Macro Runtime Scan Scope

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\common\security\macroruntimescanscope

This value determines which macro-enabled files Office submits for runtime inspection through the Antimalware Scan Interface (AMSI). It applies to VBA macros in supported Office applications and to Excel 4.0 (XLM) macros, which are supported only by Excel.

The value uses the REG_DWORD data type and supports the following data:

• 0: Disables macro runtime scanning for all files.
• 1: Scans macros in low-trust files. Files are excluded when they are opened with the macro security setting “Enable All Macros,” originate from a Trusted Location, are Trusted Documents, or contain VBA digitally signed by a Trusted Publisher.
• 2: Scans macros in all macro-enabled files; the trust-based exclusions associated with 1 do not apply.

When runtime scanning is active, the VBA or XLM runtime reports certain security-sensitive code behaviors that a macro is about to perform to the registered AMSI provider. If the provider identifies the behavior as malicious, the Office application terminates the affected session, and the antimalware product can quarantine the file. Macro execution continues when the behavior is not classified as malicious.

Notes

Security

Runtime inspection gives the antimalware provider visibility into a macro’s actual behavior, including parameters resolved during execution. This can expose malicious activity that code obfuscation might conceal from static inspection.

A value of 0 removes this additional AMSI inspection from enabled macros. A value of 1 retains the documented trust-based exclusions, while 2 extends inspection to those files and therefore provides the broadest runtime coverage.

This setting does not determine whether macros are permitted to run. It supplements Office macro security and has an effect only when an antimalware product is registered on the device as an AMSI provider.

Possible side effects

Runtime scanning can reduce the execution performance of affected VBA projects and XLM macro sheets. The impact depends on the macro’s behavior and the antimalware provider performing the inspection.

Notes

If the policy is not configured, Microsoft documents “Enable for low trust files,” corresponding to the behavior of value 1, as the default.

Microsoft documents this policy as applying only to subscription versions of Office, such as Microsoft 365 Apps for enterprise. The “Microsoft Office 2016” category name therefore does not by itself indicate support in the perpetual Office 2016 product.

Microsoft documentation

Microsoft Learn: Settings for the Microsoft 365 Apps for Enterprise security baseline

Microsoft Security Blog: XLM + AMSI—New runtime defense against Excel 4.0 macro malware

See also

• Entry in the reference