Microsoft Office 365 ProPlus STIG Version Comparison

There are 2 differences between versions v2 r11 (Oct. 25, 2023) (the "left" version) and v3 r1 (July 24, 2024) (the "right" version).

Check O365-OU-000020 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

When a custom action is executed that uses the Outlook object model, Outlook must automatically deny it.

Check Content

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Security >> Set Outlook object model custom actions execution prompt is set to "Enabled" and "Automatically Deny". Use the Windows Registry to navigate to the following key: HKCU\software\policies\microsoft\office\16.0\outlook\security If the value for promptoomcustomaction "promptoomcustomaction" is set to REG_DWORD "REG_DWORD = 0, 0", this is not a finding.

Discussion

This policy setting controls whether Outlook prompts users before executing a custom action. Custom actions add functionality to Outlook that can be triggered as part of a rule. Among other possible features, custom actions can be created that reply to messages in ways that circumvent the Outlook model's programmatic send protections. If you enable this policy is enabled, setting, you can choose from four options are available to control how Outlook functions when a custom action is executed that uses the Outlook object model: - Prompt User - Automatically Approve - Automatically Deny - Prompt user based on computer security. This option enforces the default configuration in Outlook. If you disable or do not configure this policy setting, is disabled or not configured, when Outlook or another program initiates a custom action using the Outlook object model, users are prompted to allow or reject the action. If this configuration is changed, malicious code can use the Outlook object model to compromise sensitive information or otherwise cause data and computing resources to be at risk. This is the equivalent of choosing Enabled -- Prompt user based on computer security.

Fix

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Setting >> Set Outlook object model custom actions execution prompt to "Enabled" and select "Automatically Deny".