Require that application add-ins are signed by Trusted Publisher
This per-user policy value determines whether Microsoft Word verifies an application add-in’s digital signature before loading the add-in.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\word\security\requireaddinsig
This per-user policy value determines whether Microsoft Word verifies an application add-in’s digital signature before loading the add-in.
The value uses the REG_DWORD data type. When set to 1, Word loads only add-ins that have been validly signed by a trusted publisher. If an add-in is unsigned or its signer is not recognized as a trusted publisher, Word disables the add-in and notifies the user. The publisher’s code-signing certificate must be recognized in the Trusted Publishers certificate store.
When set to 0, the policy requirement is disabled. This does not mean that Word has otherwise established that an add-in is safe; it only removes the trusted-publisher check imposed by requireaddinsig.
Notes
Security
A value of 1 reduces the risk of Word running unsigned add-ins or add-ins from unrecognized publishers. A valid digital signature identifies the source and allows changes made after signing to be detected. It does not guarantee that every add-in signed by a trusted publisher is harmless.
The protection depends on careful management of the Trusted Publishers certificate store. Trusting a code-signing certificate can cause other content validly signed with that certificate to be recognized as originating from the same publisher. Publisher trust is also a Windows-wide property rather than a setting confined to Word.
Possible side effects
Unsigned add-ins and add-ins whose signing certificates are not trusted cannot load. Commands, automation, or integrations supplied by those add-ins can therefore become unavailable.
Word can also display a warning or prevent loading when a signature is valid but the required signing certificates are missing from the Trusted Publishers store. Microsoft documents this behavior for associated DLL files as well. Consequently, updates can affect even Microsoft components when new or changed certificates are not yet present in the applicable trust store.
Notes
This policy value applies to the current user and to Microsoft Word in the Office 16.0 version branch. Equivalent settings for other Office applications use separate registry paths.
The setting governs application add-ins. It is not a general signature policy for Word documents or VBA macros, which are also subject to separate security policies and Trust Center settings.
Microsoft documentation
Microsoft Support: Resolve warning for the REQUIREADDINSIG security policy
Microsoft Learn: Trusted publishers for Office files