Restricting Microsoft Office macros is one of the eight controls in the Essential Eight, and one of the few you can genuinely finish in an afternoon. It is also the one most small businesses think they have already done, because Microsoft turned on part of it for them.
Part is not all. Here is what the Australian Signals Directorate asks for, what Microsoft already handles, and the settings you still have to apply yourself.
What the Essential Eight asks for at each maturity level
The wording in the Essential Eight Maturity Model is worth reading as written, because it is more specific than most summaries of it.
Maturity Level One asks for four things. Macros are disabled for users that do not have a demonstrated business requirement. Macros in files originating from the internet are blocked. Macro antivirus scanning is enabled. And macro security settings cannot be changed by users.
Maturity Level Two adds one more: macros are blocked from making Win32 API calls.
Maturity Level Three changes the shape of the control. Only macros running from within a sandboxed environment, a Trusted Location, or digitally signed by a trusted publisher are allowed to execute. Those macros have to be checked for malicious code before they are signed or placed in a Trusted Location, only privileged users responsible for that checking can write to Trusted Locations, macros signed by an untrusted publisher cannot be enabled from the Message Bar or Backstage View, and the list of trusted publishers is validated at least annually.
So “turn macros off for everyone” gets you Level One on the first requirement. It does not get you Level Three. That is a common misreading worth clearing up before you start.
What Microsoft already does for you
Since 2022, Office on Windows blocks VBA macros in files that carry Mark of the Web, which Windows adds to anything downloaded from the internet or opened from an untrusted zone. Users see a red Security Risk banner with no Enable Content button. Microsoft’s documentation on the change sets out when it reached each update channel, starting with Current Channel version 2206 in July 2022.
Two limits on that default. It only covers Access, Excel, PowerPoint, Project, Publisher, Visio and Word on Windows, not Office on Mac, iOS, Android or the web. And Mark of the Web only applies on NTFS volumes, so a file copied to a FAT32 USB stick loses it.
An unconfigured default is also not a control you can evidence. ASD asks that macro security settings cannot be changed by users, and a default a user can override by ticking Unblock in file properties does not meet that.
The licensing catch that stops most small businesses
Check this before you plan anything else. Microsoft states plainly that these policies can only be used with Microsoft 365 Apps for enterprise, and that they are not available for Microsoft 365 Apps for business.
Microsoft 365 Business Basic, Business Standard and Business Premium ship Microsoft 365 Apps for business. If that is what your team is licensed for, the policy route below will not apply, and you are looking at a licence change or an approach built on device management and attack surface reduction rules instead. Sort that out first, because nothing else here works around it.
Step 1: decide who has a demonstrated business requirement
ASD’s Restricting Microsoft Office macros publication ranks the approaches by security benefit. All macros disabled is rated very high. Macros signed by trusted publishers, and macros from Trusted Locations, are rated high. Letting users decide case by case with no additional measures is rated low, and enabling everything “should never be implemented”.
Turning everything off is the default for anyone without a demonstrated need, and most of your staff are in that group. Ask the finance and operations people what they actually run, get the file names, and keep that list. It becomes your exceptions list.
Step 2: set the macro notification policy
In the Group Policy Management Console, each application has its own policy under User Configuration\Policies\Administrative Templates. For Word that is Microsoft Word 2016\Word Options\Security\Trust Center, and for Excel Microsoft Excel 2016\Excel Options\Security\Trust Center. Access, PowerPoint, Project, Publisher and Visio each have an equivalent. The 2016 naming is correct even on current versions of Microsoft 365, and ASD says the same.
Enable VBA Macro Notification Settings and choose:
- Disable all without notification for users with no business requirement.
- Disable all except digitally signed macros, with Require macros to be signed by a trusted publisher selected, for users who do have one. This is Microsoft’s own security baseline recommendation.
Two naming quirks catch people out. In Excel the policy is called Macro Notification Settings, not VBA Macro Notification Settings. And in Excel’s policy values and interface, the word “all” is replaced by “VBA”, so you are looking for “Disable VBA macros without notification”.
Step 3: block macros from the internet, explicitly
In the same Trust Center node for each application, set Block macros from running in Office files from the Internet to Enabled. Microsoft recommends this as part of its security baseline and notes that if you configure it, the default change above becomes irrelevant to you. That is exactly what you want: a setting you chose, not a default you inherited.
Step 4: close the ways around it
A macro policy with open Trusted Locations and trusted documents is not really a macro policy. In each application’s Trust Center node, ASD recommends:
- Turn off trusted documents: Enabled.
- Turn off Trusted Documents on the network: Enabled.
- Trust access to Visual Basic Project: Disabled.
- Disable all trusted locations: Enabled, unless Trusted Locations are the approach you have deliberately chosen.
- Allow Trusted Locations on the network: Disabled, unless you are running a controlled network Trusted Location that only approved users can write to.
Under Microsoft Office 2016\Security Settings, also set Automation Security to “Disable macros by default” if you are disabling everything, and set Allow mix of policy and user locations to Disabled either way.
Step 5: turn on macro scanning and block Win32 API calls
Macro antivirus scanning is a Level One requirement. Under each application’s Security node, ASD points to Macro Runtime Scan Scope, set to “Enable for all documents”, along with the “Scan encrypted macros” settings for Word, Excel and PowerPoint.
For Level Two, the Win32 API requirement maps to one attack surface reduction rule: Block Win32 API calls from Office macros, GUID 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b, listed in Microsoft’s ASR rules reference. It depends on Microsoft Defender Antivirus and the Antimalware Scan Interface. Microsoft notes that most organisations never need Win32 API calls from VBA, even when they use macros for other things. Run it in audit mode for a fortnight, then switch it to block.
Step 6: deploy it, then prove it
Group Policy is one option. Cloud Policy, at config.office.com, applies the same user-level policies to devices that are not domain joined, and flags which settings are part of Microsoft’s recommended baseline. Your device management platform can deploy the equivalent settings too.
Then check it on a real machine rather than trusting the console. Download a macro-enabled file in a web browser and open it. You should see the Security Risk banner with no way to enable content. To confirm a file carries Mark of the Web, run notepad filename:Zone.Identifier at a command prompt: a ZoneId of 3 means internet, and macros in that file are blocked.
If a team genuinely needs macros
Get the macros signed, deploy the public code signing certificate to the users who need it, and stop users adding trusted publishers themselves. Microsoft flags the catch: every macro signed with that certificate is trusted, and a trusted publisher is a Windows-wide setting, not an Office one. Whoever holds that certificate holds a key to every desk in the business.
The part no setting fixes
ASD’s guidance on social engineering makes the point directly: when macros are disabled, attackers move on to talking someone into turning them back on, often with polite, plausible instructions. Any request to change a security setting, run code or alter a configuration should be verified independently, on a number the person already had. Tell your team that in those words.
Start here today: check which Microsoft 365 apps licence your staff are on. If it is Microsoft 365 Apps for business, the policy route is closed to you, and that is the conversation to have first.
If you’d like a second opinion on where your macro settings actually sit, get in touch.