Block macros from running in Office files from the internet
This per-user policy value controls whether Microsoft Visio can run VBA macros in files that Windows or Office identifies as originating from the internet.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\visio\security\blockcontentexecutionfrominternet
This per-user policy value controls whether Microsoft Visio can run VBA macros in files that Windows or Office identifies as originating from the internet. When blocking is enforced, Visio does not execute the affected macros. A less restrictive Trust Center setting, including the general option to enable all macros, does not override the policy.
Internet origin is usually determined through Mark of the Web (MOTW). Windows applies this mark to files obtained from untrusted sources, such as certain browser downloads and email attachments associated with the Internet or Restricted Sites zone. Files on network shares can also be affected when Windows does not classify the location as Local intranet or Trusted sites. The registry value does not mark files itself; it determines how Visio responds when an internet origin has been identified.
This is a Visio-specific setting. Policies with the same display name for other Office applications use separate application-specific registry values.
Notes
Security
VBA macros from untrusted sources can be used to execute malicious code and deploy malware or ransomware. Blocking them prevents users from directly starting such code from an affected Visio file. Visio displays a security-risk notification instead of offering an immediate Enable Content action.
The setting neither removes macros from a document nor analyzes their code. It prevents execution only when the applicable origin and trust conditions are met.
Possible side effects
Legitimate Visio files obtained through browser downloads, email attachments, or network shares classified as untrusted cannot run their VBA functionality. This can disrupt automation, custom commands, and document-event processing implemented by the file's VBA project.
Notes
Trusted Locations are evaluated before the policy block and can allow a file to open with its macros enabled regardless of its original source. Digitally signed macros can likewise run when the matching certificate is installed as a Trusted Publisher on the device.
An absent or unconfigured policy value does not necessarily mean that internet macros are allowed in current Office releases. Microsoft introduced default blocking for these macros in supported Windows versions of Visio and other Office applications. If the policy is explicitly disabled, other macro policies and Trust Center settings determine the resulting behavior.
Microsoft documentation
Microsoft Learn: Macros from the internet are blocked by default in Office
Microsoft Learn: Document.MacrosEnabled property (Visio)