Microsoft Office 365 ProPlus Security Technical Implementation Guide

The Microsoft Office 365 ProPlus Security Technical Implementation Guide (V3 R5) has 139 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

139STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Apr 01 2026

Scripts associated with public folders must be prevented from execution in Outlook.

Microsoft Office 365 ProPlus Security Technical Implementation Guide

Assessment Title

Rule Text

Scripts associated with public folders must be prevented from execution in Outlook.

Description

Discussion Text

This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223348

Rule

SV-223348r961092_rule

Severity

medium

Rule Version

O365-OU-000003

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the policy for Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for public folders is set to "Enabled".

Use the Windows Registry to navigate to the following key:

HKCU\software\policies\microsoft\office\16.0\outlook\security

If the value for publicfolderscript is set to REG_DWORD = 0, this is not a finding.

Implementation Procedure

Fix Text

Set the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for public folders to "Enabled".

STIG check 68 of 139 in the Microsoft Office 365 ProPlus STIG checklist

← Previous · V-223347Outlook must use remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers.Next · V-223349 →Scripts associated with shared folders must be prevented from execution in Outlook.