Microsoft's Secure Future Initiative (SFI) is set to implement significant security enhancements across Microsoft 365 services, including Office applications, Entra, SharePoint Online, and OneDrive. Starting mid-July 2025, several legacy protocols will be disabled by default, aiming to bolster the platform's security posture.
Key Changes:
- Disabling Legacy Protocols:
- RPS Protocol: Access to SharePoint and OneDrive via the Relying Party Suite (RPS) protocol will be blocked. RPS, previously used by older web browsers and client applications lacking modern authentication, is vulnerable to brute force attacks.
- FPRPC Protocol: The FrontPage Remote Procedure Call (FPRPC) protocol, originating from the discontinued FrontPage web design tool, will also be disabled. Despite its obsolescence, FPRPC is still utilized in some legacy applications and automated processes, posing security risks.
- Third-Party Application Access:
- Users will no longer have the ability to grant consent to third-party applications accessing files and pages. Instead, administrators must explicitly approve such access, allowing for granular control over permissions and enhancing overall security.
While these measures significantly enhance security by default, they may disrupt existing workflows that rely on the affected protocols and third-party applications. Administrators are advised to promptly identify and update or replace applications dependent on these legacy protocols. Establishing a workflow for approving third-party application access is also recommended to ensure continuity of operations.
Timeline:
- Mid-July 2025: Initiation of protocol deactivation and implementation of new access controls.
- August 2025: Completion of the transition across all Microsoft 365 tenants.
Additional Security Updates:
In parallel, Microsoft is introducing new security settings for Windows 365 cloud PCs:
- Default Deactivation of Peripheral Redirection: Clipboard, storage, USB devices, and printer redirection between cloud systems and local computers will be disabled by default. This change affects only newly set up cloud PCs; existing systems remain unaffected.
- Enhanced Security Features: New Windows 365 setups using Windows 11 Gallery images will have Virtualization-Based Security (VBS), Credential Guard, and Hypervisor-Protected Code Integrity (HVCI) enabled by default.
By proactively addressing vulnerabilities associated with legacy protocols and enhancing default security configurations, Microsoft's SFI aims to provide a more secure and resilient environment for all Microsoft 365 users.
Source: heise online Old apps and third-party providers blocked: Major Microsoft 365 security impact
