Allow Active X One Off Forms

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\outlook\security\allowactivexoneoffforms

This REG_DWORD value determines which ActiveX controls classic Outlook for Windows may load in one-off forms. A one-off form stores its form definition in the individual Outlook item instead of referring to a published form.

The value data has the following meanings:

• 0: Load only Outlook Controls
• 1: Allows only Safe Controls
• 2: Allows all ActiveX Controls

The setting applies only to ActiveX controls in these forms. It does not determine whether scripts contained in a one-off form may run; Outlook manages form scripting through separate security settings.

Notes

Security

A value of 0 limits loading to the controls permitted by Outlook. A value of 1 expands the permitted set to controls classified as safe. That classification does not, by itself, establish that every affected control or form comes from a trusted source.

A value of 2 also permits ActiveX controls that are not classified as safe. A malicious or vulnerable control delivered through an Outlook item could consequently execute code with the signed-in user's permissions. ActiveX controls can potentially access resources such as the local file system and the Windows registry.

This policy does not necessarily override broader ActiveX restrictions. In particular, an ActiveX control for which a kill bit is set remains blocked.

Possible side effects

With a value of 0 or 1, legacy or specialized Outlook forms may appear incomplete or lose functionality when they depend on ActiveX controls that the selected mode does not permit. A value of 2 can avoid such compatibility failures, but increases the attack surface.

Notes

This is a user-scoped administrative-template policy for classic Outlook under the Office 16.0 version branch. In addition to Office 2016, Microsoft uses this branch for later perpetual Office releases and Microsoft 365 Apps.

The Microsoft 365 Apps security baseline enables this policy with “Load only Outlook Controls.” This is a baseline value and should not be interpreted as a guaranteed product default for every Outlook installation.

Microsoft documentation

Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference

Microsoft Learn: Save a Form with the Item (One-off Forms)

Microsoft Support: Enable or disable ActiveX settings in Office files

Microsoft Download Center: Administrative Template files (ADMX/ADML) for Microsoft Office

See also

• Entry in the reference