Outlook Security Mode

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\outlook\security\adminsecuritymode

The adminsecuritymode REG_DWORD value selects the source from which classic Outlook obtains administrative security settings for the current user. It does not itself contain individual rules for attachments, add-ins, custom forms, or access through the Outlook object model.

The supported value data has the following meaning:

• 0: Outlook uses its default security settings. An absent value also results in the default mode.
• 1: Outlook uses the security policy published in the Outlook Security Settings public folder.
• 2: Outlook uses the security policy published in the Outlook 10 Security Settings public folder.
• 3: Outlook uses the associated policy-based Outlook security settings.

For dependent Outlook security policies delivered through Microsoft Intune, the Office cloud policy service, or Group Policy to take effect, this mode must be set to 3.

Notes

Additional effects

The selected policy source can govern such areas as potentially unsafe attachments, trusted add-ins, custom Outlook forms, and programmatic access through the Outlook object model. The individual settings present in that source determine which behaviors actually change.

Values 1 and 2 provide compatibility with legacy Outlook security forms stored in Exchange public folders. They are relevant only when the corresponding security form has been published and is accessible to Outlook.

Security

adminsecuritymode is a policy-source selector; by itself, it does not grant applications or add-ins additional permissions. Its security impact depends on the settings obtained from the selected source.

With value 3, dependent policies can, for example, deny, prompt for, or approve programmatic operations and can control attachment handling, ActiveX controls, and scripts in Outlook forms. A permissive combination of those policies can make access to Outlook data or security-sensitive operations easier. Conversely, selecting value 3 does not automatically create a hardened configuration—the dependent settings must impose the intended restrictions.

With value 0, Outlook does not use the administrative Outlook policies that depend on this security mode as its policy source. Consequently, organization-wide protections intended through those dependent policies might not be enforced.

Possible side effects

Changing the policy source can alter warnings and restrictions encountered by Outlook automation, add-ins, custom forms, or attachments. Restrictive dependent settings can disrupt legitimate integrations, while permissive settings can suppress warnings or allow operations that were previously blocked.

Notes

Because the value is stored under HKCU, its scope is the current user. The 16.0 version identifier is shared by Outlook 2016 and several later classic Outlook releases based on the same Office codebase.

This ADMX-based setting applies to classic Outlook for Windows. New Outlook for Windows uses a different policy model for many features.

Microsoft documentation

Microsoft Learn: List of settings for the Microsoft 365 Apps for Enterprise security baseline in Intune

Microsoft Learn: Information about e-mail security settings and AdminSecurityMode

Microsoft Learn: Map classic Outlook policies to new Outlook

See also

• Entry in the reference