Domain History

m365.cloud.microsoft

Grade B · 70/100 · 5/7 security headers present

Security Score

70/ 100

Security Headers

5/ 7

CSP Violations

NoViolations

Issues Found

22Issues

Recommendations

3Available

Security

70 / 100

Good security foundation but some CSP hardening recommended.

Compliance

67 / 100

Several compliance gaps found in CSP implementation.

Best Practices

85 / 100

Good practices in place but missing some important optimizations.

CSP Analysis

Content Security PolicyHIGH

default-src 'self';base-uri 'self';script-src 'nonce-mVeahZx3dsfZSs4qJ5T01A==' 'strict-dynamic' 'report-sample' https:;report-to csp-endpoint;upgrade-insecure-requests;style-src 'self' 'report-sample' *.cdn.office.net *.microsoft.com res-dev.cdn.officeppe.net 'unsafe-inline' https://www.microsoft.com/;font-src 'self' data: *.cdn.office.net res-dev.cdn.officeppe.net data c.s-microsoft.com *.microsoft.com;connect-src 'self' https://browser.pipe.aria.microsoft.com https://browser.events.data.microsoft.com *.office.com *.cdn.office.net res-dev.cdn.officeppe.net https://consentreceiverfd-prod.azurefd.net https://*.clarity.ms/collect https://turbo.microsoft.com https://deeplinkservice.svc.cloud.microsoft https://sdf.deferreddeeplinkservice.microsoft.com data:;frame-src https://login.microsoftonline.com https://login.live.com mem.gfx.ms amcdn.msftauth.net amcdn.msauth.net;img-src * data: blob:;worker-src 'self' blob:;child-src 'self' blob:;report-uri https://csp.microsoft.com/report/Harmony-App-PROD;form-action https://login.microsoftonline.com;frame-ancestors 'self';

Directive Analysis

default-srcLOW

self

base-uriLOW

self

script-srcHIGH

nonce-mVeahZx3dsfZSs4qJ5T01A== strict-dynamic report-sample https:

•CRITICAL: 'https:' in script-src allows scripts from ANY HTTPS domain

report-toLOW

csp-endpoint

upgrade-insecure-requestsLOW

style-srcHIGH

self report-sample *.cdn.office.net *.microsoft.com res-dev.cdn.officeppe.net unsafe-inline https://www.microsoft.com/

•Subdomain wildcard '*.cdn.office.net' in style-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.microsoft.com' in style-src - vulnerable to subdomain takeover

•Unsafe inline execution allowed in style-src

font-srcHIGH

self data: *.cdn.office.net res-dev.cdn.officeppe.net data c.s-microsoft.com *.microsoft.com

•Info: 'data:' URI in font-src

•Subdomain wildcard '*.cdn.office.net' in font-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.microsoft.com' in font-src - vulnerable to subdomain takeover

connect-srcHIGH

self https://browser.pipe.aria.microsoft.com https://browser.events.data.microsoft.com *.office.com *.cdn.office.net res-dev.cdn.officeppe.net https://consentreceiverfd-prod.azurefd.net https://*.clarity.ms/collect https://turbo.microsoft.com https://deeplinkservice.svc.cloud.microsoft https://sdf.deferreddeeplinkservice.microsoft.com data:

•Subdomain wildcard '*.office.com' in connect-src - vulnerable to subdomain takeover

•Subdomain wildcard '*.cdn.office.net' in connect-src - vulnerable to subdomain takeover

•Info: 'data:' URI in connect-src

frame-srcLOW

https://login.microsoftonline.com https://login.live.com mem.gfx.ms amcdn.msftauth.net amcdn.msauth.net

img-srcHIGH

* data: blob:

•CRITICAL: Bare wildcard (*) in img-src allows ANY source

•Info: 'data:' URI in img-src

•Info: 'blob:' URI in img-src

worker-srcMEDIUM

self blob:

•Info: 'blob:' URI in worker-src

•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob content

child-srcLOW

self blob:

•Info: 'blob:' URI in child-src

report-uriLOW

https://csp.microsoft.com/report/Harmony-App-PROD

•Deprecated: 'report-uri' is deprecated in CSP Level 3. Use 'report-to' directive instead.

form-actionLOW

https://login.microsoftonline.com

frame-ancestorsLOW

self

Missing Directives

⚠HIGHMissing HIGH directive object-src (Plugin control - should be 'none')

Strict-Dynamic Analysis

✓Properly Configured

✓'strict-dynamic' properly configured - allows trusted scripts to load dependencies securely

•Whitelist entries ["https:"]... are ignored when strict-dynamic is present (CSP3 behavior)

•DANGER: 'http:' or 'https:' scheme-source alongside strict-dynamic — older browsers that don't support strict-dynamic will fall back to allowing scripts from ANY HTTP/HTTPS origin

Security Headers

✗Cross-Origin-Opener-PolicyMissing

Isolates the browsing context to prevent Spectre-type side-channel attacks and cross-origin window manipulation.

How to add it:

nginx

add_header Cross-Origin-Opener-Policy "same-origin" always;

apache

Header always set Cross-Origin-Opener-Policy "same-origin"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Cross-Origin-Opener-Policy to "same-origin"

✗Permissions-PolicyMissing

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

How to add it:

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

cloudflare

Rules > Transform Rules > HTTP Response Header Modification > Set Permissions-Policy value

✓Referrer-PolicyPresent

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

✓Strict-Transport-SecurityPresent

max-age=31536000; includeSubDomains

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

✓X-Content-Type-OptionsPresent

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

✓X-Frame-OptionsPresent

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

✓X-XSS-ProtectionPresent

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.

2 recommended security headers are missing on m365.cloud.microsoft.

Issues Found

•CRITICAL: 'https:' in script-src allows scripts from ANY HTTPS domaincritical
•CRITICAL: Bare wildcard (*) in img-src allows ANY sourcecritical
•DANGER: 'http:' or 'https:' scheme-source alongside strict-dynamic — older browsers that don't support strict-dynamic will fall back to allowing scripts from ANY HTTP/HTTPS origincritical
•Deprecated: 'report-uri' is deprecated in CSP Level 3. Use 'report-to' directive instead.info
•Info: 'blob:' URI in child-srcinfo
•Info: 'blob:' URI in img-srcinfo
•Info: 'blob:' URI in worker-srcinfo
•Info: 'data:' URI in connect-srcinfo
•Info: 'data:' URI in font-srcinfo
•Info: 'data:' URI in img-srcinfo
•Missing HIGH directive object-src (Plugin control - should be 'none')high
•Missing security header: Cross-Origin-Opener-Policymedium
•Missing security header: Permissions-Policymedium
•RISK: 'blob:' in worker-src allows creation of workers from dynamic blob contentmedium
•Subdomain wildcard '*.cdn.office.net' in connect-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cdn.office.net' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.cdn.office.net' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.microsoft.com' in font-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.microsoft.com' in style-src - vulnerable to subdomain takeovermedium
•Subdomain wildcard '*.office.com' in connect-src - vulnerable to subdomain takeovermedium
•Unsafe inline execution allowed in style-srchigh
•Whitelist entries ["https:"]... are ignored when strict-dynamic is present (CSP3 behavior)medium

Recommendations

→Add object-src directive with appropriate restrictions
→Consider implementing a stricter Content Security Policy
→Replace wildcards (*) with specific source lists

Beyond headers: infrastructure exposure

via OSN, our sister project

Security headers protect the browser. OSN maps what's exposed underneath — servers, open ports, known CVEs, DNS and WHOIS.

See what the internet sees about m365.cloud.microsoft

See full exposure report on OSN →Free, no signup.