Microsoft now restricts XLM macros in Excel by default

Although many organizations still use Excel 4.0 (XLM) macro for their automation activities, Microsoft has been encouraging the transition to the more secure Visual Basic for Applications (VBA) for quite some time. This is because malicious actors abuse macros to inject malware into enterprise systems frequently, so their continued use facilitates a relatively accessible attack surface. Microsoft tried to tackle this problem to some extent by introducing runtime inspection of XLM macro code in March 2021, and today, it is taking yet another step.

Microsoft has now announced that it will restrict XLM macros by default for customers utilizing Excel. This is something that the company already hinted at back in July 2021, and the change is now rolling out publicly. Be default, the Excel Trust Center option for the use of macros will indicate that the language is disabled.

That said, IT admins organizations obviously still have the ability to modify the default behavior using Group Policy, Cloud policies, and ADMX policies, all of which are described in Microsoft's blog post here.

The new default configuration is now rolling out for the following customers:

• Current Channel builds 2110 or greater (first released in October)
• Monthly Enterprise Channel builds 2110 or greater (first released in December)
• Semi-Annual Enterprise Channel (Preview) builds 2201 or greater (we create this in January 2022, but it first ships in March 2022)
• Semi-Annual Enterprise Channel builds 2201 or greater (will ship July 2022)

In short, it applies to the September fork version 16.0.14527.20000 and above. IT admins can also choose to completely disable the use of existing and new XLM macros across an organization for enhanced security, and if you're managing the security of your organization, you should probably check out Microsoft's blog post here.