What's New - CIS Microsoft Office Enterprise Benchmark v2.0.0
— #Microsoft 365 Apps#Security#Intune
CIS released version 2.0.0 of the Microsoft Office Enterprise Benchmark on 29th September 2026, more than two years after v1.2.0. Despite the major version bump, this is a tidy-up release rather than a rewrite. The two new controls both target embedded content, so ActiveX and OLE are what's worth looking at.
What is the benchmark?
CIS benchmarks are consensus-driven hardening guidelines. The Microsoft Office Benchmark hardens Microsoft 365 Apps and Office LTSC through the Office Group Policy templates, each control rated Level 1 (baseline) or Level 2 (stricter, may affect functionality).
There is also a separate CIS Microsoft Intune for Office Benchmark. Its current version, v1.1.0, was released in December 2024 and has not been updated for v2.0.0. It still contains the three controls that have now been removed and doesn't have the two new ones. Until CIS refreshes it, use the Enterprise benchmark as your source of truth and deploy through the Intune Settings Catalog.
A few structural changes are worth flagging up front:
- (L1) and (L2) prefixes have been removed from control titles, in line with the M365 v7.0.0 and Edge v5.0.0 benchmarks. Levels are still shown under each recommendation's Profile Applicability.
- Scope updated: Office LTSC Professional Plus 2024 and Windows Server 2025 are added, Windows 8.1 is dropped, and testing moved from Windows 10 to Windows 11.
- ADMX baseline: recommendations are now based on Office ADMX/ADML version 5556.1000 (was 5406.1000).
What's changed in v2.0.0?
The benchmark goes from 241 to 240 recommendations: 2 new, 3 removed and around 20 updated. Section numbering hasn't moved, so your existing mappings still line up.
New controls
- Disable All ActiveX (2.3.27.20, L1): Enabled. Stops Office initialising ActiveX controls outside trusted locations, so users are never asked to enable them.
- OLE Active Content (2.6.6.6.8, L1): Enabled, prompt user before activating OLE Active Content. PowerPoint prompts before an action button activates an embedded OLE object.
Removed controls
- Read e-mail as plain text (was 2.5.10.8.3.1, L2)
- Read signed e-mail as plain text (was 2.5.10.8.3.2, L2)
- Prevent users from changing permissions on rights managed content (was 2.3.18.5, L1)
The change log doesn't give reasons. In my view, the two plain-text controls were the most disruptive L2 settings in the Outlook section, so if you had them deployed you can now relax them without losing compliance.
Notable updates
- Remove file extensions blocked as Level 1 / Level 2 (2.5.14.3.1.5/6, L1): changed from
DisabledtoEnabled: ;. It works the same way (nothing is removed from Outlook's block list), but it writes a registry value that auditors can see as evidence. It only applies if Outlook Security Mode is set to Use Outlook Security Group Policy. - Authentication with Exchange server (2.5.1.2.1, L1): remediation fixed and the old Office 365 warning removed. CIS now says clearly that it only affects MAPI to on-premises Exchange, not OAuth to Exchange Online.
- Block Flash activation (1.3.1, L1): rationale and impact rewritten. Flash is gone from patched endpoints, so expect no change in behaviour; this control is mainly about keeping the audit evidence. The one exception: a legacy add-in that loads Flash inside an Office process will stop working.
Deploying through Intune
Every control in the benchmark can be deployed natively through the Intune Settings Catalog. Microsoft ships the Office ADMX templates in the catalog. Settings appear under app categories such as Microsoft Office 2016, Microsoft Outlook 2016 and Microsoft PowerPoint 2016, using the same names as Group Policy.
A few things to know:
- Most controls are user-scoped. In the catalog these settings end in (User) and write to HKCU, so assign the profiles to user groups. Machine settings sit under the (Machine) categories.
- Watch for (Deprecated) duplicates. Several Outlook settings appear twice. A (Deprecated) copy in the original Group Policy location and a current copy under the app category. Always pick the one without (Deprecated).
Don't treat the Intune for Office v1.1.0 benchmark as current. Below are the Settings Catalog paths for the new and key updated controls:
| Control | Settings Catalog path | Value |
|---|---|---|
| Disable All ActiveX | Microsoft Office 2016\Security Settings > Disable All ActiveX (User) | Enabled |
| OLE Active Content | Microsoft PowerPoint 2016\PowerPoint Options\Security > OLE Active Content (User) | Enabled: enable (prompt user before activating OLE Active Content) |
| Authentication with Exchange server | Microsoft Outlook 2016\Security\Security Form Settings > Authentication with Exchange Server (User) | Enabled: Kerberos Password Authentication |
| Outlook Security Mode | Microsoft Outlook 2016\Security\Security Form Settings > Outlook Security Mode (User) | Enabled: Use Outlook Security Group Policy |
| Remove file extensions blocked as Level 1 | Microsoft Outlook 2016\Security\Security Form Settings > Remove file extensions blocked as Level 1 (User) | Enabled: ; |
| Remove file extensions blocked as Level 2 | Microsoft Outlook 2016\Security\Security Form Settings > Remove file extensions blocked as Level 2 (User) | Enabled: ; |
| Block Flash activation in Office documents | Administrative Templates\MS Security Guide > Block Flash activation in Office documents | Enabled: Block all activation |
Top 3 to implement first
1. Disable All ActiveX (2.3.27.20, L1)
ActiveX is an old but still effective way to deliver malicious documents. If an attacker can get a user to click Enable on the Message Bar, the control runs with that user's privileges. Microsoft disabled ActiveX by default in Microsoft 365 and Office 2024 from April 2025. But users can still change the trust level in the Trust Center. This control turns Microsoft's default into a policy users can't change.
Deploy: in the Settings Catalog, set Microsoft Office 2016\Security Settings > Disable All ActiveX (User) to Enabled (disableallactivex = 1).
Watch out: legacy Access applications and custom Word or Excel forms built on ActiveX will stop working unless they're moved to a trusted location. Users who re-enabled ActiveX in the Trust Center are the ones who'll notice. Use this to find and retire what's left.
2. OLE Active Content (2.6.6.6.8, L1)
PowerPoint action buttons can be set to activate an embedded OLE object when clicked. Embedded OLE objects in PowerPoint were the route used by the Sandworm attacks (MS14-060), and this confirmation prompt is the last control point before an object activates. The policy also offers an enable all option that removes the prompt. Setting this explicitly stops that being switched on by a user, a legacy GPO or an app customisation.
Deploy: in the Settings Catalog, set Microsoft PowerPoint 2016\PowerPoint Options\Security > OLE Active Content (User) to Enabled, and select enable (prompt user before activating OLE Active Content) (enableoleactions = 1).
Watch out: It enforces PowerPoint's existing default. If you can live with Object action buttons doing nothing, the more restrictive disable option (0) is also compliant and removes the prompt as a target for social engineering.
3. Authentication with Exchange server: Kerberos (2.5.1.2.1, L1)
Not new, but updated, and it fits the wider push away from NTLM. Forcing Kerberos stops Outlook falling back to NTLM for its MAPI session with on-premises Exchange. The update makes it clear this doesn't touch OAuth to Exchange Online, so cloud-only tenants can deploy it safely. For them it's a compliance tick with no change in behaviour; the real benefit is in hybrid and on-premises environments.
Deploy: in the Settings Catalog, set Microsoft Outlook 2016\Security\Security Form Settings > Authentication with Exchange Server (User) to Enabled, and Select the authentication with Exchange server to Kerberos Password Authentication (authenticationservice = 16). Don't use the (Deprecated) copy.
Watch out: in hybrid environments with mailboxes still on-premises, check that the MAPI virtual directory has Kerberos enabled with correct SPNs. A mismatch causes repeated credential prompts, and with no NTLM fallback there is no way round it.
In summary
v2.0.0 is a maintenance release with a sensible focus. The two new controls turn Microsoft's safer defaults for embedded content into policy, the removals reduce friction in Outlook, and the audit fixes make compliance scanning more reliable. If you're already aligned to v1.2.0, the uplift is small.
The bigger issue is the Intune for Office benchmark still sitting at v1.1.0. If that's what your baseline is built on, apply the delta above now rather than waiting for CIS to catch up.