Essential Eight Control 3: Microsoft Office Macro Settings

Why Microsoft Office macro security is critical for Australian organisations

Malicious Office documents remain a practical initial-access risk because macros can execute code in a user's context. Australian organisations should therefore treat macro policy as an enforced endpoint control rather than relying on users to recognise a malicious document.

ACSC Essential Eight Control 3 — "Configure Microsoft Office Macro Settings" — directly addresses this risk. The baseline disables macros for users without a demonstrated business need and adds internet-origin blocking, antivirus scanning and locked security settings. Higher maturity levels add Win32 API restrictions and stronger trust controls.

This guide covers the specific technical configuration steps, Group Policy and Intune settings, VBA signing requirements and evidence collection for each maturity level, aligned to the current ACSC Essential Eight Maturity Model (Australian Cyber Security Centre — Essential Eight maturity model, accessed 3 November 2026).

Where this fits: macro configuration is one of eight Essential Eight controls. The pillar guide Essential Eight Maturity Level 2 — the 2026 evidence pack walks every control at ML2 and the order to close them. To see whether macros are your current gating control, run the free Essential Eight Maturity Assessment.

1. What Control 3 requires at each maturity level

The ACSC Essential Eight Maturity Model defines three progressive levels for macro configuration. Each level builds on the previous and tightens the enforcement posture.

Maturity Level 1 — Disable macros for users without a business need:

• Microsoft Office macros are disabled for users without a demonstrated business requirement (ISM-1671)
• Macros in files originating from the internet are blocked (ISM-1488)
• Microsoft Office macro antivirus scanning is enabled (ISM-1672)
• Users cannot change Microsoft Office macro security settings (ISM-1489)

Maturity Level 2 — Block Win32 API calls:

• All Maturity Level 1 controls continue to apply
• Microsoft Office macros are blocked from making Win32 API calls (ISM-1673)

Maturity Level 3 — Restrict and protect trusted macro sources:

• Only macros running in a sandbox, from a Trusted Location or signed by a trusted publisher may execute (ISM-1674)
• Macros are checked for malicious code before signing or placement in Trusted Locations (ISM-1890)
• Only the authorised privileged users who perform that checking can modify Trusted Locations (ISM-1487)
• Macros signed by an untrusted publisher cannot be enabled through the Message Bar or Backstage View (ISM-1675)
• Macros using signatures other than V3 signatures cannot be enabled through those interfaces (ISM-1891)

Assessment evidence should demonstrate both the configured policy and its effective application across the endpoints in scope. The evidence set should match the current Assessment Process Guide and the organisation's target maturity level.

2. Disabling macros via Group Policy (on-premises and hybrid)

For organisations using Active Directory with domain-joined Windows endpoints, Group Policy is a common mechanism for enforcing macro settings. Microsoft publishes Office ADMX templates that expose the necessary policy settings. ISM-1672 requires Microsoft Office macro antivirus scanning; it does not prescribe Group Policy as the enforcement mechanism.

Download the latest Microsoft 365 Apps Group Policy ADMX templates from the Microsoft Download Centre and import them into your Central Store before proceeding.

Example 1: Disabling macros and blocking internet-origin macros via Group Policy

# PowerShell: Export Group Policy Result to confirm macro policy application
# Run on a target endpoint as administrator

$OutputPath = "C:\AuditEvidence\GPResult-MacroPolicy-$(Get-Date -Format 'yyyyMMdd').html"

gpresult /H $OutputPath /F

Write-Host "GPResult saved to: $OutputPath"

# Verify the specific Office macro registry keys are applied
$OfficeVersions = @('16.0')  # Microsoft 365 Apps / Office 2019/2021

foreach ($Ver in $OfficeVersions) {
    $Apps = @('Word', 'Excel', 'PowerPoint', 'Access')
    foreach ($App in $Apps) {
        $RegPath = "HKCU:\Software\Policies\Microsoft\Office\$Ver\$App\Security"
        if (Test-Path $RegPath) {
            $MacroSetting = Get-ItemProperty -Path $RegPath -Name 'VBAWarnings' -ErrorAction SilentlyContinue
            $BlockInternet = Get-ItemProperty -Path $RegPath -Name 'blockcontentexecutionfrominternet' -ErrorAction SilentlyContinue
            Write-Host "$App VBAWarnings: $($MacroSetting.VBAWarnings) | BlockInternet: $($BlockInternet.blockcontentexecutionfrominternet)"
        } else {
            Write-Host "$App - Policy path not found (policy may not be applied)"
        }
    }
}

The key Group Policy settings to configure under User Configuration > Administrative Templates > Microsoft [Application] [Version] > Application Settings > Security > Trust Center are:

• VBA Macro Notification Settings — Disable macros for users without an approved business need; use signed-macro or Trusted Location policies where these form part of the Level 3 design
• Block macros from running in Office files from the Internet — Set to Enabled for all levels
• Trust access to the VBA project object model — Set to Disabled for all non-developer users

3. Configuring macro policies via Microsoft Intune (cloud and hybrid)

For Microsoft 365 environments or organisations with non-domain-joined endpoints, Microsoft Intune Configuration Profiles can deliver equivalent policy coverage. Validate policy precedence and effective settings across every management path in use.

Microsoft's Cloud Policy Service can apply user-scoped Microsoft 365 Apps settings to signed-in users. Organisations should test policy precedence and effective settings across their actual Group Policy, Intune and Cloud Policy configuration before selecting it as the primary enforcement mechanism.

Intune Configuration Profile — Settings Catalogue path

Navigate to: Intune Admin Centre > Devices > Configuration > Create > Settings Catalogue

Search for Microsoft Word 2016 (or the relevant application) and configure:

Apply the profile to an Entra ID (Azure AD) security group containing all endpoints. Export the Intune device compliance report after 48 hours to confirm policy application across the fleet before collecting it as audit evidence.

4. VBA digital signing and trusted publisher allow-listing

At Maturity Level 3, a trusted publisher is one of three permitted execution paths, alongside a sandbox or Trusted Location. Organisations choosing the signing path must establish a code-signing and malicious-code review process before enabling the "Disable all macros except digitally signed" policy, or existing unsigned macros will be blocked.

Setting up a trusted publisher certificate

1. Obtain a code signing certificate from your internal PKI (Active Directory Certificate Services) or a commercial CA (DigiCert, Sectigo)
2. Sign all internal VBA projects using the certificate before deploying the new policy
3. Distribute the signing certificate to all endpoints via Group Policy: Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Trusted Publishers
4. Verify the certificate appears in the Office Trust Centre: File > Options > Trust Centre > Trust Centre Settings > Trusted Publishers

ISM-1673 requires Office macros to be blocked from making Win32 API calls. For a Level 3 trusted-publisher design, maintain a current certificate inventory and verify publisher trust and signature format as part of the organisation's documented review process.

Signing a VBA project with PowerShell

# Sign a VBA-enabled Office document macro project
# Requires the Signtool.exe (Windows SDK) or Office VBA IDE certificate binding

# Step 1: Locate the code signing certificate in the local store
$CodeSignCert = Get-ChildItem -Path Cert:\CurrentUser\My |
    Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains 'Code Signing' } |
    Select-Object -First 1

if ($null -eq $CodeSignCert) {
    Write-Error "No code signing certificate found. Install a valid certificate before proceeding."
    exit 1
}

Write-Host "Using certificate: $($CodeSignCert.Subject) | Thumbprint: $($CodeSignCert.Thumbprint)"

# Step 2: Use the Office VBA IDE to apply the certificate to the VBA project
# (Automated signing of Office VBA projects requires the Office COM interop)
# Reference: https://learn.microsoft.com/office/vba/api/office.signatureset

# Step 3: Validate the existing signatures on a document
$FilePath = "C:\BusinessMacros\QuarterlyReport.xlsm"
$AuthSig = Get-AuthenticodeSignature -FilePath $FilePath -ErrorAction SilentlyContinue
if ($AuthSig) {
    Write-Host "Signature Status: $($AuthSig.Status) | Signer: $($AuthSig.SignerCertificate.Subject)"
} else {
    Write-Warning "File does not carry an Authenticode signature - VBA signing must be applied via Office IDE"
}

Note: VBA project signing within an Office document is applied through the Office VBA IDE (Developer tab > Macros > Digital Signature) or programmatically via the Office COM API. PowerShell Authenticode signing applies to Office files at the container level but does not replace in-IDE VBA project signing for the Trust Centre policy.

5. Monitoring macro execution as defence in depth

Monitoring macro execution supports detection, investigation and assessment evidence. The current macro controls do not make central SIEM collection a specific Maturity Level 3 requirement, but Microsoft 365 Defender Advanced Hunting and Microsoft Sentinel can provide useful telemetry.

Microsoft Defender for Endpoint telemetry and Attack Surface Reduction rules can provide additional visibility into macro execution attempts, including blocked activity. Validate the available events and retention in the organisation's licensed configuration before treating that telemetry as assessment evidence.

Key monitoring configurations

Attack Surface Reduction (ASR) rules relevant to macros:

• d4f940ab-401b-4efc-aadc-ad5f3c50688a — Block Office applications from creating child processes
• 3b576869-a4ec-4529-8536-b80a7769e899 — Block Office applications from creating executable content
• 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b — Block Win32 API calls from Office macros

Use the Win32 API block rule where required by the target maturity level. Test other ASR rules in Audit mode and move them to Block mode through the organisation's change process after reviewing business impact.

# Enable ASR rules relevant to macro execution in Audit mode (pre-production)
# Run via Intune PowerShell script or directly on endpoint as administrator

$MacroASRRules = @(
    'd4f940ab-401b-4efc-aadc-ad5f3c50688a',  # Block child processes from Office
    '3b576869-a4ec-4529-8536-b80a7769e899',  # Block executable content from Office
    '92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b'   # Block Win32 API calls from Office macros
)

foreach ($RuleId in $MacroASRRules) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $RuleId `
                     -AttackSurfaceReductionRules_Actions AuditMode
    Write-Host "ASR rule $RuleId set to AuditMode"
}

# After baseline period: switch to Block mode
# foreach ($RuleId in $MacroASRRules) {
#     Add-MpPreference -AttackSurfaceReductionRules_Ids $RuleId `
#                      -AttackSurfaceReductionRules_Actions Enabled
# }

6. Common pitfalls and how to avoid them

Australian security teams deploying Control 3 frequently encounter the following issues:

• Legacy business-critical macros unsigned before policy enforcement: Conduct a macro inventory using the Microsoft 365 Apps readiness toolkit before enabling the signed-only policy. This avoids unexpected outages when the policy blocks unsigned legacy code.
• Microsoft 365 Apps cloud policy not applied to all user accounts: Ensure the Cloud Policy profile is assigned to an Entra ID group containing all licensed users, not just the IT pilot group. Use the Cloud Policy health report to verify coverage.
• Trusted publisher certificates expiring unnoticed: Set a calendar alert 60 days before certificate expiry. An expired signing certificate causes macros to fail even on previously trusted documents, generating helpdesk calls and potentially causing assessors to find non-compliant endpoints.
• Group Policy and Intune policy conflict: When both GPO and Intune deliver the same setting, GPO typically wins on domain-joined devices unless the MDM enrollment is configured to prefer MDM policy. Test the effective policy with GPResult and Intune compliance reports on the same endpoint.

7. Before and after: macro security posture

Before configuring Control 3:

• Macros enabled by default in all Office applications
• Users able to click "Enable Content" on any emailed document
• No visibility into which macros execute across the fleet
• Commodity macro malware delivered via phishing emails executes without restriction

After configuring Control 3 (Level 2):

• Macros disabled by default organisation-wide; only signed macros from approved publishers execute
• Users cannot self-enable macros; the enable button is removed by policy
• Macro execution blocked for all internet-origin files regardless of signature
• IT maintains a trusted publisher certificate register reviewed annually

8. Evidence collection for ACSC assessments

The following evidence categories can help an assessor verify both policy and effective application. Confirm the final evidence request against the current Assessment Process Guide and assessment scope.

Policy configuration evidence:

• GPResult HTML report (or Intune Configuration Profile export) showing macro settings applied across the endpoint fleet
• Screenshot of the Office Trust Centre reflecting the enforced settings on a sample endpoint
• Group Policy or Intune policy document showing the effective settings, scope, and date of last review

Trusted publisher evidence (where used at Level 3):

• Trusted Publisher certificate list exported from the Certificates MMC snap-in or Intune
• Code signing certificate inventory showing certificate owner, issuer, expiry date, and associated macro projects

Monitoring and exception evidence:

• Sample SIEM query and output showing macro execution events collected over the assessment period
• Macro exception register listing any approved deviations with business justification, approver, and review date
• ASR rule status report from Microsoft Defender for Endpoint confirming Block mode on all endpoints

Collect this evidence throughout operation so the assessor can verify the control over time rather than from a single configuration screenshot.

9. Compliance alignment: ISM and PSPF

Control 3 aligns directly with several controls in the Australian Government Information Security Manual (ISM) published by the ACSC:

• ISM-1671: Microsoft Office macros are disabled for users without a demonstrated business requirement
• ISM-1488: Macros in files originating from the internet are blocked
• ISM-1672: Microsoft Office macro antivirus scanning is enabled
• ISM-1489: Users cannot change Microsoft Office macro security settings
• ISM-1673: Microsoft Office macros are blocked from making Win32 API calls
• ISM-1674, ISM-1890, ISM-1487, ISM-1675 and ISM-1891: Level 3 restricts execution sources and protects the code-review, Trusted Location and signing process

The Protective Security Policy Framework (PSPF) directs non-corporate Commonwealth entities to implement the Essential Eight, and the specific maturity level expected is set by the PSPF and related policy rather than fixed by data classification alone. Agencies should confirm the current target maturity for their environment against the latest PSPF and ASD guidance. As a general principle, the Australian Signals Directorate recommends progressing beyond a baseline implementation as soon as practicable given the ongoing threat environment.

Organisations seeking alignment with the Essential Eight Assessment should size the macro work from their endpoint coverage, business macro inventory, policy tooling and Level 3 code-review requirements.

10. Internal links and next steps

For a broader view of the Essential Eight implementation programme, the ACSC Essential Eight Complete Implementation Guide provides a roadmap covering all eight controls with priority sequencing. Many organisations plan Control 3 alongside Control 2 (Patch Applications) and Control 1 (Application Control) because the endpoint policy, application inventory and evidence work can be coordinated.

Call to action

Configuring Microsoft Office macro settings reduces a common malware execution path. Inventory business macros and test the policy scope before enforcement so the security control does not disrupt approved workflows.

Next steps: Conduct a macro inventory using the Microsoft 365 Apps readiness toolkit, establish your trusted publisher certificate process, deploy the Group Policy or Intune settings in audit mode, review the baseline for two weeks, then move to enforcement. Book an Essential Eight Assessment to get an independent review of your current maturity and a prioritised remediation roadmap tailored to your environment.

Sources referenced in this article: ACSC Essential Eight Maturity Model, ASD/ACSC Essential Eight Assessment Process Guide, Australian Government Information Security Manual (ISM), ACSC Annual Cyber Threat Report 2023-24, Microsoft 365 Apps admin centre / Cloud Policy Service documentation, Microsoft Threat Intelligence team, Protective Security Policy Framework (PSPF).