How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune

by

Key Takeaways:

  • Strengthen endpoint security by preventing Office apps
  • Leverages Microsoft Defender’s Attack Surface Reduction (ASR) rules
  • Ensuring consistent enforcement across managed devices
  • Reduces risks of malware delivery through malicious macros or embedded scripts

Let’s discuss How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune. The Intune policy “Block Office applications from creating executable content” is a critical Attack Surface Reduction (ASR) rule. It is designed to prevent Microsoft Office apps (Word, Excel, PowerPoint) from spawning or writing executable files to the disk a classic hallmark of a malware infection.

Table of Contents

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune

This setting is essentially a “digital firewall” between your productivity tools and your system’s ability to run new code. The primary purpose of the “Block Office applications from creating executable content” policy is to sever the link between a common productivity tool (Microsoft Office) and the system’s ability to run unauthorized code.

How to Start Policy Creation

As an Admin, you can quickly configure this policy on your organisation. To start the Policy Creation, open the Microsoft Intune Admin center. Then go to Devices > Configuration >+ Create > +New Policy.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.1
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.1

Profile Creation

Profile creation is the necessary step that helps you to assign the policy to appropriate platform and Profile. Here I would like to configure the policy to Windows 10 and later platform and settings catalog profile. Then click on the Create button.

Patch My PC
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.2
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.2

Adding the Basic Details

Naming the policy is the primary step that help admins to identify the policy later. This is important and necessary step that allows you to know the purpose of the policy. Here is Name is mandatory and description is optional. After adding this click on the Next button.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.3
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.3

Configure Block Office Applications from Creating Executable Content

With Settings Picker, you can use the Configuration Settings Tab. On this tab, you can click on the +Add Settings hyperlink to get the Settings Picker. The settings picker shows huge number of settings. Here, I would like to select the settings by browsing by Category. I choose Defender\Block Office applications from creating executable content.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.4
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.4

Block Office Applications from Creating Executable Content

There are 4 values available for this policy. You can choose any of this value according to your preferences. Look at the below table and screenshot.

Setting ValueOperational ImpactOperational ImpactWhen to Use this Value
Not ConfiguredThe ASR rule is inactive. Windows Defender does not evaluate this specific threat vector.No Impact. Office apps function as usual, but the system is vulnerable to macro-based “droppers.”Use during initial device enrollment before a security baseline is established.
Audit ModeThe rule evaluates actions but does not block them. It creates an event log for every violation.Visibility Only. Users experience no change. IT Admins see “would-be blocks” in the Defender for Endpoint portal.Critical Step: Use for 30 days to identify if legacy business tools or Excel add-ins will break.
BlockThe rule is actively enforced. Any attempt to create an executable file is instantly terminated.High Security. It stops malware in its tracks. However, it may block legitimate but poorly coded business plugins.Production Standard: Use after Audit results show no legitimate app interference for your users.
WarnThe user receives a prompt asking if they trust the action before it is allowed to proceed.User-Led Security. Puts the decision in the user’s hands. Can lead to “click-fatigue” where users click “Allow” by habit.Use for “Power Users” or developers who occasionally need to run advanced scripts but need a reminder.
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Table.1
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.5
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.5

Scope Tags

With scope tags, you create a restriction to the visibility of the How to Block Office Applications from Creating Executable Content. It helps to organise resources as well. Here, I would like to skip this section, because it is not mandatory. Click on the Next button.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.6
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.6

Assignments Tab for Selecting Group

To assign the policy to specific groups, you can use the Assignment Tab. Here I click, +Add groups option under Included groups. I choose a group from the list of groups and click on the Select button. Again, I click on the Select button to continue.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.7
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.7

Review + Create Tab

Before completing the policy creation, you can review each tab to avoid misconfiguration or policy failure. After verifying all the details, click on the Create Button. After creating the policy, you will get a success message.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.8
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.8

Monitoring Status

The Monitoring Status page shows whether the policy has succeeded or not. To quickly configure the policy and take advantage of the policy sync the assigned device on Company Portal. Open the Intune Portal. Go to Devices > Configuration > Search for the Policy. Here, the policy shows as successful.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.9
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.9

Event Viewer Details

Event Viewer helps you check the client side and verify the policy status. Open the Client device and open the Event Viewer. Go to Start > Event Viewer. Navigate to Logs: In the left pane, go to Application and Services Logs > Microsoft >  Windows > Windows Defender > Operational.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.10
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.10

Removing the Assigned Group from How to Block Office Applications from Creating Executable Content in Microsoft Defender

If you want to remove the Assigned group from the policy, it is possible from the Intune Portal. To do this, open the Policy on Intune Portal and edit the Assignments tab and the Remove Policy.

To get more detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.11
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.11

How to Delete How to Block Office Applications from Creating Executable Content in Microsoft Defender

You can easily delete the Policy from the Intune Portal. From the Configuration section, you can delete the policy. It will completely remove it from the client devices.

For detailed information, you can refer to our previous post – How to Delete Allow Clipboard History Policy in Intune Step by Step Guide.

How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune - Fig.12
How to Block Office Applications from Creating Executable Content in Microsoft Defender using Intune – Fig.12

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community  and the WhatsApp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Author

Anoop C Nair is a Workplace Technology solution architect with 25+ years of experience. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He is a blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune,   Windows, and   Cloud PC. He writes about technologies like Intune, SCCM,  Windows, Cloud PC, Entra, and Microsoft Security.

Leave a Comment