Word, Excel and Outlook are on every desk, which makes them one of the most common ways attackers get code onto a device. A malicious attachment with a macro, a rogue add-in or a file opened outside Protected View can be all it takes. This guide explains how to block Office macros with Intune, lock down add-ins and keep Protected View doing its job, using settings Microsoft already provides and without stopping the finance team’s legitimate spreadsheets.
Start with what Microsoft already changed
Microsoft changed the default behaviour of Office so that VBA macros in files from the internet are blocked. When a user opens such a file, they see a security banner instead of an “Enable content” button. Windows marks downloaded files and email attachments with Mark of the Web, and Office uses that to decide.
That default is a big improvement, but it is not the whole answer:
Users can still unblock a file by removing Mark of the Web in its properties.
Files opened from some network locations or by IP address can behave differently.
Macros in files that do not carry Mark of the Web are not covered.
Defaults can change, and a default is not evidence of a control when an auditor asks.
Setting the policy explicitly gives you a control you own and can report on.
Check your Office edition first
This is the detail that catches most small businesses. Microsoft states that the policies for managing how Office handles macros are only available with Microsoft 365 Apps for enterprise. They are not available for Microsoft 365 Apps for business, which is the edition included in Business Standard and Business Premium.
If you are on Business Premium, you still have strong options. Attack surface reduction rules in Microsoft Defender work regardless of Office edition, and they block the dangerous behaviour macros rely on. If you are on Microsoft 365 E3 or E5, you get both the Office policies and the ASR rules.
Layer 1: macro policies through the settings catalog
For Microsoft 365 Apps for enterprise, configure these in Intune using a settings catalog profile. In the Intune admin center, go to Devices > Configuration > Create > New policy, choose Windows and Settings catalog, and search for each setting by name. Office policies appear per app (Word, Excel, PowerPoint, Access, Visio, Project, Publisher) under each app’s Trust Center settings.
Setting
Recommended value
Notes
Block macros from running in Office files from the Internet
Enabled
Microsoft recommends this as part of the security baseline for Microsoft 365 Apps for enterprise. Set it for each app.
VBA Macro Notification Settings
Disable all except digitally signed macros
Lets signed, approved macros run. Pair with a trusted publisher certificate for in-house macros.
Allow Trusted Locations on the network
Disabled
Network trusted locations are an easy bypass if a share is writable.
Disable all trusted locations
Consider for high-risk users
Stronger, but test with line-of-business templates first.
For teams that genuinely depend on macros, usually finance, payroll or operations, do not exempt the whole department from the internet macro block. Sign the internal macros with a code signing certificate and deploy it as a trusted publisher. That keeps the workbooks working without letting an emailed macro run.
Layer 2: attack surface reduction rules
ASR rules sit in Microsoft Defender Antivirus and block the behaviours malicious documents use, even when a macro does run. Configure them in Endpoint security > Attack surface reduction > Create policy, platform Windows, profile Attack Surface Reduction Rules.
The Office-related rules I deploy in nearly every tenant:
Block all Office applications from creating child processes
Block Office applications from creating executable content
Block Office applications from injecting code into other processes
Block Win32 API calls from Office macros
Block Office communication application from creating child processes (covers Outlook)
Block executable content from email client and webmail
Microsoft’s guidance notes that most organizations do not need Win32 API calls from VBA macros, even if they use macros in other ways. Run new rules in Audit mode for two to four weeks, check the results in the Defender portal, add narrow exclusions where a real business app needs them, then switch to Block.
Layer 3: add-ins
Add-ins are code that runs inside Office, and they are often forgotten. There are two kinds to think about.
COM and VSTO add-ins (desktop)
These are installed on the device. In the same settings catalog area, look for the per-app settings that require application add-ins to be signed by a trusted publisher and that disable the Trust Bar notification for unsigned add-ins, so unsigned add-ins are blocked silently instead of prompting the user. Deploy approved add-ins through Intune as Win32 apps, so you know exactly what is installed.
Office web add-ins (Outlook, Word, Excel)
These come from the Office Store or are deployed centrally. Review which add-ins are deployed through Integrated Apps in the Microsoft 365 admin center, and decide whether users can install add-ins themselves. In the tenants I review, the most common gap is user-installed Outlook add-ins with mailbox read permissions that nobody approved. Turn off user self-install unless you have a reason to allow it, and grant approved add-ins centrally.
Layer 4: keep Protected View on
Protected View opens risky files read-only in a sandbox. Users find it mildly annoying, which is why it sometimes gets switched off by a well-meaning admin or a quick fix from the helpdesk.
Make sure these per-app settings are not enabled, so Protected View stays active:
Do not open files from the Internet zone in Protected View
Do not open files in unsafe locations in Protected View
Turn off Protected View for attachments opened from Outlook
Leaving them as Not configured keeps the secure default, but setting them explicitly to Disabled in policy stops local changes overriding it. If you have Microsoft 365 E5 or E5 Security, Safe Documents adds a cloud scan before a file can leave Protected View.
Rollout checklist
Confirm your Office edition (Apps for enterprise or Apps for business).
Inventory macro-dependent workbooks and templates with business owners.
Sign internal macros and deploy the trusted publisher certificate.
Deploy ASR rules in Audit mode and review for two to four weeks.
Deploy macro, add-in and Protected View settings to a pilot group.
Move ASR rules to Block and widen policy assignment.
Tell staff what the new banner means and how to request an exception.
Frequently asked questions
Can I block Office macros with Intune on Business Premium?
The Office macro policies are only available for Microsoft 365 Apps for enterprise, not the Apps for business edition included in Business Premium. You can still use Defender attack surface reduction rules, deployed through Intune, to block what malicious macros try to do.
Will blocking internet macros break our finance spreadsheets?
Usually not, because internal files stored in SharePoint or OneDrive do not carry Mark of the Web. Where macros come from outside or need to run anywhere, sign them with a trusted publisher certificate rather than exempting the whole team.
Should ASR rules start in Block or Audit mode?
Start in Audit mode for most rules. Microsoft suggests standard protection rules can often go straight to Block or Warn, but Office-related rules can affect legitimate tools, so review audit events first.
Not sure whether your Office apps are hardened or just running on defaults? Request a free Microsoft 365 security assessment and we will review macro, add-in and ASR settings across your devices.
Word, Excel and Outlook are on every desk, which makes them one of the most common ways attackers get code onto a device. A malicious attachment with a macro, a rogue add-in or a file opened outside Protected View can be all it takes. This guide explains how to block Office macros with Intune, lock down add-ins and keep Protected View doing its job, using settings Microsoft already provides and without stopping the finance team’s legitimate spreadsheets.
Start with what Microsoft already changed
Microsoft changed the default behaviour of Office so that VBA macros in files from the internet are blocked. When a user opens such a file, they see a security banner instead of an “Enable content” button. Windows marks downloaded files and email attachments with Mark of the Web, and Office uses that to decide.
That default is a big improvement, but it is not the whole answer:
Setting the policy explicitly gives you a control you own and can report on.
Check your Office edition first
This is the detail that catches most small businesses. Microsoft states that the policies for managing how Office handles macros are only available with Microsoft 365 Apps for enterprise. They are not available for Microsoft 365 Apps for business, which is the edition included in Business Standard and Business Premium.
If you are on Business Premium, you still have strong options. Attack surface reduction rules in Microsoft Defender work regardless of Office edition, and they block the dangerous behaviour macros rely on. If you are on Microsoft 365 E3 or E5, you get both the Office policies and the ASR rules.
Layer 1: macro policies through the settings catalog
For Microsoft 365 Apps for enterprise, configure these in Intune using a settings catalog profile. In the Intune admin center, go to
Devices > Configuration > Create > New policy, choose Windows and Settings catalog, and search for each setting by name. Office policies appear per app (Word, Excel, PowerPoint, Access, Visio, Project, Publisher) under each app’s Trust Center settings.For teams that genuinely depend on macros, usually finance, payroll or operations, do not exempt the whole department from the internet macro block. Sign the internal macros with a code signing certificate and deploy it as a trusted publisher. That keeps the workbooks working without letting an emailed macro run.
Layer 2: attack surface reduction rules
ASR rules sit in Microsoft Defender Antivirus and block the behaviours malicious documents use, even when a macro does run. Configure them in
Endpoint security > Attack surface reduction > Create policy, platform Windows, profile Attack Surface Reduction Rules.The Office-related rules I deploy in nearly every tenant:
Microsoft’s guidance notes that most organizations do not need Win32 API calls from VBA macros, even if they use macros in other ways. Run new rules in Audit mode for two to four weeks, check the results in the Defender portal, add narrow exclusions where a real business app needs them, then switch to Block.
Layer 3: add-ins
Add-ins are code that runs inside Office, and they are often forgotten. There are two kinds to think about.
COM and VSTO add-ins (desktop)
These are installed on the device. In the same settings catalog area, look for the per-app settings that require application add-ins to be signed by a trusted publisher and that disable the Trust Bar notification for unsigned add-ins, so unsigned add-ins are blocked silently instead of prompting the user. Deploy approved add-ins through Intune as Win32 apps, so you know exactly what is installed.
Office web add-ins (Outlook, Word, Excel)
These come from the Office Store or are deployed centrally. Review which add-ins are deployed through Integrated Apps in the Microsoft 365 admin center, and decide whether users can install add-ins themselves. In the tenants I review, the most common gap is user-installed Outlook add-ins with mailbox read permissions that nobody approved. Turn off user self-install unless you have a reason to allow it, and grant approved add-ins centrally.
Layer 4: keep Protected View on
Protected View opens risky files read-only in a sandbox. Users find it mildly annoying, which is why it sometimes gets switched off by a well-meaning admin or a quick fix from the helpdesk.
Make sure these per-app settings are not enabled, so Protected View stays active:
Leaving them as Not configured keeps the secure default, but setting them explicitly to Disabled in policy stops local changes overriding it. If you have Microsoft 365 E5 or E5 Security, Safe Documents adds a cloud scan before a file can leave Protected View.
Rollout checklist
Frequently asked questions
Can I block Office macros with Intune on Business Premium?
The Office macro policies are only available for Microsoft 365 Apps for enterprise, not the Apps for business edition included in Business Premium. You can still use Defender attack surface reduction rules, deployed through Intune, to block what malicious macros try to do.
Will blocking internet macros break our finance spreadsheets?
Usually not, because internal files stored in SharePoint or OneDrive do not carry Mark of the Web. Where macros come from outside or need to run anywhere, sign them with a trusted publisher certificate rather than exempting the whole team.
Should ASR rules start in Block or Audit mode?
Start in Audit mode for most rules. Microsoft suggests standard protection rules can often go straight to Block or Warn, but Office-related rules can affect legitimate tools, so review audit events first.
Microsoft’s article on macros from the internet being blocked by default explains how Mark of the Web and the policies interact. Our endpoint security baseline includes these Office and ASR settings, and our Defender for Office 365 service covers the email side. For staff awareness of macro-based phishing, see our security awareness training.
Not sure whether your Office apps are hardened or just running on defaults? Request a free Microsoft 365 security assessment and we will review macro, add-in and ASR settings across your devices.