Why does Office block macros in files from the internet?

For years, a malicious Word or Excel attachment only needed one click on Enable Content to run its code. Microsoft changed that in 2022: Office on Windows now blocks VBA macros in files that came from the internet. This guide explains what changed, what users see, why attackers moved to other file types, and how admins can let trusted macros through without undoing the protection.

What did Microsoft change?

Microsoft announced the change on the Microsoft 365 Blog on February 7, 2022: "VBA macros obtained from the internet will now be blocked by default." Users "will no longer be able to enable content with a click of a button".

The reason was simple. Microsoft's admin documentation says "VBA macros are a common way for malicious actors to gain access to deploy malware and ransomware." In the announcement, Office security engineering added that malicious code usually arrives in a document that "originates from the internet (email attachment, link, internet download, etc.)."

When did it take effect?

The rollout wasn't smooth. Microsoft paused it on July 8, 2022 "following user feedback", then said on July 20, 2022: "We're resuming the rollout of this change in Current Channel." According to Microsoft Learn, the change reached Access, Excel, PowerPoint, Visio and Word on these dates:

Publisher followed on February 14, 2023, and Project on August 13, 2024.

Which apps and platforms are covered?

The change "only affects Office on devices running Windows" and the apps Access, Excel, PowerPoint, Project, Publisher, Visio and Word. Microsoft says it "doesn't affect Office on a Mac, Office on Android or iOS devices, or Office on the web."

The version table covers Microsoft 365 Apps update channels. The 2022 announcement said Microsoft planned to bring the change to Office LTSC, Office 2021, Office 2019, Office 2016 and Office 2013 "at a future date to be determined". If you still run a perpetual version, test how it behaves rather than assuming it matches Microsoft 365 Apps.

What does the SECURITY RISK banner mean?

When someone opens a macro-enabled file from the internet, Office shows a SECURITY RISK message bar. Microsoft's support article gives its warning text: "Microsoft has blocked macros from running because the source of the file is untrusted." There's a Learn More button but no Enable Content button.

That's the key difference from the old SECURITY WARNING bar, which let users run the macros with one click. Microsoft's advice to users is blunt: "If a downloaded file from the internet or a file opened from a network share wants you to allow macros, and you're not certain what those macros do, you should probably just delete that file."

If an administrator has restricted macros, users may see a different message instead: "Your administrator has restricted the use of macros in your organization."

What is Mark of the Web?

Mark of the Web (MOTW) is how Office knows a file came from the internet. Windows adds it to files from untrusted locations, "such as the internet or Restricted Zone", for example browser downloads and email attachments. It's stored as a hidden Zone.Identifier stream on the file, with a ZoneId value:

Microsoft notes two limits. MOTW "only applies to files saved on an NTFS file system, not files saved to FAT32 formatted devices." And it depends on the tool that saved the file setting it in the first place.

How Office decides whether to run a macro

Microsoft Learn describes the order of checks for a file with MOTW:

1. Is the file in a Trusted Location? If so, macros run.
2. Are the macros digitally signed by a publisher the device trusts? If so, they run.
3. Does a policy block or allow macros? If so, the policy wins.
4. Did the user enable this file's content before the change, making it a Trusted Document? If so, macros run.
5. Otherwise, macros are blocked and the SECURITY RISK banner appears.

The order matters. Trusted Locations and trusted publishers are checked first, so they bypass the internet block entirely.

Why did attackers move to other file types?

Because the old trick stopped working. The block depends on Mark of the Web, so attackers looked for file types that don't carry it through to the file the user finally opens, such as archive and disk-image containers, or that aren't Office documents at all, such as Windows shortcut (LNK) files. Microsoft's Q1 2026 email threat report says threat actors still "commonly use ZIP files to circumvent Mark of the Web (MOTW) protections."

OneNote files were another detour. Microsoft later added a OneNote block on embedded files with dangerous extensions, starting with Version 2304 in 2023.

The bigger shift was away from malware attachments altogether. In the same Q1 2026 report, Microsoft says "Traditional malware delivery continued its long-term decline, representing just 5–6% of payloads by the end of the quarter", while credential phishing dominated. HTML attachments were the leading file type in January 2026 at 37% of payloads. Our guide to dangerous email attachment types covers what to block and quarantine now, and HTML attachment phishing explains the most common replacement.

What should users do when a macro is blocked?

1. Ask whether you expected the file. If it's an unexpected invoice, order or "secure document", don't try to unblock it. Report it.
2. Check with the sender by phone if it's from someone you know. Their mailbox may be compromised, so don't reply to the email to ask.
3. Look at what you need. Many files open and read fine without their macros. If you only need to read it, you're done.
4. Ask IT before unblocking anything from outside the company. A legitimate business process can be set up to work safely.

To unblock a file you truly trust, Microsoft's method is to right-click it, choose Properties, and select Unblock on the General tab. Admins can do the same with the PowerShell Unblock-File cmdlet. Both remove MOTW from that one file.

How do admins manage the macro block?

Policies

Microsoft recommends enabling Block macros from running in Office files from the Internet as part of the security baseline for Microsoft 365 Apps for enterprise. There's a separate policy per app, under the app's Trust Center settings in User Configuration. Before the default change, this policy was the only way to get the block. Now Not Configured behaves the same as Enabled, but setting it explicitly protects you if defaults ever shift.

For users who need macros at all, Microsoft's baseline is the VBA Macro Notification Settings policy set to "Disable all except digitally signed macros" with "Require macros to be signed by a trusted publisher". For users who don't need macros, Microsoft says to choose "Disable all without notification."

You can deploy these with Cloud Policy in the Microsoft 365 Apps admin center, Microsoft Intune or Group Policy.

One catch for small businesses: Microsoft says "You can only use policies if you're using Microsoft 365 Apps for enterprise. Policies aren't available for Microsoft 365 Apps for business." On business plans, users get the default block and manage exceptions file by file.

Safer ways to allow trusted macros

Trusted Locations: use with care

A Trusted Location skips the MOTW check. Microsoft Learn: "Saving files from the internet to a Trusted Location on a user's device ignores the check for Mark of the Web and opens with VBA macros enabled." That's convenient, and it's also an obvious target. Avoid these mistakes:

• Making the Downloads folder or Desktop a Trusted Location. Every attachment a user saves would then run its macros.
• Trusting network locations. Microsoft says network locations can be Trusted Locations, "but it's not recommended."
• Adding a SharePoint site everyone can write to as a Trusted site. It isn't a Trusted Location, but it has a similar effect. Microsoft warns that "Anyone with permissions to add files to SharePoint could add files with active content, such as macros."
• Letting users add their own. Manage Trusted Locations and trusted publishers centrally, and review them.

Do you still need to filter macro attachments?

Yes. The Office block is a strong last line, but it has gaps. It's Windows-only, it depends on MOTW being present, users can still remove MOTW, and older or unmanaged installs may behave differently. The CISA, NSA, FBI and MS-ISAC phishing guidance recommends "Block macros by default" and asks vendors to "Include mechanisms that block macros by default with email products."

A gateway rule stops the file before anyone has to make a decision. iBlockSpam includes a Microsoft Office macro filter among its attachment-type filters, and held messages go to each user's quarantine with digest emails, where an admin can release a genuine file after checking it.

Next steps

• Confirm the default block is in place: open a test macro file downloaded from the internet on a managed Windows PC and look for the SECURITY RISK banner.
• If you have Microsoft 365 Apps for enterprise, set Block macros from running in Office files from the Internet to Enabled explicitly.
• Audit Trusted Locations and trusted publishers. Remove anything that covers Downloads, Desktop or a broadly writable share.
• Block or quarantine macro-enabled attachments at the gateway, and review your rules for ZIP, ISO, LNK and HTML files too.
• Read how to spot a phishing email and share the "don't unblock unexpected files" rule with staff.