Block or log if user run any vba macro in office

Question

Hello, 
 Is it possible to log or block if user tries to run any vba macro in office applications? 
 Regards.

GlennSen · Answer

Thank you for reaching out to the community forum. By default, this action is already set to block, so wherever a user tries to run a VBA macro on their devices, our Intercept X will immediately block this via lockdown exploit detection, provided that you did not add any exclusion for lockdown exploit on your threat policy for VBA Macros. Once detection has been triggered, the user/s who runs this will be registered on the central dashboard and the device used to run. To further explain about lockdown exploits, you may refer to this KBA. https://support.sophos.com/support/s/article/KB-000039176?language=en_US