Block OLE Graph

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\common\security\blockolegraph

This user-scoped Office policy prevents the legacy Object Linking and Embedding (OLE) Graph functionality from running in Microsoft 365 Apps. It specifically covers OLE components such as MSGraph.Application and MSGraph.Chart.

When a document contains one of these objects, Office does not load the executable OLE Graph component. It renders a static image in its place.

Notes

Security

OLE Graph is a legacy feature that can be targeted by specially crafted documents to run malicious code. Blocking the component reduces exposure to known exploitation techniques that depend on OLE Graph objects.

This is a narrowly scoped control. It does not block all OLE objects, macros, ActiveX controls, or the separate OrgChart component.

Possible side effects

Existing OLE Graph objects can remain visible as static representations, but users cannot activate or edit them through the legacy OLE Graph functionality. Documents and automated processes that depend on MSGraph.Application or MSGraph.Chart might therefore lose functionality.

Notes

Because the value resides in the HKCU policy branch, its scope is the individual user. “Block OrgChart” is a separate policy backed by a different registry value, although some Microsoft security documentation discusses both protections together.

Microsoft documentation

Microsoft Learn: Block OLE Graph and OrgChart objects

Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference

See also

• Entry in the reference