Unable to permanently grey out macro settings in Office 365 Apps for Business

Question

Hi, I am trying to lock down macros, primarily in Excel. Clients have Business Premium, Windows 11 Business and Microsoft 365 Apps for Business, managed by Intune.

I also have a Windows 2019 1809 RDS server for testing which has Microsoft 365 Apps for Enterprise.

The settings I am using are:

1. Computer Config => Admin Templates => Microsoft Office 2016 (Machine) => Security Settings => Disable VBA for Office Applications = Enabled
2. User Config => Admin Templates => Microsoft Office 2016 => Security Settings => Disable VBA for Office Applications = Enabled.
3. User Config => Admin Templates => Microsoft Excel 2016 => Excel Options => Security => Trust Center => Macro Notification Settings = Enabled with "Disable VBA Macros without notification"

On the 2019 server, this has the desired effect, with the Macro settings greyed out in Excel Trust Center.

On the Windows 11 workstations, the settings are applied but are not greyed out, so the user can enable them.

If I make a reg file with the following in it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\16.0\Common]

"vbaoff"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\16.0\Common]

"vbaoff"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\office\16.0\excel\security]

"vbawarnings"=dword:00000004

"xl4macrowarningfollowvba"=dword:00000000

"vbadigsigtrustedpublishers"=dword:00000000

"vbarequirelmtrustedpublisher"=dword:00000000

"vbarequiredigsigwithcodesigningeku"=dword:00000000

...sometimes after running it, the settings are greyed out successfully, but this does not stick. If I exit Excel and load it again, the options are no longer greyed out, even though none of the reg entries have changed.

It seems like it's because of the Business version not Enterprise, but I don't understand why this would not be configurable in the Business version.

Has anyone been successful with disabling macros on business versions? I'd even be happy just hiding the Trust Center completely, but that doesn't seem possible either. Maybe it's a bug somewhere in the versions I am using.

Appreciate any comments!

Answer 1

Hi @Simon Burbery

From an Office, non-Intune perspective, I want to say it seems that we are unable to achieve your requirements.

If you have Microsoft 365 Apps for Business Premium, Group Policy support is limited to policies for web apps and privacy policies for client apps. Cloud Policy support is limited to policies for web apps.

For more, please refer to the table: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-applications-service-description/office-applications-service-description#:%7E:text=Group%20Policy%20support6:~:text=Yes16-,Group%20Policy%20support6,Yes,-Tap%20to%20find.

And the link: Use policies to manage how Office handles macros.

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 2

@Simon Burbery, Thanks for posting in Q&A.

Based on my research, here is a link with detailed information about how to disable macro settings for Office 365 apps via Intune, also you can check if the targeted device applied the policy.

https://www.anoopcnair.com/block-internet-macros-for-office-apps-intune/

Non-official, just for reference.

Hope it will help

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.