{"id":75832,"date":"2016-10-26T12:56:24","date_gmt":"2016-10-26T19:56:24","guid":{"rendered":""},"modified":"2025-12-08T06:28:29","modified_gmt":"2025-12-08T14:28:29","slug":"office-2013-can-now-block-macros-to-help-prevent-infection","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/","title":{"rendered":"Office 2013 can now block macros to help prevent infection"},"content":{"rendered":"\n
\n
\n

In response to the growing trend of macro-based threats, a new feature in Office 2016 allows an enterprise administrator to block users from running macros in Office documents that originated from the Internet.<\/p>\n\n\n\n

This feature was documented back in March: New feature in Office 2016 can block macros and help prevent infection<\/a>, and the predominant customer request we received was for this feature to be added to Office 2013.<\/p>\n<\/div>\n\n\n\n

\n
Office 365 client applications now integrate with AMSI<\/a>, enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behavior.<\/em>

This is part of our continued efforts to tackle entire classes of threats. <\/em>

Learn more:<\/em>
Office VBA + AMSI: Parting the veil on malicious macros<\/strong><\/a><\/em><\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div>\n<\/div>\n\n\n\n

We are pleased to announce that, as of September 2016, this feature is now part of Office 2013 \u2013 and it works in the same way as it does in Office 2016.<\/p>\n\n\n\n

Administrators can enable this feature for Word, Excel, and PowerPoint by configuring it under the respective application\u2019s Group Policy Administrative Templates for Office 2013<\/a>.<\/p>\n\n\n\n

For more information on how this feature works, and some background information on how macros can be abused for malware, see our blog from March 2016<\/a>.<\/p>\n\n\n\n

More info for end-users: Learn how to enable or disable macros in Office files<\/a><\/p>\n\n\n\n

More info for admins and IT professionals: Learn about security and compliance in Office 365<\/a><\/p>\n\n\n\n

Related blog entry: Machine learning vs. social engineering<\/strong><\/a><\/p>\n\n\n\n

\n\n\n\n

Talk to us<\/strong><\/h2>\n\n\n\n

Questions, concerns, or insights on this story? Join discussions at the Microsoft community<\/a> and Windows Defender Security Intelligence<\/a>.<\/p>\n\n\n\n

Follow us on Twitter @WDSecurity.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In response to the growing trend of macro-based threats, a new feature in Office 2016 allows an enterprise administrator to block users from running macros in Office documents that originated from the Internet.<\/p>\n","protected":false},"author":61,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ms_queue_id":[],"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","_alt_title":"","ms-ems-related-posts":[],"footnotes":""},"post_tag":[],"threat-intelligence":[3727],"content-type":[3663],"job-role":[],"product":[],"topic":[3687],"coauthors":[1968],"class_list":["post-75832","post","type-post","status-publish","format-standard","hentry","threat-intelligence-attacker-techniques-tools-and-infrastructure","content-type-research","topic-threat-intelligence","review-flag-1694638265-83","review-flag-disable","review-flag-integ-1694638263-281","review-flag-machi-1694638272-641","review-flag-new-1694638263-340"],"yoast_head":"\nOffice 2013 can now block macros to help prevent infection | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Office 2013 can now block macros to help prevent infection | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"In response to the growing trend of macro-based threats, a new feature in Office 2016 allows an enterprise administrator to block users from running macros in Office documents that originated from the Internet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-10-26T19:56:24+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-08T14:28:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-microsoft_logo_element.png\" \/>\n\t<meta property=\"og:image:width\" content=\"512\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Defender Security Research Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Defender Security Research Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/windows-defender-research\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Defender Security Research Team\"}],\"headline\":\"Office 2013 can now block macros to help prevent infection\",\"datePublished\":\"2016-10-26T19:56:24+00:00\",\"dateModified\":\"2025-12-08T14:28:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\"},\"wordCount\":265,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\",\"name\":\"Office 2013 can now block macros to help prevent infection | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"datePublished\":\"2016-10-26T19:56:24+00:00\",\"dateModified\":\"2025-12-08T14:28:29+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Office 2013 can now block macros to help prevent infection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/person\/a385e64377ec1eb81d3bd7f9839f060b\",\"name\":\"Microsoft Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/0242738c3da64c97e705834683728e774a3f4e29c071681ed74a68e3a671d270?s=96&d=microsoft&r=gea2dea4ce5dbbbe4077dc25334909eb7\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0242738c3da64c97e705834683728e774a3f4e29c071681ed74a68e3a671d270?s=96&d=microsoft&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0242738c3da64c97e705834683728e774a3f4e29c071681ed74a68e3a671d270?s=96&d=microsoft&r=g\",\"caption\":\"Microsoft Security\"},\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/mssecurity\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Office 2013 can now block macros to help prevent infection | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/","og_locale":"en_US","og_type":"article","og_title":"Office 2013 can now block macros to help prevent infection | Microsoft Security Blog","og_description":"In response to the growing trend of macro-based threats, a new feature in Office 2016 allows an enterprise administrator to block users from running macros in Office documents that originated from the Internet.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/","og_site_name":"Microsoft Security Blog","article_published_time":"2016-10-26T19:56:24+00:00","article_modified_time":"2025-12-08T14:28:29+00:00","og_image":[{"width":512,"height":512,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-microsoft_logo_element.png","type":"image\/png"}],"author":"Microsoft Defender Security Research Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Microsoft Defender Security Research Team","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/windows-defender-research\/","@type":"Person","@name":"Microsoft Defender Security Research Team"}],"headline":"Office 2013 can now block macros to help prevent infection","datePublished":"2016-10-26T19:56:24+00:00","dateModified":"2025-12-08T14:28:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/"},"wordCount":265,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/","name":"Office 2013 can now block macros to help prevent infection | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"datePublished":"2016-10-26T19:56:24+00:00","dateModified":"2025-12-08T14:28:29+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2016\/10\/26\/office-2013-can-now-block-macros-to-help-prevent-infection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Office 2013 can now block macros to help prevent infection"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/person\/a385e64377ec1eb81d3bd7f9839f060b","name":"Microsoft Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/0242738c3da64c97e705834683728e774a3f4e29c071681ed74a68e3a671d270?s=96&d=microsoft&r=gea2dea4ce5dbbbe4077dc25334909eb7","url":"https:\/\/secure.gravatar.com\/avatar\/0242738c3da64c97e705834683728e774a3f4e29c071681ed74a68e3a671d270?s=96&d=microsoft&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0242738c3da64c97e705834683728e774a3f4e29c071681ed74a68e3a671d270?s=96&d=microsoft&r=g","caption":"Microsoft Security"},"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/mssecurity\/"}]}},"bloginabox_animated_featured_image":null,"bloginabox_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/75832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=75832"}],"version-history":[{"count":1,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/75832\/revisions"}],"predecessor-version":[{"id":144245,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/75832\/revisions\/144245"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=75832"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/post_tag?post=75832"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=75832"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=75832"},{"taxonomy":"job-role","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/job-role?post=75832"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/product?post=75832"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=75832"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=75832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}