ASD.ISM-1488 - Microsoft Office macros in files originating from the internet are blocked.
Overview
Microsoft Office macros in files originating from the internet are blocked (ISM-1488, Essential Eight Maturity Level One).
A macro in an email attachment or a downloaded document is still the most common way malicious code reaches a workstation. Office marks files from the internet with the Mark of the Web and, since 2022, blocks their macros by default; but a user can still unblock a file from its properties, and a Trust Center change can turn the default off. This policy makes the block a tenant decision that the user cannot undo, which is why it is rated as a second layer behind the Office default. This check reads the Intune settings catalog policies for Windows and looks for Block macros from running in Office files from the Internet set to Enabled for Word, Excel and PowerPoint in an assigned policy. Access, Visio, Project and Publisher are reported when configured. Settings deployed by Group Policy or the Office cloud policy service are not read.
Remediation action
- In Microsoft Intune admin center, go to Devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog.
- Add, under Microsoft Word 2016 > Word Options > Security > Trust Center, the setting Block macros from running in Office files from the Internet and set it to Enabled. Repeat for Microsoft Excel 2016, Microsoft PowerPoint 2016, and for Access, Visio, Project and Publisher where they are installed.
- Assign the policy to all users.
Related links
- Essential Eight maturity model
- ASD Microsoft Office macro security
- Macros from the internet are blocked by default in Office
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1488 |
| Severity | Medium |
| Suite | ASD |
| Product | Intune |
| Feature | Device configuration |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File, T1566.001 Spearphishing Attachment |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1488 |
| Benchmark level | ML1 |
| Essential Eight strategy | Restrict Microsoft Office macros |
| Supports controls | essential-eight:ISM-1488, nist-800-53-r5:CM-7, ism:ISM-1488 |
| PowerShell test | Test-MtAsdOfficeMacrosFromInternetBlocked |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/asd/intune/Test.ASD.ISM-1488.ps1 - Documentation:
tests/asd/intune/Test.ASD.ISM-1488.md