L1 BIO 16.01 ISO A.12.4.1 CIS 18.9.19.2

Block Signing Org Id Only

📅 2025-10-30

•

⏱️ 2 minuten lezen

•

🔴 Must-Have

💼 Management Samenvatting

Deze security regelen waarborgt de correcte configuratie van beveiligingsinstellingen op Windows endpoints.

Aanbeveling

Implementeer

Risico zonder

High

Risk Score

7/10

Implementatie

2u (tech: 1u)

Van toepassing op:

✓ Windows

Deze instelling is onderdeel van de Windows security baseline en beschermt tegen bekende aanvalsvectoren door het afdwingen van veilige configuraties.

PowerShell Modules Vereist

Primary API: Graph
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Dit regelen Configureerert block signing org id alleen via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.

Vereisten

office

Implementeeratie

Gebruik PowerShell-script block-signing-org-id-only.ps1 (functie Invoke-Monitoring) – Monitoren.

monitoring

Gebruik PowerShell-script block-signing-org-id-only.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script block-signing-org-id-only.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance en Auditing

Beleid documentatie

Compliance & Frameworks

CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell

# Control: O365-CO-000024 - Office applications must be configured to block signing into Office with non-organizational accounts
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\SignIn",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Green

    try {
        $valueName = "BlockSignInOptions"
        $expectedValue = 3  # 3 = Org ID only, 1 = Both blocked, 0 = Both allowed

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: BlockSignInOptions = $expectedValue (Org ID only)" -ForegroundColor Green
            return $true
        }
        else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: BlockSignInOptions = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    }
    catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "BlockSignInOptions" -Value 3 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: BlockSignInOptions = 3 (Org ID only)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    }
    catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}


function Invoke-Revert {
    Write-Host "Reverting O365-CO-000024: Office applications must be configured to block signing into Office with non-organizational accounts
" -ForegroundColor Yellow
    
    try {
        if ($WhatIf) {
            Write-Host "  [WhatIf] Would remove registry value" -ForegroundColor Cyan
            return $true
        }
        
        $valueName = "BlockSignInOptions"
        
        if (Test-Path $RegistryPath) {
            Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
            Write-Host "  Removed registry value: $valueName" -ForegroundColor Green
        }
        
        return $true
    }
    catch {
        Write-Host "  Error during revert: # Control: O365-CO-000024 - Office applications must be configured to block signing into Office with non-organizational accounts
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\SignIn",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Green

    try {
        $valueName = "BlockSignInOptions"
        $expectedValue = 3  # 3 = Org ID only, 1 = Both blocked, 0 = Both allowed

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: BlockSignInOptions = $expectedValue (Org ID only)" -ForegroundColor Green
            return $true
        } else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: BlockSignInOptions = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    } catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "BlockSignInOptions" -Value 3 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: BlockSignInOptions = 3 (Org ID only)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    } catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

if ($Monitoring) {
        $result = Invoke-Monitoring
        exit $(if ($result) { 0 } else { 1 })
    }
    elseif ($Remediation) {
        $result = Invoke-Remediation
        exit $(if ($result) { 0 } else { 1 })
    }
    elseif ($Revert) {
        $result = Invoke-Revert
        exit $(if ($result) { 0 } else { 1 })
    }
    else {
        Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
    }
}
catch {
    Write-Host "Script execution error: # Control: O365-CO-000024 - Office applications must be configured to block signing into Office with non-organizational accounts
        #Requires -Version 5.1
        # DISA STIG Microsoft Office 365 ProPlus v3r3

        param(
            [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\SignIn",
            [switch]$Monitoring,
            [switch]$Remediation,
            [switch]$Revert,
            [switch]$WhatIf
        )

        function Invoke-Monitoring {
            Write-Host "Monitoring O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Green

            try {
                $valueName = "BlockSignInOptions"
                $expectedValue = 3  # 3 = Org ID only, 1 = Both blocked, 0 = Both allowed

                if (-not (Test-Path $RegistryPath)) {
                    Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
                    return $false
                }

                $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

                if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
                    Write-Host "✓ Control compliant: BlockSignInOptions = $expectedValue (Org ID only)" -ForegroundColor Green
                    return $true
                }
                else {
                    $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
                    Write-Host "✗ Control non-compliant: BlockSignInOptions = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
                    return $false
                }
            }
            catch {
                Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }

        function Invoke-Remediation {
            Write-Host "Remediating O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Yellow

            try {
                if (-not (Test-Path $RegistryPath)) {
                    New-Item -Path $RegistryPath -Force | Out-Null
                }

                Set-ItemProperty -Path $RegistryPath -Name "BlockSignInOptions" -Value 3 -Type DWord -Force
                Write-Host "✓ Registry value set successfully: BlockSignInOptions = 3 (Org ID only)" -ForegroundColor Green

                Start-Sleep -Seconds 1
                return Invoke-Monitoring
            }
            catch {
                Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }


        function Invoke-Revert {
            Write-Host "Reverting O365-CO-000024: Office applications must be configured to block signing into Office with non-organizational accounts
" -ForegroundColor Yellow
    
            try {
                if ($WhatIf) {
                    Write-Host "  [WhatIf] Would remove registry value" -ForegroundColor Cyan
                    return $true
                }
        
                $valueName = "BlockSignInOptions"
        
                if (Test-Path $RegistryPath) {
                    Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
                    Write-Host "  Removed registry value: $valueName" -ForegroundColor Green
                }
        
                return $true
            }
            catch {
                Write-Host "  Error during revert: # Control: O365-CO-000024 - Office applications must be configured to block signing into Office with non-organizational accounts
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\SignIn",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Green

    try {
        $valueName = "BlockSignInOptions"
        $expectedValue = 3  # 3 = Org ID only, 1 = Both blocked, 0 = Both allowed

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: BlockSignInOptions = $expectedValue (Org ID only)" -ForegroundColor Green
            return $true
        } else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: BlockSignInOptions = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    } catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "BlockSignInOptions" -Value 3 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: BlockSignInOptions = 3 (Org ID only)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    } catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

if ($Monitoring) {
    $result = Invoke-Monitoring
    exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
    $result = Invoke-Remediation
    exit $(if ($result) { 0 } else { 1 })
} else {
    Write-Host "Usage: .\block-signing-org-id-only.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
    Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
    Write-Host "> Microsoft Office 2016 > Sign In > Block signing into Office: Enabled, Org ID only" -ForegroundColor White
}" -ForegroundColor Red
                return $false
            }
        }

        # Main execution
        try {
            if ($Monitoring) {
                $result = Invoke-Monitoring
                exit $(if ($result) { 0 } else { 1 })
            }
            elseif ($Remediation) {
                $result = Invoke-Remediation
                exit $(if ($result) { 0 } else { 1 })
            }
            else {
                Write-Host "Usage: .\block-signing-org-id-only.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
                Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
                Write-Host "> Microsoft Office 2016 > Sign In > Block signing into Office: Enabled, Org ID only" -ForegroundColor White
            }" -ForegroundColor Red
    exit 1
}" -ForegroundColor Red
            return $false
        }
    }

    # Main execution
    try {
        if ($Monitoring) {
            $result = Invoke-Monitoring
            exit $(if ($result) { 0 } else { 1 })
        }
        elseif ($Remediation) {
            $result = Invoke-Remediation
            exit $(if ($result) { 0 } else { 1 })
        }
        elseif ($Revert) {
            $result = Invoke-Revert
            exit $(if ($result) { 0 } else { 1 })
        }
        else {
            Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
        }
    }
    catch {
        Write-Host "Script execution error: # Control: O365-CO-000024 - Office applications must be configured to block signing into Office with non-organizational accounts
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\SignIn",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Green

    try {
        $valueName = "BlockSignInOptions"
        $expectedValue = 3  # 3 = Org ID only, 1 = Both blocked, 0 = Both allowed

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: BlockSignInOptions = $expectedValue (Org ID only)" -ForegroundColor Green
            return $true
        } else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: BlockSignInOptions = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    } catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "BlockSignInOptions" -Value 3 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: BlockSignInOptions = 3 (Org ID only)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    } catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}


function Invoke-Revert {
    Write-Host "Reverting O365-CO-000024: Office applications must be configured to block signing into Office with non-organizational accounts
        " -ForegroundColor Yellow
    
    try {
        if ($WhatIf) {
            Write-Host "  [WhatIf] Would remove registry value" -ForegroundColor Cyan
            return $true
        }
        
        $valueName = "BlockSignInOptions"
        
        if (Test-Path $RegistryPath) {
            Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
            Write-Host "  Removed registry value: $valueName" -ForegroundColor Green
        }
        
        return $true
    } catch {
        Write-Host "  Error during revert: # Control: O365-CO-000024 - Office applications must be configured to block signing into Office with non-organizational accounts
        #Requires -Version 5.1
        # DISA STIG Microsoft Office 365 ProPlus v3r3

        param(
            [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\SignIn",
            [switch]$Monitoring,
            [switch]$Remediation,
            [switch]$Revert,
            [switch]$WhatIf
        )

        function Invoke-Monitoring {
            Write-Host "Monitoring O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Green

            try {
                $valueName = "BlockSignInOptions"
                $expectedValue = 3  # 3 = Org ID only, 1 = Both blocked, 0 = Both allowed

                if (-not (Test-Path $RegistryPath)) {
                    Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
                    return $false
                }

                $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

                if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
                    Write-Host "✓ Control compliant: BlockSignInOptions = $expectedValue (Org ID only)" -ForegroundColor Green
                    return $true
                }
                else {
                    $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
                    Write-Host "✗ Control non-compliant: BlockSignInOptions = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
                    return $false
                }
            }
            catch {
                Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }

        function Invoke-Remediation {
            Write-Host "Remediating O365-CO-000024: Block signing into Office with non-organizational accounts" -ForegroundColor Yellow

            try {
                if (-not (Test-Path $RegistryPath)) {
                    New-Item -Path $RegistryPath -Force | Out-Null
                }

                Set-ItemProperty -Path $RegistryPath -Name "BlockSignInOptions" -Value 3 -Type DWord -Force
                Write-Host "✓ Registry value set successfully: BlockSignInOptions = 3 (Org ID only)" -ForegroundColor Green

                Start-Sleep -Seconds 1
                return Invoke-Monitoring
            }
            catch {
                Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }

        if ($Monitoring) {
            $result = Invoke-Monitoring
            exit $(if ($result) { 0 } else { 1 })
        }
        elseif ($Remediation) {
            $result = Invoke-Remediation
            exit $(if ($result) { 0 } else { 1 })
        }
        else {
            Write-Host "Usage: .\block-signing-org-id-only.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
            Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
            Write-Host "> Microsoft Office 2016 > Sign In > Block signing into Office: Enabled, Org ID only" -ForegroundColor White
        }" -ForegroundColor Red
        return $false
    }
}

# Main execution
try {
    if ($Monitoring) {
    $result = Invoke-Monitoring
    exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
    $result = Invoke-Remediation
    exit $(if ($result) { 0 } else { 1 })
} else {
    Write-Host "Usage: .\block-signing-org-id-only.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
    Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
    Write-Host "> Microsoft Office 2016 > Sign In > Block signing into Office: Enabled, Org ID only" -ForegroundColor White
}" -ForegroundColor Red
        exit 1
    }

Risico zonder implementatie

High: No auth tracking.

Management Samenvatting

Schakel in audit logging.

Implementatietijd: 2 uur
FTE required: 0.01 FTE

Block Signing Org Id Only

💼 Management Samenvatting

Implementatie

Vereisten

Implementeeratie

monitoring

Remediatie

Compliance en Auditing

Compliance & Frameworks

Automation

Risico zonder implementatie

Management Samenvatting

Share artikel