How a rollout goes, and what it looks like on a device

Three things go out to every device, in this order: your organisation’s root certificate into Trusted Root Certification Authorities, its signing certificate into Trusted Publishers, and then the macro policy. Each goes to a pilot group first: IT plus one team that lives in macro-heavy spreadsheets. While the trust is landing, the macros that team relies on are signed and the signed copies put back where people open them.

The policy comes in two versions for two groups of users: everyone gets “Disable all macros without notification”; the users with a recorded business requirement get “Disable all macros except digitally signed macros”. The rollout bundle you download from the dashboard carries all of it with your names filled in: the two certificates, importable Intune policies for both groups, the scripts that put the signing certificate into Trusted Publishers, the Group Policy fallback, and a verification script that prints, from any device, the effective setting per application and the two certificate stores, and for a given file who signed it and whether the device trusts them.

What you keep for an assessor: screenshots of the Trust Center’s Macro Settings and Trusted Publishers pages from a device in each group, the verification script’s output with the device name and date, the approval record behind the approved-user group, the signing certificate’s thumbprint and expiry, and the signing record from the dashboard.