We have a spreadsheet the whole finance team uses that relies on macros. What happens?

We find it during the audit phase. Then we work out whether it can be rebuilt without macros, which it often can. If not, we digitally sign the macro and allowlist the certificate that signed it. That is a few hours of work, not a reason to stall the rollout.

What's the risk if we skip this control?

Macro-delivered ransomware has been one of the most common ways Australian businesses get compromised. Someone opens an Office file from an email, the macros fire, and credentials or data leave the building before anyone notices. Configuring macros properly closes that path. Skipping it leaves one of the cheapest routes in wide open.

Does this apply to Excel files from clients?

Particularly those. Files that arrive from the internet, whether by email, web download or an external USB stick, have macros blocked whatever the user's own policy says. That is the specific ACSC rule, and it is the one that catches real compromise attempts.

Configure Microsoft Office macro settings

Stopping the little automation scripts inside Word and Excel from running unless they're from a trusted source.

The case for it

What you lose without Office macro restrictions.

Macros have delivered ransomware to Australian businesses for over a decade. What makes them useful to your finance team makes them just as useful to an attacker. Configuring them properly removes a whole class of attack, and most of your staff will never notice the change.

Where you need to be

What each maturity level asks of Office macro restrictions.

The Australian Cyber Security Centre (ACSC) sets a requirement for this control at each maturity level, ML1 through ML3. Your overall Essential Eight score is your weakest control rather than an average, so a gap here pulls the whole score down.

ML1 The 2026 baseline

Macros are disabled for users who don't have a business requirement. Macros in files originating from the internet are blocked. Macro antivirus scanning is enabled.

ML2 Regulated or audited

Macros are only enabled for users with a business requirement via a managed allowlist. Macros are checked by antivirus before execution. Macro use is logged.

ML3 Defence or sensitive

Only digitally signed macros from trusted publishers run. Signed macros are validated. Macro execution is logged centrally.

Not sure which level you should aim for?

Three questions about your regulatory position and the data you keep will point you at the right target.

Take the maturity picker

The rollout

Setting up Office macro restrictions in your environment.

Staff with no business need for macros have them switched off, using Microsoft 365 security baselines. Anyone who does need them, usually finance or reporting, gets named files allowlisted through Intune, or macros that must be digitally signed. The policy is tied to your Microsoft Entra ID groups, so when someone's role changes, their macro settings change with it.

Talk to a tech about this control See which plan includes it

Free self-assessment

No email required.

Score yourself on all eight controls.

Eight questions, your estimated Essential Eight maturity level, and a branded PDF report you can share with your board, insurer, broker or auditor. Runs entirely in your browser. Nothing is sent to us unless you choose to book a call.

Take the self-assessment

Asked on client calls

Questions we get about Office macro restrictions.

We have a spreadsheet the whole finance team uses that relies on macros. What happens?: We find it during the audit phase. Then we work out whether it can be rebuilt without macros, which it often can. If not, we digitally sign the macro and allowlist the certificate that signed it. That is a few hours of work, not a reason to stall the rollout.

What's the risk if we skip this control?: Macro-delivered ransomware has been one of the most common ways Australian businesses get compromised. Someone opens an Office file from an email, the macros fire, and credentials or data leave the building before anyone notices. Configuring macros properly closes that path. Skipping it leaves one of the cheapest routes in wide open.

Does this apply to Excel files from clients?: Particularly those. Files that arrive from the internet, whether by email, web download or an external USB stick, have macros blocked whatever the user's own policy says. That is the specific ACSC rule, and it is the one that catches real compromise attempts.

Where to go next

Essential Eight controls that work with Office macro restrictions.

See all eight controls

Control 04

User application hardening

Turning off features in web browsers and Office that attackers commonly abuse.

Read the control

Control 01

Application control

Only letting approved programs run on your computers. Everything else is blocked by default.

Read the control

Control 07

Multi-factor authentication

Requiring something more than a password to log in: a code, a key, or an app.

Read the control

The maturity level summaries on this page are a plain-English version of the ACSC's published Essential Eight Maturity Model. For the full text, see the ACSC Essential Eight Maturity Model .

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.