Office 365 "The fine print" popup message - is it legitimate?

Solved, my first option or angle of attack was to disable the Office Updates, the second Randy helped me out with though I would've assumed the same same 2nd process, which was to run Office Repair after disabling the Office Updates so it could overwrite any changed files with the originals. This should get rid of those 365 popups in previous versions of Office.

Oleg, thanks, didn't realize that. 

I thought it better to check here, than to open a support ticket for a known issue.  And, other comments didn't indicate an exceptional experience with support on this topic.  :)

The reason I'm being so cautious is that, years ago, my then-new pc got ransomware.  I now use the paid version of Malwarebytes antimalware, but I'm still skeptical about unexpected popup msgs.

I see there are other discussion threads related to this one, where folks are telling each other that the popup just indicates that the most recent updates applied, require new 'fine print' for the user to sign.  That's demonstrably incorrect, and your explanation is still the best I've seen.  ty.

Honestly, i doubt you will get official reaponse here. If you need that, file a support ticket and ask them to provide you one. 

Office is not always updating on the same day everywhere (sometimes it takes a week or longer), it can be that update was released on July 28, but your client updated later. Mine hasn't updated until i ran update check manually yesterday and got the same popup. That confirmed my theory of faulty update and not malware. 

I don't know of a public link to this information. I took it from our Admin center of Office 365. Im not an MS representative. Just a user like you, or more specifically IT admin at organization using Office 365.

Oleg, thanks so much for tracking this down!  

While I had noticed that the license agreement text said 'last updated September 2017', I was concerned at the possibility of malware concealed by an apparently legitimate page of content.  

I even verify updates to products from Adobe and Malwarebytes, when they pop up, out of an overabundance of caution.  :) 

Thanks!

eta:  after reading others' replies, I'd also like to see an official communication from Microsoft. 

The screen image in Oleg's reply appears to be from the Office 365 admin portal, so presumably another Office 365 administrator can verify its provenance....

Hello Oleg K,

You have provided some information that you say is from a Microsoft advisory.. No offense, but I still would prefer to see a Microsoft response to this. 

Can you provide a link to the Microsoft website that contains this information ?  

For one thing, you listed "Start time: Saturday, July 28, 2018, at 2:00 PM UTC", but I was using Office 2016 applications without issue on Monday July 30.  I didn't see the popup until Tuesday July 31.

When is Microsoft going to respond to this matter ?   

Does Oleg K represent and speak on behalf of Microsoft ?

Completely agree - incidents such as this and the Windows 10 1803 BSOD update have all but destroyed my confidence in Microsoft.  Microsoft has a very real and serious credibility problem.

---

Mark Tompkins wrote:

In important ways, it is "malware" -- it is inadequately sourced, so it could be "spoof'ed"...

The behavior is clearly wrong -- i.e. prompting for accepting a license that has already been accepted...

... and, even if it is Microsoft's mistake, there is no way to determine that it is harmless without triggering unknown events...    (so, for example, it is entirely possible that it would be "accepting" additional activities that a user did not want...)

 

Thus, users should not be clicking on something like this...    it should only be happening at an install sequence...

---

---

Mark Tompkins wrote:

In important ways, it is "malware" -- it is inadequately sourced, so it could be "spoof'ed"...

The behavior is clearly wrong -- i.e. prompting for accepting a license that has already been accepted...

... and, even if it is Microsoft's mistake, there is no way to determine that it is harmless without triggering unknown events...    (so, for example, it is entirely possible that it would be "accepting" additional activities that a user did not want...)

 

Thus, users should not be clicking on something like this...    it should only be happening at an install sequence...

---

I heartily agree!  I was a little shocked at an earlier post that read, in part, "It is OK to Accept.  My version of the Agreement really didn't say anything....it didn't look like the standard Microsoft agreement. "

This is not normal behavior for a product that was installed months or years ago.  Simply clicking "Accept" in boxes that pop up out of nowhere is a recipe for disaster.

In important ways, it is "malware" -- it is inadequately sourced, so it could be "spoof'ed"...

The behavior is clearly wrong -- i.e. prompting for accepting a license that has already been accepted...

... and, even if it is Microsoft's mistake, there is no way to determine that it is harmless without triggering unknown events...    (so, for example, it is entirely possible that it would be "accepting" additional activities that a user did not want...)

Thus, users should not be clicking on something like this...    it should only be happening at an install sequence...

That's the detailed information from advisory:

Title: Issues accessing Office Online User Impact: Users may receive an unexpected pop-up regarding the license agreement and may also be unable to access Office clients.

More info: When users receive the pop-up regarding the End User Licensing Agreement (EULA), clicking "Accept" should enable access to Office clients. Dismissing the pop-up may result in Office clients closing. The content of the licensing agreement has not changed.

Current status: We've identified that a recent feature update has modified the storage location of the EULA acceptance information and is causing users to receive a pop-up message prompting them to accept the user agreement. We've initiated the process of reverting this update to mitigate impact.

Scope of impact: This issue may potentially affect any of your users attempting to access Office clients. Start time: Saturday, July 28, 2018, at 2:00 PM UTC

So it was a technical bug which caused for the same EULA agreement which is shown when activating new product to be shown to existing users/installations. It is saying they are now reverting the faulting update.

I'm starting to wonder if it would be useful to get an attorney involved.

It is not mentioning malware because it is not a malware. One can click on the advisory to read details. I haven't read the details. It was enough to email my users to click Accept when it appears after Office updates. In our case it doesn't come up again and is not blocking Office usage. Have more pressing issues than a simple license agreement popup..

I just clicked on a Word doc and it opened without any issues. No pop-up, no muss no fuss. Fingers crossed?

I also note that Microsoft's acknowledgement, above, acknowledges only the problem--it does not tell us whether it/is/was a MS issue or potentially malware. It's good to see progress, but it gives us no guidance.

And Microsoft's Virtual Agent is STILL working on connecting me to a live agent . . .

But you could say the same of Apple (Jobs and Gates took the graphical OS idea from Xerox)  and any other organisation that creates an ecosystem that you are joining ... this behaviour is not Microsoft specific and inherent to the SaaS model across the globe.  Just to be clear I'm not defending this activity ..

James;

I do not agree with Microsoft's coercive behavior.  I loathe the way they just do whatever they want and push out sub-standard software and then leave us without support.  My personal philosophy is that Mr. Gates was never an OS genius but a marketing genius.  However, being responsible for a company full of desktops and just wanting the users to continue working means that I have to accept things the way they are.  I guess we could all explore alternative software but it might be a little late for that.  I am just grateful that this time, at least, it wasn't some malware trying to destroy us.  I am also grateful for one resource left to us, namely blogs like this one.