Restrict Microsoft Office macros

This strategy restricts who can run Microsoft Office macros and which macros may execute. In November 2023, ASD removed macro execution-event logging and added stronger signing requirements at Level Three.

What is required, and where

Maturity Level One requires:

• macros disabled for users without a demonstrated business requirement
• macros in files originating from the internet blocked
• macro antivirus scanning enabled
• macro security settings unable to be changed by users

Maturity Level Two adds a requirement to block macros from making Win32 application programming interface (API) calls.

Maturity Level Three adds these controls:

• only macros from a sandboxed environment, a Trusted Location, or digitally signed by a trusted publisher may execute
• macros are checked for malicious code before being signed or placed in a Trusted Location
• only privileged users responsible for that checking may write to Trusted Locations
• macros signed by an untrusted publisher cannot be enabled through the Message Bar or Backstage View
• V3 signatures are enforced
• the trusted publishers list is validated at least annually

See the requirements matrix for every control at each maturity level.

The requirement that was removed

This is the update's only explicit removal of an Essential Eight requirement. From the Essential Eight maturity model changes:

Due to a lack of native support for macro execution event logging in Microsoft Windows… and advice from incident responders and threat hunters that such events provide limited benefit, the requirement to collect and analyse these events for signs of compromise has been removed.

If a checklist lists macro execution-event logging as an Essential Eight requirement, it is using a pre-November 2023 version of the model.

Note this removal is specific to macro execution events. The broader centralised logging requirement introduced at Maturity Level Two across the framework still applies.

ASD's ranking of macro approaches

ASD's Restricting Microsoft Office macros publication ranks six approaches by security benefit:

The framework's Level One requirement (disabled for anyone without a demonstrated business need) is effectively "all macros disabled, with exceptions you have to justify".

Commonwealth implementation

Restrict Microsoft Office macros is the best-performing of the eight across Commonwealth entities. ASD's Commonwealth Cyber Security Posture in 2025 has it reaching 81% at Maturity Level Two or above in 2024–25, up from 68%.

Microsoft now blocks macros from the internet by default in supported Office versions. That default helps with one Level One control, but it does not satisfy the strategy by itself. Organisations must still disable macros for users without a demonstrated business requirement, enable antivirus scanning and prevent users from changing the security settings.

The result cannot establish an organisation's overall maturity on its own. Under the weakest-link rule, the lowest of the eight strategy levels determines the overall level.

Macros are still a delivery mechanism

Office files can carry embedded Visual Basic for Applications code, which attackers use to deliver malware. ASD split macro controls out of user application hardening as a separate strategy in the 2017 Strategies to Mitigate Cyber Security Incidents, "to reflect the prevalence of malicious Microsoft Office macros".

Default blocking does not remove the need for Level Three controls. Those requirements address macros placed in locations or signed by publishers the environment trusts: the macro is checked before signing, write access to Trusted Locations is restricted, and signatures are validated.