Windows 10: Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT

Brink · Mar 30, 2021

Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 2103. We invite you to download the draft baseline package (attached to this post), evaluate the proposed baselines, and provide us your comments and feedback below.

This baseline builds on the previous Office baseline we released mid-2019. The highlights of this baseline include:

Restrict legacy JScript execution for Office to help protect remote code execution attacks while maintaining user productivity as core services continue to function as usual.

Expanded macro protection requiring application add-ins to be signed by a trusted publisher. Also, turning off Trust Bar notifications for unsigned application add ins and blocking them to silently disable without notification.

Block Dynamic Data Exchange (DDE) entirely.

New policies added for Microsoft Defender Application Guard, protecting users from unsafe documents.

Also, see the information at the end of this post regarding updates to Security Policy Advisor and Office Cloud Policy Services.

The downloadable baseline package includes importable GPOs, a script to apply the GPOs to local policy, a script to import the GPOs into Active Directory Group Policy, updated custom administrative template (SecGuide.ADMX/L) file, all the recommended settings in spreadsheet form and a Policy Analyzer rules file. The recommended settings correspond with the Office 365 ProPlus administrative templates version 5140, released February 26, 2021.

GPOs included in the baseline

Most organizations can implement the baselineâs recommended settings without any problems. However, there are a few settings that will cause operational issues for some organizations. We've broken out related groups of such settings into their own GPOs to make it easier for organizations to add or remove these restrictions as a set. The local-policy script (Baseline-LocalInstall.ps1) offers command-line options to control whether these GPOs are installed.

The âMSFT Office 365 ProPlus 2103â GPO set includes âComputerâ and âUserâ GPOs that represent the âcoreâ settings that should be trouble free, and each of these potentially challenging GPOs, each of which is described later:

"Legacy JScript Block - Computer" disables the legacy JScript execution for websites in the Internet Zone and Restricted Sites Zone.

âLegacy File Block - Userâ is a User Configuration GPO that prevents Office applications from opening or saving legacy file formats.

âRequire Macro Signing - Userâ is a User Configuration GPO that disables unsigned macros in each of the Office applications.

âDDE Block - Userâ is a User Configuration GPO that blocks using DDE to search for existing DDE server processes or to start new ones.

Restrict legacy JScript execution for Office

The JScript engine is a legacy component in Internet Explorer which has been replaced by JScript9. Some organizations may have Office applications and workloads relying on this component, therefore it's important to determine whether legacy JScript is being used to provide business-critical functionality before you enable this setting. Blocking the legacy JScript engine will help protect against remote code execution attacks while maintaining user productivity as core services continue to function as usual. As a security best practice, we recommend you disable legacy JScript execution for websites in Internet Zone and Restricted Sites Zone. Weâve enabled a new custom setting called "Restrict legacy JScript execution for Office" in the baseline and provided it in a separate GPO "MSFT Office 365 ProPlus 2103 - Legacy JScript Block - Computer" to make it easier to deploy. Learn more about Restrict JScript at a Process Level.

Note: It can be a challenge to identify all applications and workloads using the legacy JScript engine, it's often used by a webpage by setting the script language attribute in HTML to Jscript.Encode or Jscript.Compact, it can also be used by the WebBrowser Control (WebOC). After the policy is applied, Office will not execute legacy JScript for the internet zone or restricted site zone websites. Therefore, applying this Group Policy can impact the functionalities in an Office application or add-ins that require the legacy JScript component and users arenât notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones.

Important: If you disable or donât configure this Group Policy setting, legacy JScript runs without any restriction at the application level.

Comprehensive blocking of legacy file formats

In the last Office baseline we published, we blocked legacy file formats in a separate GPO that can be applied as a cohesive unit. There are no changes to the legacy file formats recommended to block.

Blocking DDE entirely

Excel already disabled Dynamic Data Exchange (DDE) as an interprocess communication method, and now Word added a new setting âDynamic Data Exchangeâ that we have configured to a disabled state. Because of the new addition from Word the existing GPO has been renamed to âMSFT Office 365 ProPlus 2103 - DDE Block â Userâ.

Macro signing

The âVBA Macro Notification Settingsâ policy has been updated for Access, Excel, PowerPoint, Publisher, Visio, and Word with a new option. To further control macros we now recommend that macros also need to be signed by a Trusted Publisher. With this new recommendation macros not digitally signed by a Trusted Publisher will be blocked from running. Learn more at Upgrade signed Office VBA macro projects to V3 signature.

Note: Enabling âBlock macros from running in Office files from the Internetâ continues to be considered part of the main baseline and should be enforced by all security-conscious organizations.

Application Guard policies

We're excited to announce the integration of Office with Microsoft Defender Application Guard. When Application Guard is enabled for your tenant, the integration will help prevent untrusted files from accessing trusted resources. New policies for Application Guard are added to the baseline to protect users from unsafe documents including enabling "Prevent users from removing Application Guard protection on files." and disabling "Turn off protection of unsupported file types in Application Guard for Office." Learn more about Microsoft Defender Application Guard.

Other changes in the baseline

New policy: "Control how Office handles form-based sign-in prompts" we recommend enabling and blocking all prompts. This results in no form-based sign-in prompts displayed to the user and the user is shown a message that the sign-in method isnât allowed. We understand this setting might have some issues, and we value your feedback during the Draft cycle of this baseline posting.

New policy: We recommend enforcing the default by disabling "Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine" (Note: This policy description is a double negative, the behavior we recommend is the security checks remain ON).

New policy: We recommend enforcing the default by disabling "Allow VBA to load typelib references by path from untrusted intranet locationsâ. Learn more at FAQ for VBA solutions affected by April 2020 Office security updates.

New dependent policy: "Disable Trust Bar Notification for unsigned application add-ins" policy had a dependency that was missed in the previous baseline. To correct, we have added that missing policy, "Require that application add-ins are signed by Trusted Publisher". This applies to Excel, PowerPoint, Project, Publisher, Visio, and Word.

Removed from the baseline: "Do not display 'Publish to GAL' button". While this setting has been there for a long time, after further research, we believe this setting is used to ensure good deployment practices and not to mitigate security concerns.

Deploy policies from the cloud, and get tailored recommendations for specific security policies

Deploy user-based policies from the cloud to any Office 365 ProPlus client through the Office cloud policy service. The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups. Once defined, policies are automatically enforced as users sign in and use Office 365 ProPlus. No need to be domain joined or MDM enrolled, and it works with corporate-owned devices or BYOD. Learn more about Office cloud policy service.

Security Policy Advisor can help give you insights on the security and productivity impact of deploying certain security policies. Security Policy Advisor provides you with tailored recommendations based on how Office is used in your enterprise. For example, in most customer environments, macros are typically used in apps such as Excel and only by specific groups of users. Security Policy Advisor helps you identify groups of users and applications where macros can be disabled with minimal productivity impact, and optionally integrate with Office 365 Advanced Threat Protection to provide you details on who is being attacked. Learn more about Security Policy Advisor.

As always, please let us know your thoughts by commenting on this post.
Click to expand...

Source: https://techcommunity.microsoft.com/...t/ba-p/2228388

:)

Brink · Mar 30, 2021

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 1907. Please evaluate this proposed baseline and send us your feedback through the Baselines Discussion site.

This baseline builds on the overhauled Office baseline we released in early 2018. The highlights of this baseline include:

Componentization of GPOs so that “challenging” settings can be added or removed as a unit.

Comprehensive blocking of legacy file formats

Blocking Excel from using Dynamic Data Exchange (DDE)

Also see the announcements at the end of this post regarding the new Security Policy Advisor and Office cloud policy services.

The downloadable attachment to this blog post includes importable GPOs, a script to apply the GPOs to local policy, a custom administrative template (ADMX) file for Group Policy settings, all the recommended settings in spreadsheet form and as Policy Analyzer rules. The recommended settings correspond with the Office 365 ProPlus administrative templates version 4888 released on July 17, 2019 that can be downloaded here. The download for the final version of this baseline will be released through the Security Compliance Toolkit.

Componentization of GPOs
Most organizations can implement most of the baseline’s recommended settings without any problems. However, there are a few settings that will cause operational issues for some organizations. We have broken out related groups of such settings into their own GPOs to make it easier for organizations to add or remove these restrictions as a set. The local-policy script, BaselineLocalInstall.ps1, offers command-line options to control whether these GPOs are installed.

The “MSFT Office 365 ProPlus 1907” GPO set includes “Computer” and “User” GPOs that represent the “core” settings that should be trouble free, and each of these potentially challenging GPOs, each of which is described later:

“Legacy File Block – User” is a User Configuration GPO that prevents Office applications from loading or saving legacy file formats.

“Require Macro Signing – User” is a User Configuration GPO that disables unsigned macros in each of the Office applications.

“Excel DDE Block – User” is a User Configuration GPO that blocks Excel from using DDE to search for existing DDE server processes or to start new ones.

Comprehensive blocking of legacy file formats
In the previous Office baseline we published, we tried to end the use of legacy file formats, including all the old Office document formats such as *.doc, *.xls, and *.ppt. However, we missed some important ones. So we just went ahead and fixed the glitch.

One of the threats of these old binary file formats is that their inherent complexity too often led to exploitable bugs in their parsers. The bigger threat is that many of these formats can include macros or other executable instructions that are easily abused. By contrast, macros are disabled with the most-commonly used Office Open XML (OOXML) document formats, which were first introduced with Office 2007. Only macro-enabled formats such as *.docm and *.xlsm support macros, and these can be filtered at the point of ingress.

While fixing the glitch, however, we also recognized that many organizations cannot entirely end their use of legacy Office document formats, so we broke out the file-blocking settings into a separate GPO, so they can be added or removed as a cohesive unit.

Blocking Excel from using DDE
Dynamic Data Exchange (DDE) is a very old interprocess communication method that is still used in some parts of Windows and remains supported for applications to use, primarily for backward compatibility. A few years ago, malware authors began embedding specially-formed DDE references in Office documents that were sent to victims and that would run attacker-chosen code. Since then, most Office apps quietly disabled the use of DDE. Excel retained user-configurable settings to enable DDE server process lookup and launch. These can now be configured through Group Policy, and this baseline recommends disabling both settings. Because of the likelihood that some organizations still depend on this functionality, we have broken out “Excel DDE Block” as a separate GPO.

Macro signing
The baseline also retains the “VBA Macro Notification Settings” options from our previous baselines that require that macros embedded in Office documents be signed by a trusted publisher. We recognize that some organizations have had workflows and processes relying on such macros for a long time, and that enforcing these particular settings can cause operational issues. It can also be challenging to identify all the documents and VBA projects that need to be signed. We have decided at this time to move these settings into a separate GPO to make it easier to switch the settings on or off without affecting the rest of the baseline.

Note that the “Block macros from running in Office files from the Internet” settings we turned on in the previous baseline are retained in the main GPOs and should be enforced by all security-conscious organizations.

Also see below about how the new Security Policy Advisor service can provide tailored recommendations for VBA macro policies.

Other changes in the baseline

“Block macros from running in Office files from the Internet” is now supported for Access, so we added it.

Implemented new settings to block the opening of certain untrusted files and to open others in Protected View.

Enabled the new “Macro Runtime Scan Scope” setting.

Removed the file block setting for “PowerPoint beta converters,” as Office no longer implements that block.

Deploy policies from the cloud, and get tailored recommendations for specific security policies
In addition to being able deploy these policies through Active Directory Group Policy or through Local Group Policy, you now have a new way to deploy user-based policies from the cloud to any Office 355 ProPlus client through the new Office cloud policy service.

The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups. Once defined, policies are automatically enforced as users sign in and use Office 365 ProPlus. No need to be domain joined or MDM enrolled, and it works with corporate-owned devices or BYOD. To learn more about Office cloud policy service, check out the announcement here: The new cloud-based policy management service for Office 365 ProPlus has been released!.

We also have a new service in public preview called Security Policy Advisor that can help you with deploying security policies. Security Policy Advisor can provide you with tailored recommendations for specific security policies based on how Office is used in your enterprise. For example, in most customer environments, macros are typically used in specific apps such as Excel and only by specific groups of users. Security Policy Advisor can help you identify groups of users and applications where macros can be disabled with minimal productivity impact, and optionally integrate with Office 365 Advanced Threat Protection to provide you information on who is being attacked. To learn more about Security Policy Advisor, check out the announcement here: Announcing Security Policy Advisor Preview for Office 365 ProPlus - Microsoft Tech Community - 480880.

Click to expand...

Source: https://techcommunity.microsoft.com/...FT/ba-p/771308

Brink · Mar 30, 2021

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT Office

Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 1907. Please evaluate this proposed baseline and send us your feedback through the Baselines Discussion site.

This baseline builds on the overhauled Office baseline we released in early 2018. The highlights of this baseline include:

Componentization of GPOs so that “challenging” settings can be added or removed as a unit.

Comprehensive blocking of legacy file formats

Blocking Excel from using Dynamic Data Exchange (DDE)

Also see the announcements at the end of this post regarding the new Security Policy Advisor and Office cloud policy services.

The downloadable attachment to this blog post includes importable GPOs, a script to apply the GPOs to local policy, a custom administrative template (ADMX) file for Group Policy settings, all the recommended settings in spreadsheet form and as Policy Analyzer rules. The recommended settings correspond with the Office 365 ProPlus administrative templates version 4888 released on July 17, 2019 that can be downloaded here. The download for the final version of this baseline will be released through the Security Compliance Toolkit.

Componentization of GPOs
Most organizations can implement most of the baseline’s recommended settings without any problems. However, there are a few settings that will cause operational issues for some organizations. We have broken out related groups of such settings into their own GPOs to make it easier for organizations to add or remove these restrictions as a set. The local-policy script, BaselineLocalInstall.ps1, offers command-line options to control whether these GPOs are installed.

The “MSFT Office 365 ProPlus 1907” GPO set includes “Computer” and “User” GPOs that represent the “core” settings that should be trouble free, and each of these potentially challenging GPOs, each of which is described later:

“Legacy File Block – User” is a User Configuration GPO that prevents Office applications from loading or saving legacy file formats.

“Require Macro Signing – User” is a User Configuration GPO that disables unsigned macros in each of the Office applications.

“Excel DDE Block – User” is a User Configuration GPO that blocks Excel from using DDE to search for existing DDE server processes or to start new ones.

Comprehensive blocking of legacy file formats
In the previous Office baseline we published, we tried to end the use of legacy file formats, including all the old Office document formats such as *.doc, *.xls, and *.ppt. However, we missed some important ones. So we just went ahead and fixed the glitch.

One of the threats of these old binary file formats is that their inherent complexity too often led to exploitable bugs in their parsers. The bigger threat is that many of these formats can include macros or other executable instructions that are easily abused. By contrast, macros are disabled with the most-commonly used Office Open XML (OOXML) document formats, which were first introduced with Office 2007. Only macro-enabled formats such as *.docm and *.xlsm support macros, and these can be filtered at the point of ingress.

While fixing the glitch, however, we also recognized that many organizations cannot entirely end their use of legacy Office document formats, so we broke out the file-blocking settings into a separate GPO, so they can be added or removed as a cohesive unit.

Blocking Excel from using DDE
Dynamic Data Exchange (DDE) is a very old interprocess communication method that is still used in some parts of Windows and remains supported for applications to use, primarily for backward compatibility. A few years ago, malware authors began embedding specially-formed DDE references in Office documents that were sent to victims and that would run attacker-chosen code. Since then, most Office apps quietly disabled the use of DDE. Excel retained user-configurable settings to enable DDE server process lookup and launch. These can now be configured through Group Policy, and this baseline recommends disabling both settings. Because of the likelihood that some organizations still depend on this functionality, we have broken out “Excel DDE Block” as a separate GPO.

Macro signing
The baseline also retains the “VBA Macro Notification Settings” options from our previous baselines that require that macros embedded in Office documents be signed by a trusted publisher. We recognize that some organizations have had workflows and processes relying on such macros for a long time, and that enforcing these particular settings can cause operational issues. It can also be challenging to identify all the documents and VBA projects that need to be signed. We have decided at this time to move these settings into a separate GPO to make it easier to switch the settings on or off without affecting the rest of the baseline.

Note that the “Block macros from running in Office files from the Internet” settings we turned on in the previous baseline are retained in the main GPOs and should be enforced by all security-conscious organizations.

Also see below about how the new Security Policy Advisor service can provide tailored recommendations for VBA macro policies.

Other changes in the baseline

“Block macros from running in Office files from the Internet” is now supported for Access, so we added it.

Implemented new settings to block the opening of certain untrusted files and to open others in Protected View.

Enabled the new “Macro Runtime Scan Scope” setting.

Removed the file block setting for “PowerPoint beta converters,” as Office no longer implements that block.

Deploy policies from the cloud, and get tailored recommendations for specific security policies
In addition to being able deploy these policies through Active Directory Group Policy or through Local Group Policy, you now have a new way to deploy user-based policies from the cloud to any Office 355 ProPlus client through the new Office cloud policy service.

The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups. Once defined, policies are automatically enforced as users sign in and use Office 365 ProPlus. No need to be domain joined or MDM enrolled, and it works with corporate-owned devices or BYOD. To learn more about Office cloud policy service, check out the announcement here: The new cloud-based policy management service for Office 365 ProPlus has been released!.

We also have a new service in public preview called Security Policy Advisor that can help you with deploying security policies. Security Policy Advisor can provide you with tailored recommendations for specific security policies based on how Office is used in your enterprise. For example, in most customer environments, macros are typically used in specific apps such as Excel and only by specific groups of users. Security Policy Advisor can help you identify groups of users and applications where macros can be disabled with minimal productivity impact, and optionally integrate with Office 365 Advanced Threat Protection to provide you information on who is being attacked. To learn more about Security Policy Advisor, check out the announcement here: Announcing Security Policy Advisor Preview for Office 365 ProPlus - Microsoft Tech Community - 480880.

Click to expand...

Source: https://techcommunity.microsoft.com/...FT/ba-p/771308

Brink · Mar 30, 2021

Office 365 ProPlus updates

Office 365 ProPlus delivers cloud-connected and always up-to-date versions of our most valuable enterprise apps. Today, we’re making three important announcements related to ProPlus: changes to the Office 365 system requirements; improvements to the ProPlus update model, including alignment with Windows 10; and new tools and programs to manage ProPlus application compatibility.

Changes to the Office 365 system requirements

Office 365 ProPlus is the very best way to experience the Office 365 services. For IT, ProPlus delivers the most secure and most complete suite of productivity apps available. And because the apps are cloud-connected and always up-to-date, they’re continually getting better—with new security features, new telemetry and new management capabilities. For end users, ProPlus brings the Office 365 services to life. When a modern app is connected to a modern service, magic happens. People can collaborate in new ways. Apps can simplify mundane tasks. And advanced security services can protect users as they work.

When customers connect to Office 365 with a legacy version of Office, they’re not enjoying all that the service has to offer. The IT benefits—particularly security—are cut short. And the end user experience in the apps is limited to the features shipped at a point in time. To ensure that customers are getting the most out of their Office 365 subscription, we are updating our system requirements.

Office 365 ProPlus or Office perpetual in mainstream support required to connect to Office 365 services. Starting October 13, 2020, Office 365 ProPlus or Office perpetual in mainstream support will be required to connect to Office 365 services. Office 365 ProPlus will deliver the best experience, but for customers who aren’t ready to move to the cloud by 2020, we will also support connections from Office perpetual in mainstream support.

Applies to Office 365 commercial services only. This update does not change our system requirements or support policies for the Office perpetual clients, Office perpetual clients connecting to on-premises servers, or any consumer services.

More than three years’ notice. We’re providing more than three years’ notice to give IT time to plan and budget for this change. Until this new requirement goes into effect in 2020, Office 2010, Office 2013 and Office 2016 perpetual clients will still be able to connect to Office 365 services.

Visit our Office 365 Tech Community to learn more and to ask the experts your questions.

Improvements to the Office 365 ProPlus update model, including alignment with Windows 10

Moving to Office 365 ProPlus requires an initial upgrade and ongoing management of regular updates. Customers quickly see the benefits of the move, but they’ve also asked us to simplify the update process—and to improve the coordination between Office and Windows. To respond to this feedback, we’re pleased to announce that we will align the Office 365 ProPlus and Windows 10 update model. This change will make planning and managing updates for both Office and Windows easier for customers using the Secure Productive Enterprise.

Targeting September 2017, we will make the following changes to the Office 365 ProPlus update model:

Two updates a year. We will reduce the Office 365 ProPlus update cadence from three to two times a year, with semi-annual feature updates to Windows 10 and Office 365 ProPlus targeted for March and September.

18 months of support. We will extend the support period for Office 365 ProPlus semi-annual updates from 12 to 18 months (starting from first release) so IT professionals can choose to update once or twice a year.

System Center Configuration Manager support. System Center Configuration Manager will support this new aligned update model for Office 365 ProPlus and Windows 10, making it easier to deploy and update the two products together.

See the upcoming changes to the Office 365 ProPlus update management article to learn more.

New tools and programs to manage Office 365 ProPlus application compatibility

One of the biggest concerns customers have about the move to a new version of Office is application compatibility. Office add-ins and VBA solutions often play a significant role in key business processes, and application compatibility is an important consideration in both upgrades and updates. To help customers manage ProPlus application compatibility, we’re pleased to announce four new investments.

Upgrade assessment tools. Starting today, we’re offering a limited preview of new tools that will catalogue the add-ins and VBA solutions in use in your organization, identify potential issues with the upgrade to Office 365 ProPlus, and recommend steps for remediation.

Application compatibility testing. For each new Office 365 ProPlus release, we will perform compatibility testing of the most common third-party add-ins, identify potential issues, and take steps to remediate.

Office 365 ProPlus monitoring services. We will provide new services to monitor your ProPlus deployment and provide visibility into the usage and stability of apps and add-ins.

Reporting, tracking and resolving issues. We will improve our existing service for reporting, tracking and resolving application compatibility issues—and partner with customers and ISVs to find the best approach to remediation.

You can learn more about the upgrade assessment tools today, and we’ll have more to share on our application compatibility testing program, the new Office 365 ProPlus monitoring services and the new service for reporting, tracking and resolving issues in the coming months.

We are here to help

If you’re connecting to Office 365 with a legacy version of Office, you’re not enjoying all that the service has to offer—and we’re here to help. For more information on Office 365 ProPlus deployment, refer to the Office 365 ProPlus Deployment Guide and the ProPlus Ignite On-Demand sessions. And when you’re ready to make the move to ProPlus, the Microsoft FastTrack customer success service will help you with the details. Visit the FastTrack website to learn more and submit a request for help with planning, assessment and deployment. ProPlus is the very best way to experience the Office 365 services, and we’re committed to helping you upgrade with confidence.

—Ron Markezich
Click to expand...

Source: Office 365 ProPlus updates - Office Blogs

Windows 10: Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT

Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT

Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT

Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT

Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT - Similar Threads - Security baseline Office

23h2 security baseline. Whats new from 2021 baseline?

23h2 security baseline. Whats new from 2021 baseline?

Security baseline (DRAFT) for Windows 10 and Windows Server v2004

Office 365 ProPlus questions

Office 2010 support is ending - get current with Office 365 ProPlus Office

Windows Server 2019 adds support for Office 365 ProPlus Office

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Save AutoRecover doesn't work in Office 365 ProPlus

Office 365 ProPlus updates