

The following recommendations, listed in alphabetical order, should be treated as high priorities when hardening Microsoft Office deployments. Finally, as Group Policy settings for Microsoft Office are periodically updated by Microsoft, care should be taken to ensure the latest version is always used. For cloud-based policy configurations, equivalents are available in Microsoft 365 Apps admin centre for many of the Group Policy settings. Once downloaded, the ADMX and associated ADML files can be placed in %SystemDrive%\Windows\SYSVOL\domain\Policies\PolicyDefinitions on the Domain Controller and they will be automatically loaded in the Group Policy Management Editor.

The Group Policy Administrative Templates for Microsoft 365, Office 2021, Office 2019 and Office 2016 can be obtained from Microsoft. Before implementing the recommendations in this publication, testing should be undertaken to ensure the potential for unintended negative impacts on business processes is reduced as much as possible.

This publication provides recommendations on hardening Microsoft 365, Office 2021, Office 2019 and Office 2016 applications. Hardening applications on workstations is an important part of reducing this risk. Workstations are often targeted by malicious actors using malicious websites, emails or removable media in an attempt to extract sensitive information.
