Re-evaluating “Block Flash activation in Office documents” (change to "Block all activation")

[FinnvanDamme]

Context

• CIS recommends: Block all activation
• Defender XDR flags missing configuration as remediation required
• OIB currently sets:
  • Block embedding/linking, allow other activation

---

Observation

This is a deviation from CIS, but:

• Not documented in the OIB vs CIS rationale
• No clear explanation why a less restrictive option is chosen

---

Expected impact of "Block all activation"

Based on CIS:

• Functional impact: None (Flash is deprecated and rarely used)
• Security impact: Ensures Flash cannot be loaded anywhere in Office
• Operational impact: Minimal; only affects legacy documents with embedded Flash

---

Concern

Without rationale, it is unclear whether this is:

• An intentional usability trade-off
• Or a legacy configuration

---

Suggestion

• Document this in the OIB vs CIS rationale, explaining the deviation

—or—

• Align with CIS/XDR and move to Block all activation

---

Question

What is the reasoning behind choosing a less restrictive setting here?