What are Office macro settings?
Where it stops an attack.
- The attack An “invoice” attachment asks the reader to click Enable content.
- Stopped here Macros in files from the internet are blocked, and staff who don’t need macros have them switched off.
- The result The document opens. The malicious code never runs.
Essential 8 macro settings by maturity level
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
Who can run macros Only staff with a business need No change
Adds: only macros that are sandboxed, in a Trusted Location or signed by a trusted publisher
Macros in files from the internet Blocked No change
No change
Macro antivirus scanning On No change
No change
Users change macro settings Not allowed No change
No change
Win32 API calls from macros Not required
Blocked No change
Vetting approved macros Not required
Not required
Checked before signing. Trusted publishers reviewed yearly
Trusted Locations and signatures Not required
Not required
Only vetting staff can write to Trusted Locations. Untrusted or older signatures can’t be enabled
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to restrict Office macros
Protection first, disruption last.
- 01
Find who uses macros
Usually a few finance or operations staff. Everyone else has macros off. - 02
Block internet macros for everyone
Files downloaded from the internet can’t run macros, even for approved users. - 03
Lock the settings
Set centrally through Intune or Group Policy, so users can’t switch them back. - 04
Sign or relocate approved macros
Business-critical macros move to Trusted Locations or get signed, ready for Maturity Level 3.
Common macro settings mistakes
Where rollouts go wrong.
-
Leaving “Enable content” to judgement
A well-made fake invoice will eventually get clicked.
-
Blanket exceptions
Macros on for a whole department because one person needs them.
-
Trusting the defaults
Defaults vary by Office version. Enforce by policy.
Will blocking macros break our spreadsheets?
Not if it’s planned. We find the people and files that rely on macros first, then allow them through Trusted Locations or signing.
Doesn’t Microsoft block internet macros by default now?
For many versions, yes, but it varies and can be overridden. The control is to enforce it by policy and be able to prove it.
Do macros matter if we use Office on the web?
Office on the web doesn’t run VBA macros, but most businesses still use the desktop apps, which is where the risk is.