- Microsoft 365 begins by default blocking Activex
- The “powerful” tool puts users at risk of execution of remote code
- Users will not be able to create or interact with Activex objects
Microsoft has revealed that Activex will be disabled by default in Microsoft 365, starting this month, citing security as the company’s most important decisive factor.
In a blog post, Microsoft Office Security Product Manager Zaeem Patel, while Activex, enabled rich interactions within Microsoft 365 applications, is a “powerful technology”, but it is also one that comes with associated security risks thanks to the amount of access it has to a user system.
From April 2025, Microsoft will disable all checks without review by default across Microsoft Word, Microsoft Excel, Microsoft PowerPoint and Microsoft Visio.
Microsoft starts blocking Activex by default this month
Patel previously criticized default settings for putting users at risk of being exploited by attackers through social engineering or malicious files.
A successful Activex attack could give malicious actors access to the execution of the remote code, which puts a victim’s system and the entire organization’s network at risk.
Activation of Activex now requires manual action through the Trust Center, and it assumes that the system administrator permits give access to this. Users without access will look gray instead.
“When Activex is disabled, you will no longer be able to create or interact with Activex objects in Microsoft 365 files,” Patel confirmed.
Described as “small building blocks that create applications that work over the Internet via web browsers,” explains Microsoft on a separate support page, how Activex controls can be used for command buttons, list boxes and dialog boxes.
“Some existing Activex objects will still be visible as a static image, but it will not be possible to interact with them,” Patel added.
Beta Channel users are already affected with the change, with current channel (preview) users running version 2504 (Build 18730.20030) or later also experiencing the change this month.
In a seeming recognition that some users may not be happy with the change and the fact that there is no real direct replacement, Microsoft offers to collect feedback via File> Feedback in any Microsoft 365 app.
