Enabling ActiveX Settings for Office Apps via Intune
You can control ActiveX behavior in Office apps (Word, Excel, PowerPoint, Outlook) by deploying an Administrative Templates profile in Intune. This lets you enforce ActiveX settings centrally without touching each PC.
1. Download and Add Office ADMX in Intune
- Download the latest Office ADMX/ADML files from Microsoft Download Center.
- In the Endpoint Manager admin center, go to Devices > Configuration profiles > Create profile.
- Choose:
- Platform: Windows 10 and later
- Profile type: Templates > Administrative Templates
- Under Configuration settings, click Add and then Import ADMX file. Upload the Office ADMX and its corresponding language ADML files.
2. Configure ActiveX Settings
Once the ADMX templates are loaded, you’ll see all Office policy settings. The key settings are under each app’s “Security Settings” node:
- For Word, Excel, and PowerPoint:
- Path: Microsoft Office 2016 (Machine)$$App Name]\Security Settings\ActiveX Controls and Plug-ins
- Policies to configure:
– Disable all ActiveX without prompt (Enable or Disable)
– Allow ActiveX Controls and Plug-ins (Enable)
- For Outlook:
- Path: Microsoft Outlook 2016 (Machine)\Security Settings\ActiveX Controls and Plug-ins
- Policies: same as above.
Adjust each policy to Enabled or Disabled based on your security stance. For example, to block ActiveX without prompts, enable Disable all ActiveX without prompt.
3. Assign the Profile
- Under Assignments, select the device groups or all devices you want this policy to apply to.
- Review and Create the profile.
Your devices will sync and apply the new ActiveX settings during the next policy refresh (typically within 90 minutes).
By using an Administrative Templates profile with Office ADMX, you gain granular control over ActiveX in every Office application. No scripts or manual registry edits needed—just a single profile in Intune.
