⚙️🪟🧑💼🔓CP - Microsoft 365 Apps - Macro Signing - Exemption
The escape hatch for the one workbook nobody can sign yet. Prompt instead of block, for named users, with an end date attached.
What this policy is about 🔓
This is the counterpart to ⚙️🪟🧑💼CP - Microsoft 365 Apps - Macro Signing.
The baseline writes Trust Center values into HKCU\Software\Policies\Microsoft\Office\16.0\<app>\security, and those values stay written when a user drops out of the profile's scope. Excluding somebody from the baseline stops future enforcement and changes nothing about the machine they are sitting at. Their macros stay blocked, they raise a second ticket, and somebody spends an afternoon looking for a sync failure that is not there.
This policy writes the values back to a prompting state, and it is assigned to the exception group.
The exemption restores the decision, not a blanket allow. Users get the yellow bar back and can choose to enable content. That is a meaningful step down in protection, which is exactly why it is time-boxed and named rather than handed out on request.
Why this matters 🕵️
Because there is always one workbook. A pricing model built by someone who left in 2019, a VBA-driven export into an accounting package the vendor no longer updates, a macro that generates the payroll file. Signing it is the right answer and signing it takes time: someone has to find the source, get a code-signing certificate, sign it and test it.
Without an exemption path, that gap gets closed by an engineer switching the baseline off for everyone "just until Friday", and Friday has a way of moving. A narrow, documented exemption is how the baseline survives contact with real customers.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Administrative Templates → Microsoft Word 2016 / Excel 2016 / PowerPoint 2016 → Application Settings → Security → Trust Center.
| Setting | Value |
|---|---|
| VBA Macro Notification Settings (Word, Excel, PowerPoint) | Enabled → Disable all with notification |
| Block macros from running in Office files from the Internet | Enabled |
| Prevent Excel from running XLM macros | Enabled |
| Require that application add-ins are signed by Trusted Publisher | Not configured |
| Assignment, include | 🛡️🧑💼👈🔓⚙️Group - Unsigned Macros Allowed users |
| Assignment, exclude | None |
Two rows do not move, and that is deliberate. The internet block and the XLM block stay enabled even here. The exemption exists so that a known local workbook can run, not so that a document from a stranger becomes clickable again. An exemption that reopens the email-attachment path is not an exemption, it is a rollback.
"Disable all with notification", never "Enable all macros". The first restores the user's choice; the second removes the Trust Center from the equation entirely and would run anything, silently. There is no scenario on a managed estate that needs the second.
The user must also be excluded from the baseline. Both profiles would otherwise write conflicting values for the same setting. Exclusion plus inverse, always both.
Caveats ⚠️
This is a step down in protection and should read like one on the ticket. The user is back in the position of deciding, from a yellow bar, whether a document is trustworthy. Name the workbook, name the approver, set a review date, and record what needs to happen for the exemption to end.
Sign the macro instead, wherever you can. A code-signing certificate plus the public certificate deployed to Trusted Publishers turns this from an ongoing exception into a solved problem. In most cases that work is a morning, and it removes a permanent hole from the baseline.
It follows the user, not the device. These are HKCU settings, so an exempted user carries the weakened Trust Center to every machine they sign in to, including shared devices. Keep that in mind for anyone who works across a lot of hardware.
Verify on the machine. Intune reports the assignment applied well before anyone confirms the workbook opens. Check the Trust Center in the application, or the registry value under the relevant app key.
Review quarterly and expect resistance. Nobody ever asks for an exemption to be removed. Diarise it.
👥 Assignment scope
Exception group only. Everyone else stays on the signing baseline.
Entry requires a named user, a named file or application, an approver, and a review date. Group membership is the record; if nobody can explain a member's presence, that member comes out.
🔗 Related
- ⚙️🪟🧑💼CP - Microsoft 365 Apps - Macro Signing: the baseline this carves an exception out of.
- 🛡️🧑💼👈🔓⚙️Group - Unsigned Macros Allowed users: the group both assignments depend on.
- 🧱🪟💻ES - Attack Surface Reduction Rules: what still stands between an exempted user and a bad afternoon.
Exemptions are fine. Permanent exemptions nobody can explain are how baselines quietly become suggestions. 🔓