ASD.ISM-1672 - Microsoft Office macro antivirus scanning is enabled.
Overview
Microsoft Office macro antivirus scanning is enabled (ISM-1672, Essential Eight Maturity Level One).
A macro that is allowed to run can still be malicious. With macro runtime scanning, Office hands the behaviour of a running macro to the Antimalware Scan Interface (AMSI), where Microsoft Defender Antivirus or another registered antivirus inspects it and stops it. This check reads the Intune settings catalog policies for Windows and looks for Macro Runtime Scan Scope set to Enabled with the scope Enable for all documents, in an assigned policy. ASD's guide to restricting Microsoft Office macros and the ASD Blueprint for Secure Cloud both set all documents. Enable for low trust documents scans only files with the Mark of the Web, whose macros ASD.ISM-1488 already blocks, so it does not count.
Remediation action
- In Microsoft Intune admin center, go to Devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog.
- Add, under Microsoft Office 2016 > Security Settings, the setting Macro Runtime Scan Scope, set it to Enabled and choose Enable for all documents.
- Assign the policy to all users.
Related links
- Essential Eight maturity model
- ASD Microsoft Office macro security
- Antimalware Scan Interface (AMSI)
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1672 |
| Severity | Medium |
| Suite | ASD |
| Product | Intune |
| Feature | Device configuration |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.002 Malicious File |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1672 |
| Benchmark level | ML1 |
| Essential Eight strategy | Restrict Microsoft Office macros |
| Supports controls | essential-eight:ISM-1672, nist-800-53-r5:SI-3, ism:ISM-1672 |
| PowerShell test | Test-MtAsdOfficeMacroAntivirusScanning |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/asd/intune/Test.ASD.ISM-1672.ps1 - Documentation:
tests/asd/intune/Test.ASD.ISM-1672.md