Require that application add-ins are signed by Trusted Publisher
This per-user Visio policy requires application add-ins to carry a valid digital signature from a publisher recognized as trusted before they can be loaded.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\visio\security\requireaddinsig
This per-user Visio policy requires application add-ins to carry a valid digital signature from a publisher recognized as trusted before they can be loaded. The relevant code-signing certificate must be present in the Windows Trusted Publishers certificate store.
Visio does not load an add-in that lacks a valid, trusted signature. It may notify the user that the add-in was disabled or that its signature is valid but the publisher has not yet been trusted.
Notes
Additional effects
Signature validation can extend to associated DLLs used while loading an add-in. Consequently, a signed add-in can still produce a trust warning or fail to load when the certificate required for a related component is missing from the Trusted Publishers store.
Security
This policy reduces the risk of Visio loading unsigned add-ins or add-ins from unrecognized publishers. Add-ins run within the Visio process and can potentially access data and capabilities available to that process and the signed-in user.
A valid signature establishes integrity and identifies the signer; it does not establish that an add-in is harmless. Trusting a publisher also causes other components validly signed with the same trusted certificate to be recognized accordingly. Trust placed in an unauthorized or overly broad certificate therefore weakens the protection.
The setting governs trust validation for application add-ins. It does not replace the separate controls that apply to macros, ActiveX controls, executable files, or other active content.
Possible side effects
Legitimate add-ins do not load if they are unsigned, have an invalid signature, or rely on a signing certificate that is not registered as trusted. Commands, automation, or integrations supplied by those add-ins may consequently become unavailable.
Microsoft or third-party components can also produce a warning after an update if the updated files use a new signing certificate that is not yet present in the applicable certificate store.
Notes
The registry location is user-scoped and applies specifically to Visio. Equivalent settings for other Office applications use their own application-specific registry paths.
The 16.0 branch is used not only by Visio 2016 but also by later supported Visio desktop releases, including Visio 2019, Visio LTSC 2021, Visio LTSC 2024, and Visio supplied through applicable Microsoft 365 subscription plans.
Microsoft documentation
Microsoft Support: Resolve warning for the REQUIREADDINSIG security policy
Microsoft Learn: Trusted publishers for Office files