Require that application add-ins are signed by Trusted Publisher
This per-user policy value determines whether Excel verifies an application add-in's digital signature before loading the add-in.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\excel\security\requireaddinsig
This per-user policy value determines whether Excel verifies an application add-in's digital signature before loading the add-in.
The value uses the REG_DWORD type. When set to 1, Excel loads only add-ins that are digitally signed and whose signatures can be associated with a trusted publisher. If an add-in is unsigned or its signer is not a trusted publisher, Excel disables the add-in and notifies the user unless a separate policy suppresses that notification.
When set to 0, Excel does not impose this signature check as a requirement before loading application add-ins.
Notes
Security
Signature verification restricts add-in loading to code associated with explicitly trusted publishers. It reduces the risk of Excel executing unauthorized, unsigned, or modified add-in code.
This setting does not add or remove trusted publishers. The add-in's signing certificate must already be recognized through the Trusted Publishers certificate store. A valid signature also does not establish that the signed code is harmless; it identifies the publisher and helps detect changes made after signing.
When the value is 0, this policy does not prevent a dangerous, unsigned, or untrusted-publisher add-in from loading. Other Excel and Office security controls can still block the add-in independently.
Possible side effects
Unsigned add-ins and add-ins whose signing certificates are not trusted are disabled. Commands, functions, automation, or integrations supplied by those add-ins can consequently become unavailable. Existing add-ins can also be affected after a certificate is renewed or removed from the Trusted Publishers store.
Notes
This policy applies to Excel application add-ins. It does not replace the separate controls for VBA macros, Trusted Locations, or files obtained from the internet.
Excel add-in files carrying Mark of the Web, particularly .xla and .xlam files, are subject to additional protections. For these files, a digital signature and a trusted publisher alone do not overcome the internet-origin block introduced by the security hardening in 2016.
Microsoft documentation
Microsoft Learn: Trusted publishers for Office files
Microsoft Learn: Macros from the internet are blocked by default in Office
Microsoft Office administrative template: Excel 2016 policy definition