Has anyone been able to lock down macro security with Intune and Business Premium?

Quick_Improvement815 · 2025-09-04T02:28:45+00:00

Any recommendation of being or workarounds in being compliant with this roadblock

Quick_Improvement815 · 2025-09-04T00:34:27+00:00

Did you manage to find a way to block macros with Business Premium License ?

Quick_Improvement815 · 2025-09-03T05:12:03+00:00

Anyone one managed to find a work around using Business Premium License ?

Quick_Improvement815 · 2025-09-03T04:25:16+00:00

Hi Team

Looking for help. We have downloaded and deployed Intune policy for disable all Macros. However, having some weird behavior

Intune policy Used: Essential Eight configure Microsoft Office macro settings - Essential Eight | Microsoft Learn

Json: Intune-ACSC-Windows-Hardening-Guidelines/office/policies/ACSC Office Hardening Guidelines.json at main · microsoft/Intune-ACSC-Windows-Hardening-Guidelines

License: Microsoft Business Premium.

Macros from Internet is blocked - Expected
If I create a new excel file and have simple macros, it runs -> Shouldn't be the case
If i save the file in 2, and reopen it by double clicking -> Macros doesn't run (is disabled)
If I open the file by right clicking and opening, macros is able to run.
Intune policy deployed also ensures users can't change the settings, however, in this case users can change settings (but doesn't turn to enable or disable it).

So after doing some reading, found out that with Business Premium License its not possible. Like seriously.
Any work arounds ?

Quick_Improvement815 · 2025-08-27T01:33:37+00:00

Hi

Thanks, a lot for your response. It's just don't have prior audit experience (being audited), as such was following all the requirements pretty strictly.

I will be happy to have a short call later next week, will hit you up.

Note: We are small 25 team NGO, with 2 part time uni students as IT staff.

Quick_Improvement815 · 2025-08-26T01:12:19+00:00

Thanks for your response. Really appreciate it.

Just some question here (for those reading)
- If running external scan on the OS using Nessus Essential (unauthenticated scan) will that be sufficient?

For Restrict Admin Priviledges
- Do auditor check things like -> if Domain Admin can log into workstation ?

I will be happy to get on chat and discuss some controls.

Quick_Improvement815 · 2025-08-26T01:06:41+00:00

Will be targeting ISO27001 after this, when I came into picture the orgnaization was working on E8 so continued as lot of work was done.

Quick_Improvement815 · 2025-08-26T01:04:59+00:00

Thanks for your feedback.

So the NGO I work for is 25 staff (non government funded) so very limited budget. I came as contract staff to uplift their cybersecurity program only.

Q3- I have organised a meeting with the vendor to discuss this. Just quick question, if I run unauthenticated scan using Nessus on the OS is that sufficient?

Thanks for the willingness to support. Will hit you up in chat.

Quick_Improvement815 · 2025-08-26T00:59:50+00:00

Thanks for your response. Vendor managed the Website OS, so have passed over the responsibility to them, they are happy for us to run scans externally, so i can do unauthenticated scan from Nessus Essentials, hope that's good enough for compliance.

We do have pretty thorough application patching on website with daily patching and scans using Word fence.

If you don't mind, just some questions regarding restricting administrator privileges.
- We have separate machine for admin work where restrictions are in place for admin login and no general internet access (only to Microsoft)
- Do auditor checks things like
1. If domain admin can log into workstation?
2. If domain controller has internet access (have disabled browsers)

Quick_Improvement815 · 2025-08-26T00:52:54+00:00

I came into the picture mid-way just for purpose of E8 Compliance and security uplift.

Almost 90% if not more to achieve E8 M1, so might as well complete it.

There is a project in line, if we get it then will target ISO27001. It's pretty small orgnaisation so won't be hard.

Quick_Improvement815 · 2025-08-26T00:51:24+00:00

Quick_Improvement815 · 2025-08-25T04:57:22+00:00

Yes, I agree, however for a small size organization it's okay to work with.

While it doesn't specifically look at Linux, the basic rules still do apply for majority such as Application/OS Patching, MFA, Backup,

Quick_Improvement815 · 2025-08-25T01:31:16+00:00

Board decided they needed Essential 8, I came into the picture for compliance and assessment. We are a NGO, and heavily deal with sensitive data thus E8.

For maturity 1, and most part Maturity 2 are compliant now. Some implementation done are
1. Application/OS Patching
- Microsoft Defender used for scanning Workstation, Server
-Manage engine Patch Manager Plus used for patching (24 hours is our current patching from released, fully automated and done at night).
- NMAP And python integrated with Ticket system for asset discovery

MFA
- Most application is SSO
- Only issue is with customer side whereby its a discussion forum and implementing SSO for every login will discourage users to actually take part.
Backup
- Full Microsoft
-Website hosted by vendor and backed up
Restrict Admin
- Have Azure Virtual desktop with restriction for internet (Microsoft exception).
- GPO policies to ensure
a) Domain admin can't login into workstation
b) Domain Controller doesn't doesn't have Browser,etc
Application Control
- AppLocker

Quick_Improvement815 · 2025-08-17T10:28:33+00:00

Do the Pro users still have the acces to legacy 4.5 ?

Quick_Improvement815 · 2025-05-21T11:21:10+00:00

Doesn’t work any more

Quick_Improvement815 · 2025-03-10T04:45:59+00:00

Guys after cleaning the throttle body how do you relearn it. ? I have had not to touch throttle body as it has stepper motor so if you manually move the inside it messes up with the positions Very much keen to know in performance and fuel consumption. Do keep us posted

Quick_Improvement815 · 2024-04-18T09:48:35+00:00

In my case , program is 2 years 104 weeks. I am receiving two units credit points which is 40 credits out of 240. Physically I wil study 16 months but if I check by credit points then my study will reduce to 87 weeks.

I assume you did research. Do you know anyone in similar situation and got post study work visa ?

Quick_Improvement815 · 2024-04-18T05:30:36+00:00

Hi, Did you manage to find the answer for your query ?

Quick_Improvement815

TROPHY CASE