Help with Disabling Macro Settings in the Trust Center via Intune Config Profiles

Question

Hi, I'm running into an issue with Intune configuration profiles. Our business has a security requirement to disable the option to change any settings within the Macro Settings tab in the Trust Center for all relevant Office applications.

From what I've gathered, it seems that applying the Macro Notification Settings = Enabled with the option “Disable VBA Macros without notification” should accomplish this by setting the preferred setting and greying out the options. However, despite applying this configuration, the macro settings are not getting greyed out as expected.

Our Environment is entirely cloud based in terms of Microsoft (No On-Prem AD, all Entra/Intune) and clients have Windows 11 Business Premium

What I've Tried:

• Applying the setting to both user and device scope separately at different times: The issue persists.
• Registry modification: I attempted directly editing the registry, which worked for a short period (less than a day), but the setting reverted and the options became available again. This solution has since been unable to be reproduced.
• Other Macro Policies: This isn’t the only macro-related policy we’ve set. There is a comprehensive set of policies for disabling all macros across our environment, but the issue persists even with these in place. As far as I can tell, the only relevant one to this particular requirement is the Macro Notification Settings = Enabled but it is not working as intended.

Specific Configuration for Excel (although issue exists for all apps):

Here are the Excel settings I've configured as part of our policies:

• Excel Options > Security > Trust Center
  • VBA Macro Notification Settings (User): Enabled
    • Disable all without notification
  • Trust access to Visual Basic Project (User): Disabled
  • Turn off trusted documents (User): Enabled
  • Turn off Trusted Documents on the network (User): Enabled
• Excel Options > Security > Trust Center > Trusted Locations
  • Allow Trusted Locations on the network (User): Disabled
  • Disable all trusted locations (User): Enabled

I've also confirmed that the policies apply to all relevant Office apps, as well as the overarching Office configuration.

Has anyone encountered a similar issue or have suggestions on how to effectively grey out or lock these macro settings? Any insights would be greatly appreciated

Answer 1

Dear @LukeMili-1371,

Thank you for posting your question in the Microsoft Q&A forum.

If you have Microsoft 365 Apps for Business Premium, Group Policy support is limited to policies for web apps and privacy policies for client apps. Cloud Policy support is limited to policies for web apps. For more, please refer to the Microsoft Official Documents: Office applications service description

• If devices are running Microsoft 365 Apps for business (the SKU included in Business Premium), several Office policy channels behave differently than Microsoft 365 Apps for enterprise.
• The Cloud Policy service (config.office.com) roams with the user and overrides Trust Center, but on Apps for business, macro policies aren’t enforced (privacy only). If you need cloud policy to lock macro settings, you’ll want Microsoft 365 Apps for enterprise licenses.
• For reference: Overview of Cloud Policy service for Microsoft 365

And for more information about using policies to manage how Office handles macros, please refer to the link: Use policies to manage how Office handles macros.

Therefore, in the Microsoft Intune admin center, you can use either the Settings catalog (preview) or Administrative Templates to configure and deploy policy settings to your users for devices running Windows 10 or later. It is possible, but there are some important limitations compared to Apps for Enterprise:

To get started, go to Devices > Configuration profiles > Create profile. For Platform, choose Windows 10 and later and then choose the profile type. For reference: Microsoft Intune admin center

For more information, see the following articles:

• Use the settings catalog to configure settings on Windows and macOS devices - preview
• Use Windows 10/11 templates to configure group policy settings in Microsoft Intune

Limitations:

• UI may not grey out in Apps for Business even if macros are blocked.
• Full enforcement (including UI lock) is guaranteed only with Microsoft 365 Apps for Enterprise.
• Avoid mixing old Administrative Templates with Settings Catalog.

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.

Please understand that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution.

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.

I'm looking forward for your reply.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.