Why does Microsoft's helloWorld add-in example trigger 20 macro warning message boxes during a native compare operation? - ms-word

Question

Follow this code example causes problems with MSWord's native document compare functionality when group policy has disabled macros:
https://learn.microsoft.com/en-us/office/dev/add-ins/design/using-office-ui-fabric-react
Why is MSWord identifying a basic office.js add-in as a macro? There are no macros in this helloWorld example code? Security conscious clients will not wish to lower their security policy in-order to use the document compare function. Is there another way to suppress these annoying message boxes, as asking the end-user to click [OK] twenty times on every document compare action is an awful user experience.
Note: The macros settings in the Trust Center do nothing to prevent these message boxes from showing when the group policy is in-place. Its not entirely clear what group policy setting is causing this, but I suspect its setting "Block macros from running in Office files from the Internet".
What is not clear is why the Wikipedia add-in from the app source store does not interfere with the document compare whereas the helloWorld example above does. There must be a way of trusting office.js add-ins to suppress this warning without having to compromise the corporate security strategy?
Environment:
Microsoft Word for Office 365 MSO (16.0.12527.20612) 32 bit
Windows 10 Enterprise, Version 1809
Visual Studio Code version 1.48
Node.js v12.14.1
Repo steps:
Follow the article detailed above for the helloWorld example
Apply a strict macro policy via Group Policy Management (exact policy setting is unknown. I am trying to acquire this from our IT Support to precisely identify which setting is triggering these macro warnings - and 'no' its not the trust center macro settings, as this settings do nothing to reveal/suppress this macro warning)
With MSWord open (irrespective of whether the helloWorld add-in is loaded in the sidebar or not, its mere association to MSWord is enough) attempt to do a document compare operation from the [Review] tab.
Removing the corporate security Group Policy from my laptop fixes the problem. Re-instating the group policy re-creates the problem. It's just not clear which setting in this policy is causing the problem. HOWEVER the Wikipedia add-in from the app source store is somehow trusted regardless of this Group Policy. As a minimum requirement, we need to provide clients with details of what the security constraint/setting is. Ideally, I'd like to know what it is that the wikipedia add-in has done to become trusted in such a way that those warnings are suppress irrespective of the Group Policy setting
Update
Adding the SSL certificates for the add-in to the Trusted Publishers store made no difference.
I tried a number of other apps found in the app source store with mixed results:
AppName (Publisher) : Results
Wikipedia (Microsoft) : Compare works correctly
Pickit (www.pickit.com) : Compare interrupted by 20 macro warning message boxes
ScriptLab (Microsoft) : Compare interrupted by 20 macro warning message boxes
Microsoft Dynamics (Microsoft) : Compare works correctly
The publishing location nor the publisher seems to influence the outcome of the compare functionality
Update
Here is an export of the group policy that relates to MSWord macros:
Interesting Update
It would appear that there is a unexpected interaction between the Group Policy details above, the document compare operation AND the ExtensionPoint xml element in the manifest.xml file. If I remove the extensionPoint element then the macro warning no longer shows during the document compare operation. However, removing this element means that we no longer have an icon to load the application with - forcing the end-user to re-add the add-in for every document, which isn't really a solution. See manifest.xml file below:
<?xml version="1.0" encoding="UTF-8"?>
<OfficeApp
xmlns="http://schemas.microsoft.com/office/appforoffice/1.1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0"
xmlns:ov="http://schemas.microsoft.com/office/taskpaneappversionoverrides"
xsi:type="TaskPaneApp">
<!-- Begin Basic Settings: Add-in metadata, used for all versions of Office unless override provided. -->
<!-- IMPORTANT! Id must be unique for your add-in, if you reuse this manifest ensure that you change this id to a new GUID. -->
<Id>69de862e-09ee-4ec4-85a4-f230fa10cbc0</Id>
<!--Version. Updates from the store only get triggered if there is a version change. -->
<Version>1.0.0.0</Version>
<ProviderName>CompanyX AddIn</ProviderName>
<DefaultLocale>en-US</DefaultLocale>
<!-- The display name of your add-in. Used on the store and various places of the Office UI such as the add-ins dialog. -->
<DisplayName DefaultValue="CompanyX AddIn" />
<Description DefaultValue="CompanyX AddIn for Office 365" />
<!-- Icon for your add-in. Used on installation screens and the add-ins dialog. -->
<IconUrl DefaultValue="https://companyX.com/images/ds_AddIn_80.png" />
<HighResolutionIconUrl DefaultValue="https://companyX.com/images/ds_AddIn_80.png"/>
<!--If you plan to submit this add-in to the Office Store, uncomment the SupportUrl element below-->
<SupportUrl DefaultValue="https://companyX.com/support.html" />
<!--End Basic Settings. -->
<!--Begin TaskPane Mode integration. This section is used if there are no VersionOverrides or if the Office client version does not support add-in commands. -->
<Hosts>
<Host Name="Document" />
</Hosts>
<DefaultSettings>
<SourceLocation DefaultValue="https://companyX.com/index.html" />
</DefaultSettings>
<!-- End TaskPane Mode integration. -->
<Permissions>ReadWriteDocument</Permissions>
<VersionOverrides xmlns="http://schemas.microsoft.com/office/taskpaneappversionoverrides" xsi:type="VersionOverridesV1_0">
<!-- The Hosts node is required. -->
<Hosts>
<!-- Each host can have a different set of commands. -->
<!-- Excel host is Workbook, Word host is Document, and PowerPoint host is Presentation. -->
<!-- Make sure the hosts you override match the hosts declared in the top section of the manifest. -->
<Host xsi:type="Document">
<!-- Form factor. Currently only DesktopFormFactor is supported. -->
<DesktopFormFactor>
<!--"This code enables a customizable message to be displayed when the add-in is loaded successfully upon individual install."-->
<GetStarted>
<!-- Title of the Getting Started callout. resid points to a ShortString resource -->
<Title resid="CompanyX.GetStarted.Title"/>
<!-- Description of the Getting Started callout. resid points to a LongString resource -->
<Description resid="CompanyX.GetStarted.Description"/>
<!-- Point to a url resource which details how the add-in should be used. -->
<LearnMoreUrl resid="CompanyX.GetStarted.LearnMoreUrl"/>
</GetStarted>
<!-- Function file is a HTML page that includes the JavaScript where functions for ExecuteAction will be called.
Think of the FunctionFile as the code behind ExecuteFunction. -->
<FunctionFile resid="CompanyX.DesktopFunctionFile.Url" />
<!-- PrimaryCommandSurface is the main Office Ribbon. -->
<ExtensionPoint xsi:type="PrimaryCommandSurface">
<!-- Use OfficeTab to extend an existing Tab. Use CustomTab to create a new tab. -->
<OfficeTab id="TabHome">
<!-- Ensure you provide a unique id for the group. Recommendation for any IDs is to namespace using your company name. -->
<Group id="CompanyX.Group1">
<!-- Label for your group. resid must point to a ShortString resource. -->
<Label resid="CompanyX.Group1Label" />
<!-- Icons. Required sizes 16,32,80, optional 20, 24, 40, 48, 64. Strongly recommended to provide all sizes for great UX. -->
<!-- Use PNG icons. All URLs on the resources section must use HTTPS. -->
<Icon>
<bt:Image size="16" resid="CompanyX.tpicon_16x16" />
<bt:Image size="32" resid="CompanyX.tpicon_32x32" />
<bt:Image size="80" resid="CompanyX.tpicon_80x80" />
</Icon>
<!-- Control. It can be of type "Button" or "Menu". -->
<Control xsi:type="Button" id="CompanyX.TaskpaneButton">
<Label resid="CompanyX.TaskpaneButton.Label" />
<Supertip>
<!-- ToolTip title. resid must point to a ShortString resource. -->
<Title resid="CompanyX.TaskpaneButton.Label" />
<!-- ToolTip description. resid must point to a LongString resource. -->
<Description resid="CompanyX.TaskpaneButton.Tooltip" />
</Supertip>
<Icon>
<bt:Image size="16" resid="CompanyX.tpicon_16x16" />
<bt:Image size="32" resid="CompanyX.tpicon_32x32" />
<bt:Image size="80" resid="CompanyX.tpicon_80x80" />
</Icon>
<!-- This is what happens when the command is triggered (E.g. click on the Ribbon). Supported actions are ExecuteFunction or ShowTaskpane. -->
<Action xsi:type="ShowTaskpane">
<TaskpaneId>ButtonId1</TaskpaneId>
<!-- Provide a url resource id for the location that will be displayed on the task pane. -->
<SourceLocation resid="CompanyX.Taskpane.Url" />
</Action>
</Control>
</Group>
</OfficeTab>
</ExtensionPoint>
</DesktopFormFactor>
</Host>
</Hosts>
<!-- You can use resources across hosts and form factors. -->
<Resources>
<bt:Images>
<bt:Image id="CompanyX.tpicon_16x16" DefaultValue="https://companyX.com/images/ds_AddIn_16.png" />
<bt:Image id="CompanyX.tpicon_32x32" DefaultValue="https://companyX.com/images/ds_AddIn_32.png" />
<bt:Image id="CompanyX.tpicon_80x80" DefaultValue="https://companyX.com/images/ds_AddIn_80.png" />
</bt:Images>
<bt:Urls>
<bt:Url id="CompanyX.Taskpane.Url" DefaultValue="https://companyX.com/index.html" />
<bt:Url id="CompanyX.GetStarted.LearnMoreUrl" DefaultValue="https://go.microsoft.com/fwlink/?LinkId=276812" />
<bt:Url id="CompanyX.DesktopFunctionFile.Url" DefaultValue="https://companyX.com/function-file/function-file.html" />
</bt:Urls>
<!-- ShortStrings max characters==125. -->
<bt:ShortStrings>
<bt:String id="CompanyX.TaskpaneButton.Label" DefaultValue="CompanyX AddIn" />
<bt:String id="CompanyX.Group1Label" DefaultValue="Contract Review" />
<bt:String id="CompanyX.GetStarted.Title" DefaultValue="CompanyX AddIn for Office 365." />
</bt:ShortStrings>
<!-- LongStrings max characters==250. -->
<bt:LongStrings>
<bt:String id="CompanyX.TaskpaneButton.Tooltip" DefaultValue="Start CompanyX AddIn" />
<bt:String id="CompanyX.GetStarted.Description" DefaultValue="CompanyX AddIn add-in loaded successfully. Go to the HOME tab and click the 'CompanyX AddIn' button to get started." />
</bt:LongStrings>
</Resources>
</VersionOverrides>
<!-- End Add-in Commands Mode integration. -->
</OfficeApp>

Answer 1

After evaluating numerous add-ins downloaded from the app store (from various different publishers, including Microsoft) it is clear that the problem is related to the ribbon.
Add-ins that do not use the ribbon do not present the macro warning. Add-ins that do use the ribbon (custom or home ribbon) that use the security Group Policy setup above are deluged with macro warnings during the document compare operation.
Clients will of-course be unwilling to reduce their security setup to suppress this series of warning message boxes. Therefore the only solution is to alter the add-in's manifest.xml so that it does not use the ribbon.