec Baselines
Esc
Microsoft 365 tenant · Devices, Intune tenant settings & Microsoft 365 Apps

Block ActiveX, OLE Graph and OrgChart objects, and DDE server launches in Microsoft 365 apps

When it fails: Microsoft 365 apps allow legacy active content that runs code from documents. Users can re-enable ActiveX controls, documents can load OLE Graph or OrgChart objects, or Excel can launch DDE servers, all known ways to run code from a crafted file.

CB-M365-DEVICE-015highactivemanualprofile baseline

Description

Three Baseline Security Mode settings are turned on in the Microsoft 365 admin center:

  • Block ActiveX controls in the Microsoft 365 apps: ActiveX is locked to Disable all controls without notification (Cloud Policy policy Disable All ActiveX);
  • Block OLE Graph and OrgChart objects: apps do not load these legacy embedded objects (Cloud Policy policies Block OLE Graph and Block OrgChart);
  • Block Dynamic Data Exchange (DDE) server launch in Excel: Excel does not start DDE servers (Cloud Policy policy Don't allow Dynamic Data Exchange (DDE) server launch in Excel).

Rationale

These three features let a document start code without macros. ActiveX controls and OLE objects have a long record of exploited vulnerabilities, and DDE formulas were widely used in phishing campaigns to run commands as soon as a spreadsheet opened. Microsoft 365 apps already disable ActiveX by default, but users can turn it back on in the Trust Center when a document asks them to. Enforcing the three settings removes these code execution paths and the user override.

Impact

Documents with ActiveX controls (old forms, some line-of-business templates) lose those controls. Files embedding Microsoft Graph charts or OrgChart objects show them as static images or not at all. Excel workbooks that pull live data from other applications through DDE stop updating; Excel-to-Excel DDE links between open workbooks keep working. Use the impact reports, and a higher-priority Cloud Policy configuration for a documented group of users if a dependency cannot be removed.

Audit

  1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
  2. Browse to Settings > Org settings > Security & privacy > Baseline security mode.
  3. Check that Block ActiveX controls in the Microsoft 365 apps, Block OLE Graph and OrgChart objects and Block Dynamic Data Exchange (DDE) server launch in Excel are all turned on.
  4. In the Office Cloud Policy service (https://config.office.com), Customization > Policy Management, review higher-priority policy configurations that set Disable All ActiveX, Block OLE Graph, Block OrgChart or the DDE policy to another value: each must target a documented group.
  5. Fail if any of the three settings is off, or if an exception applies to all users.

Remediation

  1. In Settings > Org settings > Security & privacy > Baseline security mode, download the impact report of each setting (the ActiveX report lists users opening files with ActiveX controls).
  2. Replace the dependent documents, or prepare a scoped Cloud Policy exception.
  3. Turn on the three settings. Role: Office Apps Administrator.
  4. Alternative: set the Cloud Policy policies listed above to Enabled in a policy configuration targeting all users. No PowerShell cmdlet exists.

Rollback

Turn the settings off in Baseline security mode, or set the Cloud Policy policies back to not configured.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1CM-7related
NIST SP 800-53 Rev. 55.1.1SI-3related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1559.002
MITRE ATT&CKT1203
MITRE ATT&CKT1566.001

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr