The Outlook Security Mode must be enabled to always use the Outlook Security Group Policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223359	O365-OU-000014	SV-223359r508019_rule		Medium

Description
This policy setting controls which set of security settings are enforced in Outlook. If you enable this policy setting, you can choose from four options for enforcing Outlook security settings: - Outlook Default Security - This option is the default configuration in Outlook. Users can configure security themselves, and Outlook ignores any security-related settings configured in Group Policy. - Use Security Form from "Outlook Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. - Use Security Form from "Outlook 10 Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. - Use Outlook Security Group Policy - Outlook uses security settings from Group Policy. Important: You must enable this policy setting if you want to apply the other Outlook security policy settings mentioned in this guide. If you disable or do not configure this policy setting, Outlook users can configure security for themselves, and Outlook ignores any security-related settings that are configured in Group Policy. Note: In previous versions of Outlook, when security settings were published in a form in Exchange Server public folders, users who needed these settings required the HKEY_CURRENT_USER >> Software >> Policies >> Microsoft >> Security >> CheckAdminSettings registry key to be set on their computers for the settings to apply. In Outlook, the CheckAdminSettings registry key is no longer used to determine users' security settings. Instead, the Outlook Security Mode setting can be used to determine whether Outlook security should be controlled directly by Group Policy, by the security form from the Outlook Security Settings Public Folder, or by the settings on users' own computers.

Description

This policy setting controls which set of security settings are enforced in Outlook. If you enable this policy setting, you can choose from four options for enforcing Outlook security settings: - Outlook Default Security - This option is the default configuration in Outlook. Users can configure security themselves, and Outlook ignores any security-related settings configured in Group Policy. - Use Security Form from "Outlook Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. - Use Security Form from "Outlook 10 Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. - Use Outlook Security Group Policy - Outlook uses security settings from Group Policy. Important: You must enable this policy setting if you want to apply the other Outlook security policy settings mentioned in this guide. If you disable or do not configure this policy setting, Outlook users can configure security for themselves, and Outlook ignores any security-related settings that are configured in Group Policy. Note: In previous versions of Outlook, when security settings were published in a form in Exchange Server public folders, users who needed these settings required the HKEY_CURRENT_USER >> Software >> Policies >> Microsoft >> Security >> CheckAdminSettings registry key to be set on their computers for the settings to apply. In Outlook, the CheckAdminSettings registry key is no longer used to determine users' security settings. Instead, the Outlook Security Mode setting can be used to determine whether Outlook security should be controlled directly by Group Policy, by the security form from the Outlook Security Settings Public Folder, or by the settings on users' own computers.

STIG	Date
Microsoft Office 365 ProPlus Security Technical Implementation Guide	2020-09-11

Details

Check Text ( C-25032r442296_chk )
Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode is set to "Enabled (Use Outlook Security Group Policy)". Use the Windows Registry to navigate to the following key: HKCU\software\policies\microsoft\office\16.0\ outlook\security If the value for adminsecuritymode is set to REG_DWORD = 3, this is not a finding.

Check Text ( C-25032r442296_chk )

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode is set to "Enabled (Use Outlook Security Group Policy)".

Use the Windows Registry to navigate to the following key:

HKCU\software\policies\microsoft\office\16.0\ outlook\security

If the value for adminsecuritymode is set to REG_DWORD = 3, this is not a finding.

Fix Text (F-25020r442297_fix)
Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode to "Enabled (Use Outlook Security Group Policy)".