Security setting for macros

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\outlook\security\level

This per-user policy value selects the security level applied to VBA macros in classic Outlook for Windows. It is a REG_DWORD value with the following supported settings:

• 1 – No security check: Outlook permits macros without presenting a security prompt.
• 2 – Always warn: Outlook initially disables macros and displays a security warning that allows the user to decide whether to run them.
• 3 – Warning for signed, disable unsigned: Macros from trusted publishers can run. Outlook can request a trust decision when a macro has a valid signature from a publisher that is not yet trusted. Unsigned macros and macros without a valid signature remain disabled.
• 4 – Never warn, disable all: Outlook disables macros without displaying macro security warnings.

The setting is specific to Outlook and does not change the macro security level of other Microsoft Office applications.

Notes

Security

VBA macros execute with the signed-in user’s permissions and can interact with Outlook data and other resources available to that user. Value 1 removes the macro security check, allowing malicious or altered VBA code to run without a prior warning.

Values 2 and 3 reduce that exposure but are not absolute execution blocks. With 2, the user can permit a macro after seeing a warning. With 3, execution of signed code also depends on signature validity and whether the publisher is trusted. A valid digital signature establishes the origin and integrity of the signed project; it does not by itself prove that the code is safe.

Value 4 blocks macro execution without offering a user override and therefore provides the most restrictive behavior available through this policy.

Possible side effects

Values 3 and 4 can prevent Outlook automation from working when its VBA project does not meet the applicable signing and publisher-trust requirements. Value 2 can interrupt workflows with recurring security prompts. With 4, macro-based functionality is unavailable, and the absence of warnings means users cannot approve an affected macro on a case-by-case basis.

Notes

This policy directly governs macro security. It does not automatically extend the same rules to installed COM add-ins or additional actions. That behavior is controlled by the separate Outlook policy named Apply macro security settings to macros, add-ins and additional actions.

The 16.0 policy path is used by the administrative templates for Outlook 2016 and later classic desktop releases, including supported Outlook versions supplied with Microsoft 365 Apps. New Outlook for Windows does not support VBA macros, so this setting has no equivalent macro behavior there.

Microsoft documentation

Microsoft Learn: Teams meeting add-in security when using your Outlook client

Microsoft Support: Enable or disable macros in Microsoft 365 files

See also

• Entry in the reference