What you need to know
- Microsoft has been taking increasingly large steps over the past few months to put a stop to macro-induced security risks in its apps and services.
- Its latest move is to block internet macros by default in five major Office apps: Word, Access, Excel, PowerPoint, and Visio.
- The new default change's rollout will begin in early April 2022 and is, at a date yet to be determined, set to come to versions of Office stretching as far back as Office 2013.
Microsoft's been taking a harder stance against macros in recent times, such as with its crackdown on Excel 4.0 macros. Now, the company's going even further.
Five Office apps will soon see internet macros blocked by default. The apps in question are Word, Visio, Access, Excel, and PowerPoint. Expect the default change rollout to hit Office beginning with version 2203 via an early April 2022 Current Channel (Preview) release. It will come to other channels, including Current Channel, Monthly Enterprise Channel, and Semi-Annual Enterprise Channel, at a later date. The change will also make its way to Office LTSC, Office 2021, Office 2019, Office 2016, and Office 2013, though dates for those rollouts have yet to be provided.
As to why Microsoft is doing this, the short answer is that the change adds an extra layer of security for users. Here's an excerpt from Microsoft's announcement: "For macros in files obtained from the internet, users will no longer be able to enable content with a click of a button. A message bar will appear for users notifying them with a button to learn more. The default is more secure and is expected to keep more users safe including home users and information workers in managed organizations."
The idea is that even with the previous disclaimers Office apps have offered, it was still too easy for someone to enable an internet macro and inadvertently expose their device to malicious payloads. Now, Microsoft is upping the barrier separating internet macros from Office apps to shield users from bad code.
