Stand-alone versions of the Office suite not impacted

May 22, 2018 11:58 GMT  ·  By

Microsoft has recently announced a policy update that would restrict the use of Flash, Shockwave, and Silverlight controls in Office 365.

As noted by Tom Gallagher, Manager of Microsoft Office Security Engineering team, such content will be blocked from being activated in Office, with the timeline further detailed in a separate blog post.

Specifically, the software giant says the restriction will be implemented because Flash, Shockwave, and Silverlight are still being used in exploit campaigns against Office users, while at the same time, the user base of these controls is shrinking.

Adobe itself will pull Flash by the end of 2020, and Silverlight is also projected to reach end of support in 2021.

Microsoft explains in the post that these controls will be blocked gradually, starting with Office 365 Monthly Channel in June this year. The Semi Annual Targeted (SAT( Channel will follow in September, while the same policy will be implemented in the Semi Annual (SA) Channel in January 2019.

Customers will be allowed to unblock content

Technically, once the block comes into effect, Flash and Silverlight content in Office 365 documents would no longer be enabled. This policy won’t affect Office 2016, 2013, or 2010.

“This change does not cover scenarios where these controls are activated outside the Office process, for example, a Flash video inserted into a document via the Insert Online Video functionality,” Microsoft notes.

Microsoft will still allow customers to unblock the controls should they really want to, and the company offers dedicated guidance in this regard available here. This, however, isn’t recommended, as there are several security factors involved in this decision, and blocking Flash could help prevent certain exploits from targeting systems.

“While we are confident that this will not impact most Office users, we do understand there is potential to impact some of our users and we apologize for the inconvenience caused as a result,” it says.