Essential Eight RM-ML1.4 Prevent users from changing Microsoft Office macro security settings
What it says
Microsoft Office macro security settings cannot be changed by users.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure users cannot alter macro settings in Microsoft Office applications.
This control is about stopping people from changing the security settings for macros in Microsoft Office programs like Word and Excel. This is important because if these settings are altered, harmful macros could sneak in and cause chaos in your files, leading to data loss or theft.
Free. Save your status, tasks and notes.
Why it matters
If users can change Office macro security, they may enable macros and run malicious code, leading to malware, data loss or fraud.
How to implement
IT team: Ensure that users cannot change macro settings by configuring Group Policy settings across all computers in the organisation.
System administrator: Lock down the Trust Centre settings in Microsoft Office to prevent unauthorised changes by making changes in the Office Administrative Templates.
Security officer: Regularly review and update the list of individuals with permissions to use macros, based on business necessity.
IT manager: Coordinate with department heads to understand any business requirements for macros and allowlist only verified users.
Keep it running
Enforce Office macro security via GPO/Intune; regularly confirm users cannot change settings and audit policy/application baselines after updates.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are users able to change the macro security settings on their computers?
Look at
Examine Group Policy settings and Microsoft Office Trust Centre settings.
Good evidence
Users are unable to change macro settings; these are controlled via Group Policy and locked at the system level.
- Check 2 of 2What an auditor asks for
Ask for
How is access to alter these settings justified and documented?
Look at
Review records of business requirements and approval for macro use.
Good evidence
There is a documented business need and management approval for any user who can run macros.
Mappings
Closest match in ASD Information Security Manual: ISM-1489, Lock Microsoft Office macro security settings against user changes, which asks for the same thing.
ASD Information Security Manual: 13 mappings
This control is equivalent to ISM-1489.
E8-RM-ML1.4 requires that Microsoft Office macro security settings cannot be changed by users. ISM-1489 states the same requirement for Office macro security settings, with effectively identical scope and intent. Implementing ISM-1489 would largely satisfy E8-RM-ML1.4 (and vice versa) because both enforce centrally controlled, user-immutable macro security configuration.
This control partially meets ISM-1823.
ISM-1823 requires office productivity suite security settings to be locked so users cannot change any of them. E8-RM-ML1.4 specifically prevents users from changing Microsoft Office macro security settings, which is one subset of suite security settings. Therefore ISM-1823 encompasses the macro-setting immutability requirement but also extends to other Office security settings beyond macros.
This control partially meets ISM-1915.
ISM-1915 involves maintenance of approved user application configurations. E8-RM-ML1.4 ensures that Microsoft Office macro security settings remain unchanged by users, supporting ISM-1915 within the scope of macro settings.
This control partially overlaps ISM-1601.
ISM-1601 requires organisations to implement Microsoft Attack Surface Reduction (ASR) rules to reduce exploitable behaviours in user applications. E8-RM-ML1.4 relates because several ASR rules (or complementary Defender/Microsoft 365 policy controls) can be used to enforce macro hardening outcomes, including preventing users from weakening macro security. However, E8-RM-ML1.4 is specifically about locking down Office macro security settings, whereas ISM-1601 is broader across multiple ASR rules beyond macros.
This control partially overlaps ISM-1748.
ISM-1748 requires that email client security settings cannot be changed by users. E8-RM-ML1.4 relates by applying the same control objective (preventing user tampering with security posture) to Microsoft Office macro security settings. The common ground is restricting user ability to weaken client-side protections, but E8-RM-ML1.4 is macro-specific and does not address email client configuration controls.
This control partially overlaps ISM-1825.
ISM-1825 requires that security product security settings cannot be changed by users to maintain enforced protections. E8-RM-ML1.4 specifically requires preventing users from changing Microsoft Office macro security settings, which is an immutability outcome for a particular application security control. The overlap is that both constrain user ability to weaken security posture, but E8-RM-ML1.4 is focused narrowly on macro policy in Office rather than security products broadly as per ISM-1825.
This control supports ISM-1488.
ISM-1488 requires that Microsoft Office macros in files originating from the internet are blocked. E8-RM-ML1.4 supports this by preventing users from weakening or bypassing the macro blocking posture through changing macro security settings. ISM-1488 is about the security outcome (blocked internet macros), while E8-RM-ML1.4 is about assuring the setting remains enforced.
This control supports ISM-1671.
ISM-1671 requires Microsoft Office macros to be disabled for human users unless they have a demonstrated business requirement. E8-RM-ML1.4 supports this by preventing users from changing macro security settings, helping ensure the organisation-enforced 'macros off by default' posture cannot be bypassed locally. ISM-1671 sets the entitlement/allow-list expectation, while E8-RM-ML1.4 is a technical enforcement mechanism that stabilises that configuration.
This control supports ISM-1672.
ISM-1672 requires Microsoft Office macro antivirus scanning to be enabled as a protective configuration. E8-RM-ML1.4 ensures users cannot change Microsoft Office macro security settings, which helps preserve the enabled scanning state and prevents user-driven weakening of macro protections. E8-RM-ML1.4 is about configuration enforcement, while ISM-1672 is the specific setting to be enforced.
This control supports ISM-1674.
ISM-1674 requires enforcement of macro execution so that only sandboxed, Trusted Location, or trusted-signed macros can run. E8-RM-ML1.4 supports this by preventing users from changing Office macro security settings that could weaken or bypass the enforcement of ISM-1674. ISM-1674 defines the execution allow-list conditions, while E8-RM-ML1.4 is a configuration integrity control to keep those conditions intact.
This control depends on ISM-1584.
E8-RM-ML1.4 requires that Microsoft Office macro security settings cannot be changed by users. ISM-1584 prevents unprivileged users from bypassing, disabling or modifying operating system security functionality, which supports enforcing and protecting policy enforcement mechanisms used to lock down Office settings. ISM-1584 is OS-focused and does not itself mandate Office macro configuration, but it strengthens the ability to keep E8-RM-ML1.4 effective against local tampering.
This control depends on ISM-1673.
ISM-1673 requires enforcing a specific macro hardening setting: blocking Win32 API calls from Office macros. E8-RM-ML1.4 requires preventing users from changing macro security settings, which helps ensure the ISM-1673 protection remains enabled and cannot be bypassed by end users. E8-RM-ML1.4 is broader about configuration integrity, whereas ISM-1673 is one particular macro restriction.
This control depends on ISM-1675.
ISM-1675 requires a specific macro-enablement restriction (untrusted publisher macros cannot be enabled via Message Bar or Backstage View). E8-RM-ML1.4 supports this by preventing users from changing macro security settings that could otherwise weaken or bypass the intended restriction. The primary is the required technical behaviour in Office, whereas E8-RM-ML1.4 is a hardening control to preserve that behaviour.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-RM-ML1.4 requires that Microsoft Office macro security settings cannot be changed by users, which keeps a deployed baseline's macro settings in place.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.