What changed in Microsoft Office 365 ProPlus STIG V3R5V3R5 changes

Microsoft Office 365 ProPlus STIG V3R5 (2026-04-01) replaced V3R4 (2025-10-01): 4 checks removed, 1 updated. It has 139 checks, against 143 in V3R4.

V3R5 checklistV3R4 checklist Compare V3R4 and V3R5 in STIG Compare

  • 0 added
  • 4 removed
  • 1 updated

Updated fields: Check text 1

Removed since V3R4 (4)

  • V-278356CAT IIConnected experiences that analyze content must be disabled.
  • V-278357CAT IIConnected experiences that download online content must be disabled.
  • V-278358CAT IIAdditional optional connected experiences must be disabled.
  • V-278359CAT IIConnected experiences must be disabled.

Updated in V3R5 (1)

V-223351CAT IIThe junk email protection level must be set to No Automatic Filtering.Check text

Check text

Note: If the Outlook client application is not used to access Office 365 email (i.e., email is only accessed via Outlook Web Access [OWA]), this check is not applicable. Verify Outlook Junk E-mail protection is set to "No Automatic Filtering". In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options. Verify Junk E-mail protection is set to "No Automatic Filtering". If the system being inspected is not behind EEMSG, CBII, or O365 EOP, the Junk E-mail protection level must be set to "High". Otherwise, "Low" is acceptable. If Junk E-mail protection is not set to "No Automatic Filtering", this is a finding. If the system is not behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP and the Junk E-mail protection is not set to "High", this is a finding. If the system is behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP, and the Junk E-mail protection is not at least "Low", this is a finding.

V-223351 in V3R5

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R5 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.