---
title: "Essential Eight Office macro settings explained | CCP"
description: "Essential Eight Office macro settings: what Maturity Level 1, 2 and 3 ask for, and how to restrict macros without breaking the spreadsheets finance relies on."
url: "https://ccp.com.au/essential-eight/configure-office-macros/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight Office macro settings

## Macros for the few who need them. Off for everyone else.

This control turns Office macros off for staff who don’t need them and blocks macros in files from the internet. ASD’s current name for it is “restrict Microsoft Office macros”.

At a glance

Control

03 of 08 · Prevent attacks

Stops

Malicious Office documents

Typical tools

Intune or Group Policy, Microsoft Defender

Effort

Low to medium

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What are Office macro settings?

### Where it stops an attack.

1.  The attack An “invoice” attachment asks the reader to click Enable content.
3.  Stopped here Macros in files from the internet are blocked, and staff who don’t need macros have them switched off.
5.  The result The document opens. The malicious code never runs.

## Essential 8 macro settings by maturity level

### What changes at each level.

What changes ML1 ML2 ML3

Who can run macros Only staff with a business need No change Adds: only macros that are sandboxed, in a Trusted Location or signed by a trusted publisher

Macros in files from the internet Blocked No change No change

Macro antivirus scanning On No change No change

Users change macro settings Not allowed No change No change

Win32 API calls from macros Not required Blocked No change

Vetting approved macros Not required Not required Checked before signing. Trusted publishers reviewed yearly

Trusted Locations and signatures Not required Not required Only vetting staff can write to Trusted Locations. Untrusted or older signatures can’t be enabled

Each level includes everything in the one before. A plain-English summary, not the requirement text. [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

[Check where you are with the free self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## How to restrict Office macros

### Protection first, disruption last.

1.  01

    #### Find who uses macros

    Usually a few finance or operations staff. Everyone else has macros off.

2.  02

    #### Block internet macros for everyone

    Files downloaded from the internet can’t run macros, even for approved users.

3.  03

    #### Lock the settings

    Set centrally through Intune or Group Policy, so users can’t switch them back.

4.  04

    #### Sign or relocate approved macros

    Business-critical macros move to Trusted Locations or get signed, ready for Maturity Level 3.

[Related service: Microsoft 365 and cloud](https://ccp.com.au/services/microsoft-365/)

## Common macro settings mistakes

### Where rollouts go wrong.

-   #### Leaving “Enable content” to judgement

    A well-made fake invoice will eventually get clicked.

-   #### Blanket exceptions

    Macros on for a whole department because one person needs them.

-   #### Trusting the defaults

    Defaults vary by Office version. Enforce by policy.

## Office macro questions

### What clients ask before we start.

### Will blocking macros break our spreadsheets?

Not if it’s planned. We find the people and files that rely on macros first, then allow them through Trusted Locations or signing.

### Doesn’t Microsoft block internet macros by default now?

For many versions, yes, but it varies and can be overridden. The control is to enforce it by policy and be able to prove it.

### Do macros matter if we use Office on the web?

Office on the web doesn’t run VBA macros, but most businesses still use the desktop apps, which is where the risk is.