Require that application add-ins are signed by Trusted Publisher
This per-user policy determines whether Microsoft Publisher verifies an application add-in’s digital signature before loading the add-in.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\publisher\security\requireaddinsig
This per-user policy determines whether Microsoft Publisher verifies an application add-in’s digital signature before loading the add-in.
When the policy is enabled, Publisher loads only add-ins that are validly signed and whose signing certificate belongs to a trusted publisher. Publisher disables an unsigned add-in or an add-in from a publisher that is not trusted. The user is normally notified that the add-in was disabled, although a separate policy can suppress that notification.
When the policy is disabled or not configured, this registry value does not require Publisher to verify application add-in signatures.
Notes
Additional effects
Validation can extend beyond the add-in itself to associated DLL files. The required signing certificates must be present in the Windows Trusted Publishers certificate store. A valid digital signature is therefore insufficient when its publisher has not been designated as trusted.
Security
The policy helps prevent unauthorized or modified add-ins from being loaded. This reduces the risk of an untrusted add-in executing code within Publisher or accessing data processed by the user.
Signature validation does not assess what the signed code does or establish that it is harmless. Code validly signed with the same certificate is associated with the trusted publisher. Security therefore also depends on which certificates are present in the Trusted Publishers store and whether the corresponding private keys remain protected.
Possible side effects
Add-ins that are unsigned or whose publishers are not trusted do not load. Features that depend on those add-ins are consequently unavailable.
Even validly signed add-ins can produce warnings or fail to load after an update if new or changed signing certificates for the add-in or its associated DLL files are not yet present in the Trusted Publishers certificate store.
Notes
The registry value applies to Microsoft Publisher in Office version 16.0 for the current user. It does not control add-in signature validation in other Office applications.
Microsoft documentation
Microsoft Support: Resolve warning for the REQUIREADDINSIG security policy
Microsoft Learn: Trusted publishers for Office files