VSTO Runtime

The VSTO runtime needs to be installed on the computer for a VSTO solution to run.
The VSTO runtime does not get installed automatically with Office 365, Office 2021, Office 2019 or Office 2016.
For Office 2013 and Office 2010 the runtime was installed automatically if .NET Framework 3.5 was already installed.
For Office 2007 it always needed to be installed separately (afterwards).
You will probably have to install a newer version of the runtime if you want to use the latest version of the .NET Framework.
The runtime consists of two components:
Office Solution Loader - These components are DLLs that Office uses to load the runtime and your solution. This includes the following files: VSTOEE.dll, VSTOLoader.dll.
Office Extensions for .NET Framework - These components are managed assemblies that provide a communication layer between the solution and the Office application.

VSTO Runtime Versions

Full Trust

For a VSTO solution to run it must have full trust permissions.
There is only one way to trust an office solution and not display the trust prompt to the user.
Sign with an authorised certificate and add this publisher to the Trusted Publisher List

Trusting Office Solutions

VSTO does not use the Office macro security settings.
There are a number of different ways this can be done

What checks are made before a VSTO solutions will run ?

Application Level
1) VSTO runtime checks if the solution requests full trust in the deployment manifest
2) VSTO runtime checks to make sure the certificate is not in the Untrusted Publisher list
3) VSTO runtime checks to see if the certificate is in the Trusted Publisher list. If so this is sufficient.
4) VSTO runtime checks to make sure the deployment manifest is not in the IE restricted zone.

Document Level
1) Microsoft Office checks if the document is in the trusted locations list.
2) VSTO runtime checks if the solution requests full trust in the deployment manifest
3) VSTO runtime checks to make sure the certificate is not in the Untrusted Publisher list
4) VSTO runtime checks to see if the certificate is in the Trusted Publisher list. If so this is sufficient.
5) VSTO runtime checks to make sure the deployment manifest is not in the IE restricted zone.

When you add a folder as a trusted location, this grants full trust not to VSTO solutions but also to VBA and ActiveX code.

If you are happy to display the trust prompt you can sign with a trust certificate.
The ClickOnce Trust Prompt must be enabled

signtool.exe ??

VSTO requires full trust because they interact with Office using COM Interop and because the Office object model was designed for full trust only.
Full trust is automatically granted on your development machine when you build the project. The evidence used is based on the location of the assembly.
When you deploy your solution you need to grant full trust by using a strong name or by using a digital signature to sign the assembly.
You can grant full trust to a customisation by using a certificate or by relying on the Trust Prompt.

The user will still see a trust prompt but at least it tells them that the publisher has been verified
This is also known as the ClickOnce trust prompt
This is the Microsoft Office Customization Installer dialog box

Trust Assembly - Using Installer (.msi)

These are permitted to run from the Internet because they require user interaction, ie the user needs to acknowledge and confirm that they want the installer to run.
This is very similar to it running automatically except the need to write the policy modification code as part of an Installer class.
The System.Configuration.Install.Installer class is the base class for custom installers.

Development Machine

By default the full path of the assembly (including the assembly name) is added to the .NET framework security policy.
It is added at the User level and is given full trust.
Any referenced assemblies in your project output folder also receive full trust when the project is built.
This automatic full trust option can be changed at a project level
Select the project node and in the properties window change the Trust Assemblies Location.

Office Trusted Locations

The Office trusted folder list is accessed from the Office icon (top right hand corner) | Excel Options | Trust Center | Trust Center Settings button | Trusted Locations tab.
We made a conscious decision not to add the folder to the Office trusted folder list (a) because administrators may not want this behaviour since it trusts a location rather than a document and (b) the document may not be in the same place as setup. For example, you may publish the customization to a UNC share but store the document in a SharePoint library.

VSTO Runtime (v4)

If you are targetting .NET Framework 4.0 and using the 2010 Tools for Office Runtime then inclusion lists are not supported. In this case you can deploy your solution to the Program Files directory which automatically has full trust anyway as it requires admin rights.
You can still use inclusion lists for Office 2007 and Office 2010 solution but you must target .NET Framework 3.5 and reference the Microsoft.VisualStudio.Tools.Office.Runtime.v10.0 assembly

VSTO Runtime (v3)

A key difference between VSTO Runtime 3.0 and VSTO Runtime 2.0 is that the security model changed
VSTO 3.0 no longer relies on CAS for security but instead introduces inclusion list security.
Inclusion Lists

VSTO Runtime (v2)

Code Access Security

Authenticode Certificates ?

If you plan on distributing to a wide public audience it might be worth considering getting an official authenticode certificate from a certifying authority
Both application manifest and deployment manifest must be signed with a certificate
This can be done using the mage.exe utility

Testing Certificates ?

These types of certificates are really designed to "get you started" and are more than suitable for intranet deployment
VSTO will automatically create a temporary certificate when a certificate does not already exist.
SS of it added to a project
A temporary certificate is created automatically every time you build the solution.
All vsto deployment manifests must be signed with a certificate
A testing certificate is also known as a temporary certificate or a self-cert certificate
When you create a VSTO project (application level or document level) a temporary certificate is created for you and automatically added to your project
This certificate has the same name of the project with "_TemporaryKey.pfx" appended to it
In a new project this certificate is setup automatically to sign the deployment manifest
This certificate is valid for one year
If your project is more than a year old then you will need to create a new certificate in order to contnue building the project.

Design Time Adaptor

Design Time Adaptor for Excel
Needed for document-level
Needed for Ribbon designer

Visual Studio 2022 - 2017

Visual Studio Tools for Office Design-Time Adaptor for Excel

C:\Program Files (x86)\Microsoft Visual Studio\Shared\ 
Visual Studio Tools for Office\x64\VSTOExcelAdaptor.dll 

Visual Studio 2015

Visual Studio Tools for Office Design-Time Adaptor for Excel

C:\Program Files\Microsoft Visual Studio 14.0\ 
Visual Studio Tools for Office\x64\VSTOExcelAdaptor.dll 

Visual Studio 2013

Visual Studio Tools for Office Design-Time Adaptor for Excel

C:\Program Files\Microsoft Visual Studio 12.0\ 
Visual Studio Tools for Office\x64\VSTOExcelAdaptor.dll 

Visual Studio 2012

Visual Studio Tools for Office Design-Time Adaptor for Excel

C:\Program Files\Microsoft Visual Studio 11.0\ 
Visual Studio Tools for Office\x86\VSTOExcelAdaptor.dll 

Visual Studio 2010

Visual Studio Tools for Office Design-Time Adaptor for Excel

C:\Program Files\Microsoft Visual Studio 10.0\ 
Visual Studio Tools for Office\x86\VSTOExcelAdaptor.dll 

Office Solution Loader

This actually contains two loaders a runtime loader and a soluton loader.

Runtime Loader - (VSTOEE.dll) This runs first to check that the correct version of the VSTO runtime is installed and loaded for the version of Office that is loading the add-in or document level solution.
VSTOEE stands for Visual Studio Tools for Office Execution Engine.
Although multiple versions of the VSTO runtime can be installed on the same computer, only one instance of the VSTOEE.dll is used.

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ VSTOEE.dll 
C:\Program Files\Common Files\Microsoft Shared\VSTO\ VSTOEE.dll 

Solution Loader - (VSTOLoader.dll) This loads the actual solution after checking that the solution assembly is installed and loading correctly.
This creates a new application domain for the solution. It also performs the necessary security checks to verify that the solution has permission as well as loading the corresponding Office Extensions for .NET Framework that is also required.
It implements the IDTExtensibility2 interface which is a COM interface that all Office add-ins must implement.
It also implements the IManagedAddin interface which was introduced in Office 2007.

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\ VSTOLoader.dll 
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\ VSTOLoader.dll 

Application Level Loading

Document Level Loading

Other Assemblies

IManagedAddin

This interface was introduced in Office 2007.
Any assembly that loads a managed add-in must implement this interface
This interface was designed specifically to work alongside the VSTO runtime.

In theory because this is an interface you could use itto create your own add-in loader instead of using the VSTOLoader.dll and VSTO Runtime
The CLSID for the DLL that contains this interface however is the same as the one used by VSTOLoader.dll
This basically means that deploying your own add-in loader would break any existing VSTO add-ins

2010 VSTO Runtime v4

Also referred to as Visual Studio 2010 VSTO Runtime
Works with .NET Framework 4.0, 4.5, 4.6, 4.7, 4.8
Microsoft Office 365, 2021, 2019, 2016, 2013 or 2010
This version needs to be included as a dependency (and installed if necessary) with any add-ins that use VSTO.
vstor_redist.exe

Specific Versions

link - learn.microsoft.com/en-us/visualstudio/vsto/visual-studio-tools-for-office-runtime?view=vs-2022 

2008 VSTO Runtime v3

Also referred to as Visual Studio 2008 VSTO Runtime.
Works with .NET Framework 3.5
Microsoft Office 2007 or 2003
vstor30.exe
These are the office extension dlls when targetting .NET 3.5

2005 VSTO Runtime v2

Also referred to as Visual Studio 2005 SE VSTO Runtime
Microsoft Office 2003