Macros have long been a major factor in Office security issues, and it appears Microsoft is taking a major step toward addressing the problem.
Macros have been around for years, with Office power users having their own personal collection of macros they swear by. Unfortunately, they are also one of the most targeted attack vectors that bad actors use. Microsoft has taken various steps to try to mitigate the danger, but their latest is one of their most ambitious.
Beginning in Version 2203, Microsoft will block downloaded macros for Access, Excel, PowerPoint, Visio, and Word.
For macros in files obtained from the internet, users will no longer be able to enable content with a click of a button. A message bar will appear for users notifying them with a button to learn more. The default is more secure and is expected to keep more users safe including home users and information workers in managed organizations.
Microsoft has said it will also implement the change for Office LTSC, Office 2021, Office 2019, Office 2016, and Office 2013 at a future date.
Users intent on using downloaded macros will still be able to, but they’ll need to jump through a couple of hoops to do so. Users will be presented with a warning message, including a Learn More button.
The Learn More button goes to an article for end users and information workers that contains information about the security risk of bad actors using macros, safe practices to prevent phishing & malware, and instructions on how to enable these macros.
The change is likely to inconvenience some users, but hopefully the measure will help protect Office users.