Microsoft’s Custom Functions for Excel Preview Adds AI & ‘Service-Connected Code’ Capability

Microsoft provided an update during this week’s Build Conference event 2018 for developers related to custom functions for Excel & related capabilities.

The custom functions for Excel feature lets businesses write their own additions to Excel’s formula catalog using JavaScript. When written, they become available to end users within the formula catalog, similar to other functions. The feature presently sync with Excel Online, as well as Excel for Mac and Windows. Office 365 subscribers who are part of the Office Insiders Program can now try out a preview of custom functions for Excel.

Custom functions for Excel also can work with Azure Machine Learning services for forecasting & trends using artificial intelligence (AI) capabilities. However, while the Azure Machine Learning services capability was described at the Microsoft Ignite event back in September, the preview is still yet to come.

Developers also will be getting Power BI Custom Visuals, which will be arriving in preview “soon.” Custom Visuals can be extended using “standard open source technologies like JavaScript and D3.” Once created, Custom Visuals will work the same both in Power BI and Excel. They will get housed in Microsoft Store, as Office add-ins. They can be invoked by end users from Excel’s “Insert Chart” dialog process.

The last bit of Build news about Excel is that Microsoft Flow, Microsoft’s workflow automation solution, is getting integrated with the spreadsheet program. The Flow integration will show up as an Office Store add-in initially, but Microsoft plans to make it an “in-the-box component later in 2018.” When Flow is integrated with Excel, end users will be able to port data across Microsoft applications. Here’s how the announcement described that capability:

Via Flow, users will be able to send data from their spreadsheets hosted in SharePoint and OneDrive for Business to a wide range of services such as Teams, Dynamics 365, Visual Studio Online, Twitter, etc.

Custom Functions, AI and Service Connections
At Build on Tuesday, Yina Arenas, principal program manager for Microsoft Graph, described the overall vision for custom functions for Excel.

She demonstrated a custom function that connects to a company’s internal services, but she said it also can be designed to connect to the Web. According to Microsoft’s announcement, custom functions for Excel can calculate operations, “bring information from the Web” and “stream live data.”

Security Implications
So far, custom functions for Excel are at the preview stage and aren’t supposed to be used in production environments. However, some companies focused on security are already raising red flags about their use.

With Microsoft’s added support for JavaScript in Excel, a new attack vector has also been added for malicious actors. “By being able to insert malicious JavaScript into a file, cyber criminals will be able to make external connections to download malware, ultimately leading to further damage to servers and end systems. Security professionals need to understand this new risk and should use network traffic analytics to verify the connections that users are making on the network. Ideally, IT professionals will disable the JavaScript functionality entirely from the product.”

Plixer makes a network traffic analysis system that’s designed to provide information about cloud applications and security events, so Jett’s emphasis on having traffic analytics in place is understandable. Microsoft hasn’t really described the security associated with custom functions for Excel in great depth. However, Jett offered a few objections.

He noted that “because the functionality allows custom JSON inputs, there isn’t much limit (at least at this point) to what malicious actors can do.” Moreover, “the functionality does provide remote access,” which could include activities like “connecting to external sites, downloading external content, or uploading stolen content.”

Organizations should weigh the risks of using custom functions for Excel, he added.

“In this case, the risks are tremendous,” Jett said. “For risk-averse organizations, the feature should not be allowed.”

Microsoft has yet to describe the security aspects of custom functions for Excel. They will be Office add-ins, but it’s not clear if they’ll get vetted for security by Microsoft within the Office Store, for instance. Nonetheless, the custom functions for Excel feature can be disabled as add-ins.

“Add-ins (which is how these custom functions will be shipped) can be disabled across the board, or you can pick certain sources/catalogs to disable through Group Policy: see the templates under Security Settings > Trust Center > Trusted Catalogs,” explained Michael Sanders of Microsoft in the comments section of Microsoft’s “Create Custom Functions in Excel (Preview)” document.

Kalyan Banga

226 entries

27 comments

Profile Status

ACTIVE

Profile Info