How are macros verified and trusted?

Microsoft Office has both trusted document and trusted location functions. Once trusted documents or trusted locations are defined, macros in trusted documents or macros in Microsoft Office files in trusted locations automatically execute when the files are opened. While the use of trusted documents is discouraged, trusted locations when implemented in a controlled manner can allow organisations to appropriately balance both their business and security requirements.

Microsoft Office applications allow developers to include information about themselves by digitally signing their macros. The signing certificate that is used to create a signed macro confirms that the macro originated from the signatory, while the signature itself confirms that the macro has not been altered. Digital signing certificates can be self-generated by users, obtained from a commercial Certificate Authority or obtained from an organisation’s security administrator if they operate their own Certificate Authority.