We’re currently having an internal discussion around the use of Office macros and add-ins, specifically from a security perspective. At the moment, users are allowed to run macros or add-ins if they accept the warning prompt (for example, in Excel).
The main question we’re asking is: how much of a real security risk do these actually pose in our environment? One of the challenges is that we don’t have clear visibility into how many macros and various add-ins are in use across the organization, or what they are doing.
There is a proposal on the table to tighten controls by disabling all macros and add-ins by default, and only allowing digitally signed ones to run. In practice, this would mean a large number of existing macros and add-ins would be blocked. The idea is to then create more permissive policies for specific user groups who require them for their work. However, this approach will introduce administrative overhead in terms of managing these exceptions and maintaining signed versions of internally developed tools.
We’re also planning to enable Microsoft Defender Attack Surface Reduction (ASR) rules, which offer a range of hardening measures for Office applications. Activating these could help reduce the risk posed by malicious macros by limiting what those macros can actually do—blocking common behaviors used by malware, for instance.
So the key questions we’re considering:
- How significant is the actual risk of allowing user-enabled macros and add-ins?
- Does enabling ASR rules effectively reduce the danger to an acceptable level?
- Is the added security worth the operational impact and added complexity?
Curious to hear your thoughts—how are you handling this in your environments?