{
  "id": "CB-M365-DEVICE-015",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-015",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-015.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-015.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-015",
    "title": "Block ActiveX, OLE Graph and OrgChart objects, and DDE server launches in Microsoft 365 apps",
    "finding": {
      "title": "Microsoft 365 apps allow legacy active content that runs code from documents",
      "description": "Users can re-enable ActiveX controls, documents can load OLE Graph or OrgChart objects, or Excel can launch DDE servers, all known ways to run code from a crafted file."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365-apps",
      "baseline-security-mode",
      "cloud-policy",
      "activex",
      "dde",
      "ole"
    ],
    "description": "Three Baseline Security Mode settings are turned on in the Microsoft 365 admin center:\n\n- **Block ActiveX controls in the Microsoft 365 apps**: ActiveX is locked to **Disable all\n  controls without notification** (Cloud Policy policy **Disable All ActiveX**);\n- **Block OLE Graph and OrgChart objects**: apps do not load these legacy embedded objects (Cloud\n  Policy policies **Block OLE Graph** and **Block OrgChart**);\n- **Block Dynamic Data Exchange (DDE) server launch in Excel**: Excel does not start DDE servers\n  (Cloud Policy policy **Don't allow Dynamic Data Exchange (DDE) server launch in Excel**).\n",
    "rationale": "These three features let a document start code without macros. ActiveX controls and OLE objects\nhave a long record of exploited vulnerabilities, and DDE formulas were widely used in phishing\ncampaigns to run commands as soon as a spreadsheet opened. Microsoft 365 apps already disable\nActiveX by default, but users can turn it back on in the Trust Center when a document asks them\nto. Enforcing the three settings removes these code execution paths and the user override.\n",
    "impact": "Documents with ActiveX controls (old forms, some line-of-business templates) lose those controls.\nFiles embedding Microsoft Graph charts or OrgChart objects show them as static images or not at\nall. Excel workbooks that pull live data from other applications through DDE stop updating;\nExcel-to-Excel DDE links between open workbooks keep working. Use the impact reports, and a\nhigher-priority Cloud Policy configuration for a documented group of users if a dependency cannot\nbe removed.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Security & privacy** > **Baseline security\n   mode**.\n3. Check that **Block ActiveX controls in the Microsoft 365 apps**, **Block OLE Graph and\n   OrgChart objects** and **Block Dynamic Data Exchange (DDE) server launch in Excel** are all\n   turned on.\n4. In the Office Cloud Policy service (https://config.office.com), **Customization** > **Policy\n   Management**, review higher-priority policy configurations that set **Disable All ActiveX**,\n   **Block OLE Graph**, **Block OrgChart** or the DDE policy to another value: each must target a\n   documented group.\n5. Fail if any of the three settings is off, or if an exception applies to all users.\n"
    },
    "remediation": {
      "manual": "1. In **Settings** > **Org settings** > **Security & privacy** > **Baseline security mode**,\n   download the impact report of each setting (the ActiveX report lists users opening files\n   with ActiveX controls).\n2. Replace the dependent documents, or prepare a scoped Cloud Policy exception.\n3. Turn on the three settings. Role: Office Apps Administrator.\n4. Alternative: set the Cloud Policy policies listed above to **Enabled** in a policy\n   configuration targeting all users. No PowerShell cmdlet exists.\n",
      "rollback": "Turn the settings off in Baseline security mode, or set the Cloud Policy policies back to not\nconfigured.\n"
    },
    "references": [
      {
        "title": "Block ActiveX controls in Microsoft 365 apps",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/block-active-x-controls",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Block OLE Graph and OrgChart objects",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/block-ole-graph-org-chart-objects",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Block Dynamic Data Exchange (DDE) server launches in Excel",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/block-dynamic-data-exchange-server-launches-excel",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1559.002"
      },
      {
        "framework": "mitre-attack",
        "id": "T1203"
      },
      {
        "framework": "mitre-attack",
        "id": "T1566.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-014",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-016",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}