Office Macro Blocking Guide: Blocking Internet Macros Without Breaking Work

Most organisations know they should block Office macros from the internet, but stall because nobody knows which business processes still depend on macros and what will break. Microsoft now blocks macros in internet files by default on current Microsoft 365 Apps for Windows, yet that default is only as good as the policies, exceptions and file paths around it, and it does not cover perpetual Office, Mac or Microsoft 365 Apps for business policy control. This guide is the rollout companion to the Macro Malware Guide: it covers discovering macro dependencies, segmenting users, sequencing the policies, designing exceptions that do not reopen the hole, verifying what is actually enforced, and handling the helpdesk calls. It is for endpoint and Microsoft 365 administrators, security architects and the service desk leads who will field the tickets.

Key takeaways

• Set the internet block explicitly, everywhere. "Block macros from running in Office files from the Internet" set to Enabled for every app is protected regardless of version default; Not Configured relies on the client being new enough, and Disabled brings back the Enable content button.
• Most breakage is a path problem, not a macro problem. Files on shares reached by IP address, sites outside the Trusted sites zone and templates fetched from the web pick up the block; fixing the zone or the storage location fixes the ticket.
• Segment users by real need. The NCSC position is that disabling macros entirely is the only fully effective control, so give "Disable all without notification" to everyone who does not need macros and trusted-publisher-only to the rest.
• Every exception bypasses the block for whatever lands there. Trusted Locations, trusted publishers and Trusted sites entries must be few, write-protected, owned and reviewed, and AMSI should still scan them.
• Verify the effective setting on devices. Policy precedence, competing GPOs, Cloud Policy and Intune profiles and unmanaged clients mean the setting you deployed is not always the setting in force.

What the block actually does, and where it does not apply

Microsoft documents the decision Office makes when a user opens a file containing VBA macros that carries Mark of the Web (MOTW). Understanding the order explains most of the behaviour users report.

1. If the file is in a Trusted Location, macros are enabled.
2. If the macros are signed and the publisher's certificate is in Trusted Publishers, macros are enabled.
3. Policies are evaluated: a policy that blocks macros blocks them, a policy that enables them enables them. Not Configured falls through.
4. If the user had previously selected Enable content on that file before the change, it is a Trusted Document and macros run. On perpetual Office 2019 and LTSC 2021 this check happens before policy evaluation.
5. Otherwise macros are blocked and a Security Risk banner with a Learn More button appears. There is no Enable content button.

MOTW is only written for the Internet (ZoneId 3) and Restricted sites (ZoneId 4) zones, only on NTFS, and not on FAT32 media. Files opened through OneDrive or SharePoint "Open in Desktop App", the OneDrive sync client or synced known folders do not receive MOTW, so the internet block does not apply to them at all. The Macro Malware Guide covers how attackers use containers and other formats to avoid MOTW; this guide focuses on legitimate files.

Step one: find out who really uses macros

The NCSC recommends enabling macros only for the staff who rely on them daily, and for larger organisations only for the specific groups or teams that need them. That requires evidence, not a survey alone.

• Ask the owners: finance, actuarial, engineering, procurement and reporting teams are typical macro users. Record each workbook or template, where it lives, who maintains it, and whether it arrives from outside (supplier templates, regulator returns, bank files).
• Scan file stores: inventory macro-enabled extensions (.docm, .xlsm, .xlsb, .pptm, .dotm, .xltm, .xlam, .ppam) and legacy binary formats (.doc, .xls, .ppt) that may contain VBA projects, on file servers, SharePoint libraries and template folders. Recent modified dates and many distinct users suggest live dependency.
• Read existing exceptions: export current Trusted Locations, trusted publisher certificates and Site to Zone Assignment List entries from GPOs, Intune profiles and Cloud Policy. Each one is either a dependency to document or a hole to close.
• Use a pilot as the sensor: enforce the block for a pilot ring of a few hundred users across departments for two to four weeks and log every ticket by file path and source. Combine with ASR rules in Audit mode, whose event 1122 entries show macros that would have been stopped.
• Check add-ins and line-of-business integrations: some third-party add-ins and ERP exports rely on macros or XLM. The NCSC advises testing macros and third-party add-ins before wide rollout.

Out of this comes a macro register: each approved macro, its owner, location, signing status and retirement date. The NCSC treats macros as a legacy feature and recommends replacing them with Power Automate, Office Scripts, Power Query or newer Excel functions such as XLOOKUP and LAMBDA, so the register doubles as the retirement backlog.

Step two: choose a policy set per population

Policies sit per application under User Configuration\Policies\Administrative Templates\Microsoft <App> 2016\<App> Options\Security\Trust Center (Access uses Application Settings). Deploy through Group Policy with the Office ADMX/ADML files, Intune (Settings catalog or Administrative Templates) or Cloud Policy at config.office.com, which also reaches devices that are not domain joined.

• Why set the block for macro users too: legitimate business macros rarely need to arrive straight from the internet. Leaving it Enabled for every population means a partner file goes through a checked path instead of a user's judgement.
• "Disable all with notification" is not a control: Microsoft rates it partially protected, and the NCSC says not to rely on prompts that ask the user to click a button. Not configuring the setting leaves users able to change it in the Trust Center, with that value as default.
• XLM caveat: Microsoft documents that "Prevent Excel from running XLM macros" breaks Solver and the Analysis ToolPak. For teams that need them, clear "Enable Excel 4.0 macros when VBA macros are enabled" in Macro Notification Settings instead, which blocks XLM in untrusted workbooks.
• Baseline alignment: the Microsoft 365 Apps security baseline (Security Compliance Toolkit, published twice a year) includes the internet block, and groups unsigned-macro blocking in a "Require Macro Signing - User" GPO that you can apply or hold back as a set.

See the Group Policy Security Guide and the Microsoft Intune Guide for deployment mechanics.

Step three: design exceptions that do not reopen the hole

Each exception type bypasses the internet block in a different way. Pick the narrowest one that solves the business case.

Common legitimate cases and their fixes

• Share accessed by IP address: Microsoft notes macros are blocked unless the share is in Trusted sites or Local intranet. Use the server name and add it to Trusted sites through the Site to Zone Assignment List (Windows Components\Internet Explorer\Internet Control Panel\Security Page), clearing "Require server verification (https:)" for that zone if needed.
• Your own SharePoint and OneDrive downloaded via browser: add https://<tenant>.sharepoint.com and https://<tenant>-my.sharepoint.com to Trusted sites, remembering that this lets anyone who can upload to the tenant plant macros. See the SharePoint and OneDrive Security Guide.
• Macro-enabled templates (.dotm, .potm, .xltm): store them in a Trusted Location or sign them and trust the publisher; for network-hosted templates Microsoft recommends signing.
• Excel add-ins (.xlam, .xla): trusting the publisher does not work for Excel add-ins carrying MOTW (behaviour since MS16-088); remove MOTW after verification or deploy them to a Trusted Location. PowerPoint add-ins accept a trusted publisher signature.
• Supplier or regulator workbooks: receive them into a checked intake (sandbox detonation or manual review), then re-host the approved version internally, rather than teaching users to unblock email attachments.

Signing is the exception that scales best, but the signing key becomes a skeleton key for macro execution. See the Code Signing Security Guide.

Step four: roll out in rings and keep a rollback

1. Prepare (weeks 1 to 2): publish the macro register, fix zone assignments for known shares, sign or relocate approved macros, brief the service desk with a script and an unblock verification process.
2. Pilot ring (weeks 3 to 6): IT, security and a sample of each department. Enable the internet block, set notification settings by population, block XLM, and enable the Office ASR rules in Audit mode. Track every ticket by path and fix the cause, not the user.
3. Broad ring 1: all users without macro need. These policies rarely cause tickets once paths are fixed. Move Office ASR rules to Block for this group after reviewing audit events.
4. Broad ring 2: macro-using teams, after their macros are signed or relocated and their owners have tested.
5. Close legacy gaps: upgrade perpetual clients, bring Mac clients under MDM preferences, and remove unmanaged Office installs.
6. Rollback: if a critical process breaks, add a scoped exception (zone entry, Trusted Location or a group excluded from the XLM policy) for that team, with an expiry date. Do not set the internet block to Disabled tenant-wide: Microsoft advises against leaving it Disabled, and it reinstates the Enable content prompt for everyone.

Small vs large organisations: a small business with Microsoft 365 Apps for enterprise and no macro dependency can apply the "no macro need" column to everyone in a single change through Cloud Policy or Intune after a one-week pilot. A large estate needs the register, a signing service, a few owned Trusted Locations, rings mapped to departments and a documented exception workflow with expiry. On Microsoft 365 Apps for business, where the block policies are unavailable, the default block, current update channels and ASR rules carry more of the weight.

Verifying what is actually enforced

Deployed is not enforced. Competing GPOs, user-scoped versus device-scoped targeting, Cloud Policy overlap and devices outside management all produce gaps.

• Read the policy keys on devices: policy values land under HKCU\Software\Policies\Microsoft\Office\16.0\<app>\Security. Collect blockcontentexecutionfrominternet (1 = block) and vbawarnings (4 = disable without notification, 3 = signed only, 2 = with notification, 1 = enable all) per app through your management or inventory tooling.
• Check Trusted Locations and publishers: report every Trusted Location path and every certificate in the Trusted Publishers store across the estate, and alert on new ones not set by policy.
• Test with a benign file: keep a harmless macro-enabled test document with ZoneId 3 and confirm the Security Risk banner appears on a sample of devices per ring, version and channel.
• Watch update channels: devices stuck on old builds do not have the default, so report Office version and channel alongside the policy state.
• Monitor the safety net: ASR events 1121 (block) and 1122 (audit) in Microsoft-Windows-Windows Defender/Operational, and Office processes spawning script hosts. See the Endpoint Telemetry Guide.

Metrics that show it is working without breaking work

Where identity fits

A trusted publisher certificate is a machine credential that can make any macro run across the estate, and the people and services allowed to sign with it are privileged. Keep the key in an HSM or managed signing service, approve each signing request against the macro register, log every signature and rotate on staff changes. Trusted Locations on shares are only as safe as the accounts with write access to them, so review those permissions, including service accounts used by sync or deployment tools.

Framework mapping

Common failure patterns

• Relying on Not Configured. The default protects only clients new enough to have it; old channels, perpetual installs and anyone who once set the policy to Disabled are exposed.
• Trusting the whole intranet zone. Adding broad ranges or wildcard domains to Trusted sites or Local intranet to stop tickets silently exempts every share and site in them.
• Writable Trusted Locations on shares. A network folder that many users can write to becomes a place where malware on one machine plants macros that run unchallenged elsewhere.
• Teaching users to unblock. A service desk script that tells callers to tick Unblock turns the control back into a prompt, which is the behaviour the block was designed to remove.
• Blocking XLM without testing Solver. Analysts lose Solver and the Analysis ToolPak, and the resulting pressure gets the whole policy rolled back.
• Forgetting Mac and business editions. Mac users and Microsoft 365 Apps for business tenants sit outside the policy set and need their own controls.

Practitioner checklist

• Set "Block macros from running in Office files from the Internet" to Enabled for every Office app through one authoritative channel (Group Policy, Intune or Cloud Policy).
• Build a macro register with owner, location, signing status and retirement date before enforcing for macro users.
• Apply "Disable all without notification" to every user without a documented macro need.
• Block XLM, or clear "Enable Excel 4.0 macros when VBA macros are enabled" for teams that need Solver.
• Fix zone assignments for internal shares by name, and keep Trusted sites entries narrow and write-controlled.
• Sign approved macros with a centrally deployed certificate and stop users adding trusted publishers.
• Give the service desk a verification process for Unblock requests and an intake route for partner files.
• Pilot in rings with Office ASR rules in Audit, then move to Block.
• Report effective policy values, Trusted Locations and Office channel from devices monthly.
• Plan macro retirement towards Power Automate, Office Scripts and Power Query.

Standards and references

• Microsoft Learn: Macros from the internet are blocked by default in Office
• NCSC: Macro security for Microsoft Office
• Microsoft Learn: Security baseline for Microsoft 365 Apps for enterprise
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Support: Solver in Excel for Windows may not work properly with a certain security policy enabled
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• MITRE ATT&CK: Command and Scripting Interpreter: Visual Basic (T1059.005)

Related NHI Mgmt Group resources: Macro Malware Guide · Windows Endpoint Hardening Guide · Malicious Office Add-ins Guide · Microsoft 365 Security Guide · Steganography in Attacks Guide