Require that application add-ins are signed by Trusted Publisher
This per-user registry value controls signature verification for application add-ins in Microsoft Project.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\ms project\security\requireaddinsig
This per-user registry value controls signature verification for application add-ins in Microsoft Project. It is a REG_DWORD value. When set to 1, Project checks an add-in's digital signature before loading it. Project disables the add-in if it is unsigned or if its signature does not come from a trusted publisher.
In this context, a publisher is trusted when the required code-signing certificate is present in the Windows Trusted Publishers certificate store. A valid signature also provides assurance that the signed code has not been modified unnoticed since it was signed.
When the value is 0 or absent, this policy does not require signature verification for application add-ins. Other security policies or blocking mechanisms can still prevent an add-in from loading.
Notes
Additional effects
Verification can affect signed DLLs associated with an add-in as well as the add-in itself. If the necessary certificates are missing from the Trusted Publishers store, Project can therefore display a trust warning or disable an add-in even though the add-in has a valid digital signature.
Whether users are notified about a rejected add-in also depends on the separate policy that suppresses Trust Bar notifications for unsigned application add-ins.
Security
This setting reduces the risk of Project loading unsigned add-in code or code signed by a publisher that has not been trusted. Such add-ins can access data and functionality available to Project and to the signed-in user.
Signature verification does not evaluate whether the code itself is safe or appropriate. Malicious or unwanted behavior remains possible if the code is correctly signed with a certificate that has been designated as trusted. Trust also applies to the publisher or signing certificate; it is not an approval limited to one specific add-in.
Possible side effects
Unsigned add-ins and add-ins whose publishers are not trusted become unavailable in Project. Features, automation, or integrations that depend on those add-ins might consequently stop working.
An add-in or associated DLL can use a new signing certificate after an update. If that certificate is not yet present in the Trusted Publishers store, users can receive warnings or previously functional add-ins can be disabled.
Notes
The Office\16.0 branch is used by Project 2016 and later Windows desktop releases that share the Office 16.0 policy structure. This setting applies only to the affected user and to Microsoft Project; equivalent settings for other Office applications use separate registry paths.
Microsoft documentation
Microsoft Support: Resolve warning for the REQUIREADDINSIG security policy
Microsoft Learn: Trusted publishers for Office files