Block macros from running in Office files from the internet
This per-user Excel policy blocks VBA macros in files that Windows or Office identifies as originating from the internet.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\excel\security\blockcontentexecutionfrominternet
This per-user Excel policy blocks VBA macros in files that Windows or Office identifies as originating from the internet. Typical examples include downloaded files and email attachments carrying Mark of the Web (MOTW). Files on network shares can also be affected when the location is classified in the Internet zone and is not recognized as trusted.
The value uses the REG_DWORD type. A value of 1 enables the policy and enforces the block even when Enable all macros is selected in Trust Center. Excel notifies the user that macros were blocked but does not provide an immediate Enable Content option.
A value of 0 disables this policy. Macro execution is then governed by the Trust Center macro settings and any other applicable security policies. An absent value means Not Configured and is not equivalent to 0 in every Office version: recent Microsoft 365 Apps releases block macros from the internet by default even when this policy is not configured.
Notes
Security
The policy reduces the risk of malicious VBA macros running from downloaded workbooks or email attachments. Attackers commonly use such macros in phishing campaigns and to deliver malware or ransomware.
This block is not a general assessment that a file is safe or unsafe. It is based on the file’s origin classification and prevents macro execution through this particular control. It does not automatically neutralize other active content or vulnerabilities.
Files in Trusted Locations and macros validly signed by a publisher whose certificate is trusted on the device can be exempt from the block. The resulting protection therefore also depends on how those trust relationships are managed.
Possible side effects
Legitimate Excel workbooks, templates, or automated business processes obtained from locations classified as untrusted can lose their macro-dependent functionality. Internal files can also be affected when a network share or website is not recognized as part of the Local intranet or Trusted sites zone.
Notes
The policy applies per user and only to Excel. Other Office applications provide separate settings backed by their own registry values.
Handling of documents that were previously marked as trusted depends on the Office version. Microsoft documents that perpetual releases such as Office LTSC 2021 and Office 2019 evaluate existing Trusted Document status before policy processing. In the current Microsoft 365 Apps flow, an enforced policy block is evaluated before documents trusted under the earlier behavior.
Microsoft documentation
Microsoft Learn: Macros from the internet are blocked by default in Office
Microsoft Download Center: Administrative Template files for Microsoft Office