cirsec Baselines
Esc
Microsoft 365 tenant · Devices, Intune tenant settings & Microsoft 365 Apps

Block Microsoft Publisher

When it fails: Microsoft Publisher can still be launched. Publisher, retired from Microsoft 365 and with a large attack surface, still runs on devices where it is installed.

CB-M365-DEVICE-016lowactivemanualprofile baseline

Description

The Baseline Security Mode setting Block Microsoft Publisher is turned on in the Microsoft 365 admin center (Cloud Policy policy Disable Publisher set to Enabled). Publisher does not start on any device that receives Microsoft 365 apps policies, and users see the message that a security policy set by the organization prevents it.

Microsoft announced that Publisher is no longer included in Microsoft 365 from October 2026. Keep the control until the inventory shows no Publisher installation left; it can then be retired.

Rationale

Publisher files (.pub) are rarely used, poorly inspected by mail filters, and Publisher's parser has a large attack surface. Microsoft stopped including Publisher in Microsoft 365 in October 2026, so it no longer receives new features and is on its way out of support. Blocking it removes an attack vector that almost nobody needs.

Impact

Users can no longer open or edit .pub files. Convert the remaining publications to Word or PDF (or move layout work to another tool) before turning the setting on. Devices running older Microsoft 365 apps builds or perpetual Office versions that still ship Publisher are the ones that matter: the block only applies to apps that receive Cloud Policy settings.

Audit

  1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
  2. Browse to Settings > Org settings > Security & privacy > Baseline security mode.
  3. Check that Block Microsoft Publisher is turned on.
  4. In the Office Cloud Policy service (https://config.office.com), check that no higher-priority policy configuration sets Disable Publisher to Disabled.
  5. Fail if the setting is off or overridden for a group of users.

Remediation

  1. Find remaining Publisher users with the setting's impact report, and convert their files.
  2. In Settings > Org settings > Security & privacy > Baseline security mode, turn on Block Microsoft Publisher. Role: Office Apps Administrator.
  3. Alternative: set Disable Publisher to Enabled in an Office Cloud Policy configuration targeting all users. No PowerShell cmdlet exists.
  4. Remove Publisher from deployment configurations (Office Deployment Tool ExcludeApp ID="Publisher") for older builds.

Rollback

Turn the setting off, or set Disable Publisher back to not configured.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1CM-7related
NIST SP 800-53 Rev. 55.1.1CM-10related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1203
  • related CB-M365-DEVICE-015 Block ActiveX, OLE Graph and OrgChart objects, and DDE server launches in Microsoft 365 apps

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr