Require that application add-ins are signed by Trusted Publisher
This per-user registry policy value determines whether PowerPoint verifies an application add-in’s digital signature before loading it.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\powerpoint\security\requireaddinsig
This per-user registry policy value determines whether PowerPoint verifies an application add-in’s digital signature before loading it. It is a REG_DWORD value: 1 enforces the signature requirement, while 0 disables that policy requirement.
When the requirement is enabled, PowerPoint loads an add-in only if it is digitally signed and its signature is associated with a trusted publisher. PowerPoint disables an add-in if the required signature is missing or its publisher is not trusted.
The policy applies only to PowerPoint in the Office 16.0 policy branch. It does not impose the same requirement on other Office applications.
Notes
Security
Requiring a trusted-publisher signature reduces the risk of unsigned add-in code, or code from an untrusted publisher, running in PowerPoint. A malicious add-in that is allowed to load could operate with the signed-in user’s permissions and affect presentation content or other data and resources available to that user.
A valid signature provides evidence of the signed code’s origin and integrity; it does not establish that the add-in is harmless or approved for a particular purpose. This policy does not add publishers to the trusted list. Publisher trust depends on certificates in the Windows Trusted Publishers certificate store, and trusting a publisher can affect Office and Windows scenarios beyond PowerPoint.
Possible side effects
Legitimate add-ins are also disabled if they are unsigned or their signing certificate does not identify a trusted publisher. Commands, automation, or other PowerPoint features supplied by those add-ins can consequently become unavailable.
PowerPoint normally notifies the user when it disables an add-in for this reason. A separate policy governing Trust Bar notifications for unsigned application add-ins can suppress that notification without allowing the add-in to run.
Notes
Because the value is stored under HKCU, it applies to the individual user. It controls only PowerPoint’s signature requirement and does not manage certificates or the Trusted Publishers list.
Microsoft documentation
Microsoft Office Administrative Template: PowerPoint 2016 policy definitions
Microsoft Learn: Trusted publishers for Office files
Microsoft Learn: Specific security considerations for Office solutions