Helping users stay safe: Blocking internet macros by default in Office

Published Feb 07 2022 09:07 AM 96.6K Views
Microsoft

It’s a challenging time in software security; migration to the modern cloud, the largest number of remote workers ever, and a global pandemic impacting staffing and supply chains all contribute to changes in organizations. Unfortunately, these changes also give bad actors opportunities to exploit organizations:

 

“Cybercriminals are targeting and attacking all sectors of critical infrastructure, including healthcare and public health, information technology (IT), financial services, and energy sectors. Ransomware attacks are increasingly successful, crippling governments and businesses, and the profits from these attacks are soaring.”

- Microsoft Digital Defense Report, Oct 2021

 

For years Microsoft Office has shipped powerful automation capabilities called active content, the most common kind are macros. While we provided a notification bar to warn users about these macros, users could still decide to enable the macros by clicking a button. Bad actors send macros in Office files to end users who unknowingly enable them, malicious payloads are delivered, and the impact can be severe including malware, compromised identity, data loss, and remote access. See more in this blog post.

 

"A wide range of threat actors continue to target our customers by sending documents and luring them into enabling malicious macro code.  Usually, the malicious code is part of a document that originates from the internet (email attachment, link, internet download, etc.).  Once enabled, the malicious code gains access to the identity, documents, and network of the person who enabled it."

- Tom Gallagher, Partner Group Engineering Manager, Office Security

 

For the protection of our customers, we need to make it more difficult to enable macros in files obtained from the internet.

 

Changing Default Behavior


We’re introducing a default change for five Office apps that run macros:

 

VBA macros obtained from the internet will now be blocked by default.

 

For macros in files obtained from the internet, users will no longer be able to enable content with a click of a button. A message bar will appear for users notifying them with a button to learn more. The default is more secure and is expected to keep more users safe including home users and information workers in managed organizations.

 

"We will continue to adjust our user experience for macros, as we’ve done here, to make it more difficult to trick users into running malicious code via social engineering while maintaining a path for legitimate macros to be enabled where appropriate via Trusted Publishers and/or Trusted Locations.”

- Tristan Davis, Partner Group Program Manager, Office Platform

 

This change only affects Office on devices running Windows and only affects the following applications: Access, Excel, PowerPoint, Visio, and Word. The change will begin rolling out in Version 2203, starting with Current Channel (Preview) in early April 2022. Later, the change will be available in the other update channels, such as Current Channel, Monthly Enterprise Channel, and Semi-Annual Enterprise Channel.

 

At a future date to be determined, we also plan to make this change to Office LTSC, Office 2021, Office 2019, Office 2016, and Office 2013.

 

End User Experience


Once a user opens an attachment or downloads from the internet an untrusted Office file containing macros, a message bar displays a Security Risk that the file contains Visual Basic for Applications (VBA) macros obtained from the internet with a Learn More button.

 

A message bar displays a Security Risk showing blocked VBA macros from the internetA message bar displays a Security Risk showing blocked VBA macros from the internet

 

The Learn More button goes to an article for end users and information workers that contains information about the security risk of bad actors using macros, safe practices to prevent phishing & malware, and instructions on how to enable these macros by saving the file and removing the Mark of the Web (MOTW).

 

What is Mark of the Web (MOTW)?


The MOTW is an attribute added to files by Windows when it is sourced from an untrusted location (Internet or Restricted Zone). The files must be saved to a NTFS file system, the MOTW is not added to files on FAT32 formatted devices.

 

IT Administrator Options


This chart shows the evaluation flow for Office files with VBA macros and MOTW:

Evaluation flow for Office files with VBA macros and MOTWEvaluation flow for Office files with VBA macros and MOTW


Organizations can use the “Block macros from running in Office files from the Internet” policy to prevent users from inadvertently opening files from the internet that contain macros. Microsoft recommends enabling this policy, and if you do enable it, your organization won’t be affected by this default change.

 

“Setting policy is a powerful tool for IT Admins to protect their organizations. For years we’ve recommended blocking macros obtained from the internet in our security baselines, and many customers have done so. I’m pleased Microsoft is taking the next step to securing everyone with this policy by default!”

- Hani Saliba, Partner Director of Engineering, Office Calc

 

Additionally, there are two other options to know your files are safe:

  • Opening files from a Trusted Location
  • Opening files with digitally signed macros and providing the certificate to the user, who then installs it as a Trusted Publisher on their local machine


To learn more about how to get ready for this change and recommendations for managing VBA macros in Office files, read this article for Office admins.

 

Thank you,

Office Product Group
VBA Team & Office Security Team

 

More helpful information on the threats of Ransomware:

 

Continue the conversation by joining us in the Microsoft 365 Tech Community! Whether you have product questions or just want to stay informed with the latest updates on new releases, tools, and blogs, Microsoft 365 Tech Community is your go-to resource to stay connected!

51 Comments
%3CLINGO-SUB%20id%3D%22lingo-sub-3071805%22%20slang%3D%22en-US%22%3EHelping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3071805%22%20slang%3D%22en-US%22%3E%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3EIt%E2%80%99s%20a%20challenging%20time%20in%20software%20security%3B%20migration%20to%20the%20modern%20cloud%2C%20the%20largest%20number%20of%20remote%20workers%20ever%2C%20and%20a%20global%20pandemic%20impacting%20staffing%20and%20supply%20chains%20all%20contribute%20to%20changes%20in%20organizations.%20Unfortunately%2C%20these%20changes%20also%20give%20bad%20actors%20opportunities%20to%20exploit%20organizations%3A%3C%2FP%3E%0A%3CP%20style%3D%22%20padding-left%20%3A%2030px%3B%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20style%3D%22width%3A%2088%25%3B%20border%3A%201px%20solid%20black%3B%20margin-left%3A%20auto%3B%20margin-right%3A%20auto%3B%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22100%25%22%20height%3D%22112px%22%3E%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CFONT%20color%3D%22%23000000%22%3E%3CEM%3E%E2%80%9CCybercriminals%20are%20targeting%20and%20attacking%20all%20sectors%20of%20critical%20infrastructure%2C%20including%20healthcare%20and%20public%20health%2C%20information%20technology%20(IT)%2C%20financial%20services%2C%20and%20energy%20sectors.%20Ransomware%20attacks%20are%20increasingly%20successful%2C%20crippling%20governments%20and%20businesses%2C%20and%20the%20profits%20from%20these%20attacks%20are%20soaring.%E2%80%9D%20%3C%2FEM%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20padding-left%20%3A%2030px%3B%20%22%3E%3CFONT%20color%3D%22%23800080%22%3E-%20%3C%2FFONT%3E%3CA%20href%3D%22https%3A%2F%2Fquery.prod.cms.rt.microsoft.com%2Fcms%2Fapi%2Fam%2Fbinary%2FRWMFIi%23page%3D1%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EMicrosoft%20Digital%20Defense%20Report%3C%2FA%3E%2C%20Oct%202021%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%20style%3D%22%20padding-left%20%3A%2030px%3B%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3EFor%20years%20Microsoft%20Office%20has%20shipped%20powerful%20automation%20capabilities%20called%20active%20content%2C%20the%20most%20common%20kind%20are%20macros.%20While%20we%20provided%20a%20notification%20bar%20to%20warn%20users%20about%20these%20macros%2C%20users%20could%20still%20decide%20to%20enable%20the%20macros%20by%20clicking%20a%20button.%20Bad%20actors%20send%20macros%20in%20Office%20files%20to%20end%20users%20who%20unknowingly%20enable%20them%2C%20malicious%20payloads%20are%20delivered%2C%20and%20the%20impact%20can%20be%20severe%20including%20malware%2C%20compromised%20identity%2C%20data%20loss%2C%20and%20remote%20access.%20See%20more%20in%20%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2016%2F03%2F22%2Fnew-feature-in-office-2016-can-block-macros-and-help-prevent-infection%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ethis%20blog%20post%3C%2FA%3E.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20style%3D%22width%3A%2088%25%3B%20border%3A%201px%20solid%20black%3B%20margin-left%3A%20auto%3B%20margin-right%3A%20auto%3B%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22100%25%22%3E%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CFONT%20color%3D%22%23000000%22%3E%3CEM%3E%22A%20wide%20range%20of%20threat%20actors%20continue%20to%20target%20our%20customers%20by%20sending%20documents%20and%20luring%20them%20into%20enabling%20malicious%20macro%20code.%26nbsp%3B%20Usually%2C%20the%20malicious%20code%20is%20part%20of%20a%20document%20that%20originates%20from%20the%20internet%20(email%20attachment%2C%20link%2C%20internet%20download%2C%20etc.).%26nbsp%3B%20Once%20enabled%2C%20the%20malicious%20code%20gains%20access%20to%20the%20identity%2C%20documents%2C%20and%20network%20of%20the%20person%20who%20enabled%20it.%22%3C%2FEM%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20padding-left%20%3A%2030px%3B%20%22%3E%3CFONT%20color%3D%22%23000000%22%3E-%20Tom%20Gallagher%2C%20Partner%20Group%20Engineering%20Manager%2C%20Office%20Security%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3EFor%20the%20protection%20of%20our%20customers%2C%20we%20need%20to%20make%20it%20more%20difficult%20to%20enable%20macros%20in%20files%20obtained%20from%20the%20internet.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20style%3D%22%20text-align%20%3A%20left%3B%20%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%20id%3D%22toc-hId-338403225%22%3E%3CSTRONG%3EChanging%20Default%20Behavior%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CBR%20%2F%3EWe%E2%80%99re%20introducing%20a%20default%20change%20for%20five%20Office%20apps%20that%20run%20macros%3A%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%3A%20center%3B%20%22%3E%3CSTRONG%3EVBA%20macros%20obtained%20from%20the%20internet%20will%20now%20be%20blocked%20by%20default.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3EFor%20macros%20in%20files%20obtained%20from%20the%20internet%2C%20users%20will%20no%20longer%20be%20able%20to%20enable%20content%20with%20a%20click%20of%20a%20button.%20A%20message%20bar%20will%20appear%20for%20users%20notifying%20them%20with%20a%20button%20to%20learn%20more.%20The%20default%20is%20more%20secure%20and%20is%20expected%20to%20keep%20more%20users%20safe%20including%20home%20users%20and%20information%20workers%20in%20managed%20organizations.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20style%3D%22width%3A%2088%25%3B%20border%3A%201px%20solid%20black%3B%20margin-left%3A%20auto%3B%20margin-right%3A%20auto%3B%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22100%25%22%3E%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CFONT%20color%3D%22%23000000%22%3E%3CEM%3E%22We%20will%20continue%20to%20adjust%20our%20user%20experience%20for%20macros%2C%20as%20we%E2%80%99ve%20done%20here%2C%20to%20make%20it%20more%20difficult%20to%20trick%20users%20into%20running%20malicious%20code%20via%20social%20engineering%20while%20maintaining%20a%20path%20for%20legitimate%20macros%20to%20be%20enabled%20where%20appropriate%20via%20Trusted%20Publishers%20and%2For%20Trusted%20Locations.%E2%80%9D%3C%2FEM%3E%20%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20padding-left%20%3A%2030px%3B%20%22%3E%3CFONT%20color%3D%22%23000000%22%3E-%20Tristan%20Davis%2C%20Partner%20Group%20Program%20Manager%2C%20Office%20Platform%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3EThis%20change%20only%20affects%20Office%20on%20devices%20running%20Windows%20and%20only%20affects%20the%20following%20applications%3A%20Access%2C%20Excel%2C%20PowerPoint%2C%20Visio%2C%20and%20Word.%20The%20change%20will%20begin%20rolling%20out%20in%20Version%202203%2C%20starting%20with%20Current%20Channel%20(Preview)%20in%20early%20April%202022.%20Later%2C%20the%20change%20will%20be%20available%20in%20the%20other%20update%20channels%2C%20such%20as%20Current%20Channel%2C%20Monthly%20Enterprise%20Channel%2C%20and%20Semi-Annual%20Enterprise%20Channel.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3EAt%20a%20future%20date%20to%20be%20determined%2C%20we%20also%20plan%20to%20make%20this%20change%20to%20Office%20LTSC%2C%20Office%202021%2C%20Office%202019%2C%20Office%202016%2C%20and%20Office%202013.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20style%3D%22%20text-align%20%3A%20left%3B%20%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%20id%3D%22toc-hId--1469051238%22%3E%3CSTRONG%3EEnd%20User%20Experience%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3E%3CBR%20%2F%3EOnce%20a%20user%20opens%20an%20attachment%20or%20downloads%20from%20the%20internet%20an%20untrusted%20Office%20file%20containing%20macros%2C%20a%20message%20bar%20displays%20a%20Security%20Risk%20that%20the%20file%20contains%20Visual%20Basic%20for%20Applications%20(VBA)%20macros%20obtained%20from%20the%20internet%20with%20a%20%3CSTRONG%3ELearn%20More%3C%2FSTRONG%3E%20button.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20style%3D%22width%3A%20774px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20style%3D%22width%3A%20774px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20style%3D%22width%3A%20774px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20style%3D%22width%3A%20774px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20style%3D%22width%3A%20774px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20style%3D%22width%3A%20774px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F342371i5535164A2FB05196%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22VBAMacrosBlockedTrustBar.png%22%20alt%3D%22A%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%22%20%2F%3E%3Cspan%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EA%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%3C%2Fspan%3E%3C%2Fspan%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EA%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EA%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EA%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EA%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EA%20message%20bar%20displays%20a%20Security%20Risk%20showing%20blocked%20VBA%20macros%20from%20the%20internet%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3EThe%3CSTRONG%3E%20Learn%20More%3C%2FSTRONG%3E%20button%20goes%20to%20%3CA%20href%3D%22https%3A%2F%2Fgo.microsoft.com%2Ffwlink%2F%3Flinkid%3D2185272%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ean%20article%20for%20end%20users%20and%20information%20workers%3C%2FA%3E%20that%20contains%20information%20about%20the%20security%20risk%20of%20bad%20actors%20using%20macros%2C%20safe%20practices%20to%20prevent%20phishing%20%26amp%3B%20malware%2C%20and%20instructions%20on%20how%20to%20enable%20these%20macros%20by%20saving%20the%20file%20and%20removing%20the%20Mark%20of%20the%20Web%20(MOTW).%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20style%3D%22%20text-align%20%3A%20left%3B%20%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%20id%3D%22toc-hId-1018461595%22%3E%3CSTRONG%3EWhat%20is%20Mark%20of%20the%20Web%20(MOTW)%3F%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3E%3CBR%20%2F%3EThe%20MOTW%20is%20an%20attribute%20added%20to%20files%20by%20Windows%20when%20it%20is%20sourced%20from%20an%20untrusted%20location%20(Internet%20or%20Restricted%20Zone).%20The%20files%20must%20be%20saved%20to%20a%20NTFS%20file%20system%2C%20the%20MOTW%20is%20not%20added%20to%20files%20on%20FAT32%20formatted%20devices.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20style%3D%22%20text-align%20%3A%20left%3B%20%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%20id%3D%22toc-hId-1709023069%22%3E%3CSTRONG%3EIT%20A%3C%2FSTRONG%3E%3CSTRONG%3Edministrator%20Options%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CBR%20%2F%3EThis%20chart%20shows%20the%20evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20style%3D%22width%3A%20999px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20style%3D%22width%3A%20999px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20style%3D%22width%3A%20999px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20style%3D%22width%3A%20999px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20style%3D%22width%3A%20999px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20style%3D%22width%3A%20999px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F342776i5D9AB520C0DDF0F1%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22VBAMacrosTrustWorkflow-GreyContainer.png%22%20alt%3D%22Evaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%22%20%2F%3E%3Cspan%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEvaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3C%2Fspan%3E%3C%2Fspan%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEvaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEvaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEvaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEvaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEvaluation%20flow%20for%20Office%20files%20with%20VBA%20macros%20and%20MOTW%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3E%3CBR%20%2F%3EOrganizations%20can%20use%20the%20%E2%80%9CBlock%20macros%20from%20running%20in%20Office%20files%20from%20the%20Internet%E2%80%9D%20policy%20to%20prevent%20users%20from%20inadvertently%20opening%20files%20from%20the%20internet%20that%20contain%20macros.%20%3CSTRONG%3EMicrosoft%20recommends%20enabling%20this%20policy%2C%20and%20if%20you%20do%20enable%20it%2C%20your%20organization%20won%E2%80%99t%20be%20affected%20by%20this%20default%20change.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20style%3D%22width%3A%2088%25%3B%20border%3A%201px%20solid%20black%3B%20margin-left%3A%20auto%3B%20margin-right%3A%20auto%3B%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22100%25%22%3E%3CP%3E%3CFONT%20color%3D%22%23000000%22%3E%3CEM%3E%E2%80%9CSetting%20policy%20is%20a%20powerful%20tool%20for%20IT%20Admins%20to%20protect%20their%20organizations.%20For%20years%20we%E2%80%99ve%20recommended%20blocking%20macros%20obtained%20from%20the%20internet%20in%20our%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-security-baselines%2Fbg-p%2FMicrosoft-Security-Baselines%22%20target%3D%22_blank%22%3Esecurity%20baselines%3C%2FA%3E%2C%20and%20many%20customers%20have%20done%20so.%20I%E2%80%99m%20pleased%20Microsoft%20is%20taking%20the%20next%20step%20to%20securing%20everyone%20with%20this%20policy%20by%20default!%E2%80%9D%20%3C%2FEM%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%20style%3D%22%20padding-left%20%3A%2030px%3B%20%22%3E%3CFONT%20color%3D%22%23000000%22%3E%3CEM%3E-%3C%2FEM%3E%20Hani%20Saliba%2C%20Partner%20Director%20of%20Engineering%2C%20Office%20Calc%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3EAdditionally%2C%20there%20are%20two%20other%20options%20to%20know%20your%20files%20are%20safe%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3EOpening%20files%20from%20a%20Trusted%20Location%3C%2FLI%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3EOpening%20files%20with%20digitally%20signed%20macros%20and%20providing%20the%20certificate%20to%20the%20user%2C%20who%20then%20installs%20it%20as%20a%20Trusted%20Publisher%20on%20their%20local%20machine%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20justify%3B%20%22%3E%3CBR%20%2F%3ETo%20learn%20more%20about%20how%20to%20get%20ready%20for%20this%20change%20and%20recommendations%20for%20managing%20VBA%20macros%20in%20Office%20files%2C%20%3CA%20href%3D%22https%3A%2F%2Fgo.microsoft.com%2Ffwlink%2Fp%2F%3Flinkid%3D2185771%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eread%20this%20article%20for%20Office%20admins%3C%2FA%3E.%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3EThank%20you%2C%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3EOffice%20Product%20Group%3CBR%20%2F%3EVBA%20Team%26nbsp%3B%26amp%3B%20Office%20Security%20Team%3C%2FP%3E%0A%3CP%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20style%3D%22%20text-align%20%3A%20left%3B%20%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%20id%3D%22toc-hId-1698519965%22%3E%3CSTRONG%3EMore%20helpful%20information%20on%20the%20threats%20of%20Ransomware%3A%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CUL%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.microsoft.com%2Fon-the-issues%2F2021%2F07%2F20%2Fthe-growing-threat-of-ransomware%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EThe%20growing%20threat%20of%20ransomware%3C%2FA%3E%2C%20Microsoft%20%22On%20the%20Issues%22%20blog%20post%20on%20July%2020%2C%202021%3C%2FLI%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsecurity%2Fcompass%2Fprotect-against-ransomware%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ERapidly%20protect%20against%20ransomware%20and%20extortion%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fbusiness%2Fmicrosoft-digital-defense-report%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E2021%20Microsoft%20Digital%20Defense%20Report%3C%2FA%3E%26nbsp%3B(see%20pages%2010-19)%3C%2FLI%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender%2Fthreat-analytics%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ELearn%20about%20threat%20analytics%20in%20Microsoft%20365%20Defender%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsecurity%2Fcompass%2Fincident-response-playbook-dart-ransomware-approach%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EMicrosoft%E2%80%99s%20DART%20ransomware%20approach%20and%20best%20practices%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%20style%3D%22%20text-align%20%3A%20left%3B%20%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsecurity%2Fcompass%2Fdart-ransomware-case-study%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EMicrosoft%20DART%20ransomware%20case%20study%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EContinue%20the%20conversation%20by%20joining%20us%20in%20the%20%3CA%20href%3D%22https%3A%2F%2Faka.ms%2Fcommunity%2Fmicrosoft365%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EMicrosoft%20365%20Tech%20Community!%3C%2FA%3E%20Whether%20you%20have%20product%20questions%20or%20just%20want%20to%20stay%20informed%20with%20the%20latest%20updates%20on%20new%20releases%2C%20tools%2C%20and%20blogs%2C%20Microsoft%20365%20Tech%20Community%20is%20your%20go-to%20resource%20to%20stay%20connected!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-3071805%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20image-alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20style%3D%22width%3A%20538px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20style%3D%22width%3A%20538px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20style%3D%22width%3A%20538px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20style%3D%22width%3A%20538px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20style%3D%22width%3A%20538px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20style%3D%22width%3A%20538px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F344016i84A89654510E8419%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20alt%3D%22Macros%20Office%20blog%20teaser%20image%20-%20Resized%20538px.png%22%20%2F%3E%3C%2Fspan%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20protect%20our%20customers%2C%20users%20will%20no%20longer%20be%20able%20to%20enable%20macros%20obtained%20from%20the%20internet.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3071805%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20365%20Apps%20for%20enterprise%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3132504%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3132504%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20a%20pity%20you%20didn't%20provide%20the%20option%20to%20disable%20Excel%20V4%20macros%20independently.%20We%20could%20actually%20have%20done%20that.%20Another%20option%20would%20have%20been%20to%20allow%20macros%20to%20be%20whitelisted%20by%20hash%2C%20and%20centrally%20log%20the%20hashes%20of%20macros%20loaded%2Fenabled.%20Organizations%20with%20lots%20of%20macros%20and%20ineffective%20signing%20infrastructure%20remain%20mostly%20out%20of%20luck.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3133014%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3133014%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20John%2C%20%3CBR%20%2F%3EFortunately%2C%20the%20Excel%20team%20has%20already%20separated%20out%20XL4%20macros%20from%20VBA%20macros%2C%20not%20only%20can%20they%20be%20managed%20independently%2C%20but%20we've%20recently%20restricted%20them%20by%20default.%20See%20this%20blog%20post%20for%20more%20information%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexcel-blog%2Fexcel-4-0-xlm-macros-now-restricted-by-default-for-customer%2Fba-p%2F3057905%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexcel-blog%2Fexcel-4-0-xlm-macros-now-restricted-by-default-for-customer%2Fba-p%2F3057905%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3133476%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3133476%22%20slang%3D%22en-US%22%3E%3CP%3EOK%2C%20yay!!!!%20But%2C%20I%20just%20checked%2C%20and%20the%20referenced%20setting%20doesn't%20show%20up%20in%20my%20version%20of%20Excel%2C%20which%20I%20updated%20last%20month...%20I've%20also%20now%20followed%20the%20various%20references%2C%20and%20I%20see%20the%20original%20posting%20from%20July%20last%20year%20(which%20I%20really%20wish%20had%20been%20better%20publicized).%20Is%20there%20perhaps%20some%20GPO%20setting%20that%20prevents%20display%20of%20the%20new%20checkbox%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3133996%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3133996%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F486814%22%20target%3D%22_blank%22%3E%40John_McCash%3C%2FA%3E%26nbsp%3BI%20sent%20you%20a%20private%20message%20so%20we%20can%20sort%20this%20out%20as%20the%20Excel%204.0%20macro%20(XLM)%20setting%20that%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F861804%22%20target%3D%22_blank%22%3E%40Kellie_msft%3C%2FA%3E%26nbsp%3Bmentioned%20is%20generally%20available.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3137038%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3137038%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20concerned%20about%20workbooks%20containing%20VBA%20that%20are%20downloaded%20from%20a%20central%20point%20and%20used%20by%20many%20people%20within%20an%20organization%20suddenly%20stopping%20working.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20shared%20locations%20within%20an%20organization%20are%20considered%20trusted%20locations%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20the%20workbook%20itself%20have%20to%20be%20signed%2C%20or%20just%20the%20VBA%20within%20the%20workbook%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20its%20the%20workbook%20that%20has%20to%20be%20signed%20then%20presumably%20any%20change%20to%20the%20workbook%20means%20it%20has%20to%20be%20signed%20again%3F%20(this%20is%20not%20something%20the%20people%20responsible%20for%20maintaining%20the%20workbook%20will%20know%20how%20to%20do)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3138803%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3138803%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20fastexcel%2C%3C%2FP%3E%0A%3CP%3EPlease%20review%20the%20Admin%20documentation%20and%20the%20policy%20options%20for%20organizations%20to%20manage%20macros%3A%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252FDeployOffice%252Fsecurity%252Finternet-macros-blocked%26amp%3Bdata%3D04%257C01%257CKellie.Eickmeyer%2540microsoft.com%257Cd56c11a70fa146e892e208d9eb2b6b27%257C72f988bf86f141af91ab2d7cd011db47%257C0%257C0%257C637799393981396344%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%26amp%3Bsdata%3DogYtzcFs5Xf0ZODEjXuT%252BKoe1fh1lqzxXU2lQeXarao%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20Trusted%20Locations%20-%20an%20organization%20can%20use%20policy%20to%20choose%20whether%20to%20allow%2Fblock%20Trusted%20Locations%20set%20by%20users%2C%20and%20can%20set%20specific%20Trusted%20Locations%20on%20their%20network.%20Even%20though%20the%20article%20is%20for%20an%20earlier%20version%20of%20Office%2C%20the%20information%20still%20applies%20to%20newer%20versions%20of%20Office%3A%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Fdocs.microsoft.com%252Fdeployoffice%252Fsecurity%252Fdesignate-trusted-locations-for-files-in-office%26amp%3Bdata%3D04%257C01%257CKellie.Eickmeyer%2540microsoft.com%257Cd56c11a70fa146e892e208d9eb2b6b27%257C72f988bf86f141af91ab2d7cd011db47%257C0%257C0%257C637799393981396344%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%26amp%3Bsdata%3DANTxWv%252FRonUXTjp1LI4RLJbiEZeXr7dUorn%252B9lHJVSc%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fdocs.microsoft.com%2Fdeployoffice%2Fsecurity%2Fdesignate-trusted-locations-for-files-in-office%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20digital%20signatures%2C%20only%20the%20VBA%20macro%20project%20needs%20to%20be%20signed.%20Any%20change%20to%20the%20VBA%20macro%20project%20will%20require%20it%20to%20be%20signed%20again%20but%20updating%20content%20in%20the%20file%20does%20not%20(ex.%20adding%20text%20to%20a%20word%20doc%2C%20adding%20numbers%20to%20an%20excel%20spreadsheet).%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3140315%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3140315%22%20slang%3D%22en-US%22%3E%3CP%3EPeople%20can%20create%20macro%20documents%20a%20certain%20way%20that%20make%20interacting%20with%20them%20(by%20means%20of%20ticking%20boxes%20or%20inputting%20data%20in%20fields)%20dynamically%20change%20the%20VBA%20code%20by%20creating%20new%20sheets%20that%20will%20break%20the%20certificate%20signing.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20I'd%20like%20to%20see%20is%20better%20logging%20of%20VBA%20macro%20code%20that%20is%20executed.%20Could%20something%20be%20done%20to%20enable%20logging%20of%20macro%20executions%20within%20EventViewer%3F%20I%20have%20experimented%20with%20Trusted%20Logging%20but%20it's%20a%20little%20primitive%20and%20could%20use%20some%20improvement.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3152974%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3152974%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1301428%22%20target%3D%22_blank%22%3E%40timmytron%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%0A%3CP%3EWhen%20the%20macro%20related%20code%2Freferences%20changed%2C%20the%20signature%20would%20be%20invalid%20and%20needs%20re-sign%2C%20is%20this%20your%20scenario%3F%20Working%20on%20macros%20which%20you%20trusted%20and%20put%20them%20under%20trusted%20location%20could%20be%20good%20behavior.%3C%2FP%3E%0A%3CP%3EAs%20for%26nbsp%3B%3CSPAN%3Elogging%20for%20VBA%2C%26nbsp%3BEvent%20Viewer%20won't%20gather%20user%20content%2C%20so%20it%20shouldn't%20log%20macro%20details.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3152985%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3152985%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1304055%22%20target%3D%22_blank%22%3E%40donlv%3C%2FA%3E%26nbsp%3Byou%20are%20correct%2C%20the%20signature%20becomes%20invalid%20because%20the%20code%20has%20changed.%20This%20is%20all%20triggered%20by%20merely%20using%20the%20spreadsheet%20as%20designed%20(ultimately%20it%20is%20a%20bad%20design%20of%20the%20spreadsheet%20itself%2C%20but%20the%20developer%20would%20have%20never%20originally%20understood%20these%20challenges%20with%20signing%20them).%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20yes%2C%20for%20these%20types%20of%20files%2C%20we%20use%20them%20under%20a%20Trusted%20Location%20instead%20in%20read-only%20format%20for%20all%20users%20to%20prevent%20anyone%20adding%20malicious%20macro%20files%20to%20the%20Trusted%20Location.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWith%20regards%20to%20logging%2C%20it%20was%20merely%20a%20hopeful%20request%20that%20something%20could%20be%20improved%20there%20-%20but%20thank%20you%20for%20the%20explanation%20as%20to%20why%20Event%20Viewer%20would%20not%20be%20suitable.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3153175%22%20slang%3D%22es-ES%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3153175%22%20slang%3D%22es-ES%22%3E%3CP%3EHi!%3C%2FP%3E%3CP%3EWe%20usually%20exchange%20Excel%20files%20with%20macros%20through%20e-mail%20with%20our%20clients.%3C%2FP%3E%3CP%3EWhen%20you%20say%20%22from%20the%20Internet%22%2C%20does%20it%20include%20files%20received%20through%20e-mail%3F%3C%2FP%3E%3CP%3EThanks%20for%20your%20support.%3C%2FP%3E%3CP%3EKind%20regards.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3154429%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3154429%22%20slang%3D%22en-US%22%3E%3CP%3EI%20think%20something%20simple%20like%20adding%20a%20worksheet%20through%20the%20UI%20would%20break%20the%20code%20signature%20because%20an%20empty%20worksheet's%20class%20module%20will%20usually%20contain%20code%20statements%20like%20Option%20Explicit%20(but%20I%20have%20not%20tested%20this).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20probably%20we%20would%20have%20to%3C%2FP%3E%3CP%3E1.%20Train%20people%20who%20receive%20workbooks%20by%20email%20to%20do%20the%20file%20unblocking%20thing%20(assuming%20that%20the%20VBA%20has%20not%20already%20been%20stripped%20out)%3C%2FP%3E%3CP%3E2.%20Get%20IT%20to%20give%20the%20user%20responsible%20for%20maintaining%20the%20workbook%20the%20ability%20to%20save%20it%20to%20a%20trusted%20shareable%20location.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3156147%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3156147%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20files%20with%20macros%20and%20want%20to%20use%20them%20using%20OneDrive%20and%20SharePoint%20365%20(Teams).%20And%20now%20we%20are%20migrating%20files%20to%20Azure%20environment.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWill%20they%20stop%20working%20because%20they%20have%20macros%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3156195%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3156195%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Occasional-Visitor%20lia-component-message-view-widget-author-username%22%3E%3CA%20id%3D%22link_1f73618661c7d2_8_53e0a%22%20class%3D%22lia-link-navigation%20lia-page-link%20lia-user-name-link%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1304201%22%20target%3D%22_self%22%20aria-label%3D%22View%20Profile%20of%20Jesus_Valverde%22%3E%3CSPAN%20class%3D%22%22%3E%3C%2FSPAN%3E%3C%2FA%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1304201%22%20target%3D%22_blank%22%3E%40Jesus_Valverde%3C%2FA%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CP%3EOffice%20apps%20determine%20whether%20a%20file%20is%20from%20the%20internet%20if%20it%20has%20a%20Mark%20of%20the%20Web%20attribute%20in%20the%20file%20properties.%20The%20MOTW%20is%20an%20attribute%20added%20to%20files%20by%20Windows%20when%20it%20is%20sourced%20from%20an%20untrusted%20location%20(Internet%20or%20Restricted%20Zone).%20The%20files%20must%20be%20saved%20to%20a%20NTFS%20file%20system%2C%20the%20MOTW%20is%20not%20added%20to%20files%20on%20FAT32%20formatted%20devices.%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%23mark-of-the-web-motw-and-trusted-documents%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3ELearn%20more%20in%20this%20Admin%20article%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20includes%20files%20sent%20in%20email%20as%20attachments%20on%20Windows%20devices.%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3156203%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3156203%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1304773%22%20target%3D%22_blank%22%3E%40Danilo_Col%3C%2FA%3E%26nbsp%3BMacros%20in%20files%20with%20the%20MOTW%20attribute%20will%20be%20disabled%20by%20default%20but%20can%20be%20enabled%20again%20by%20removing%20MOTW%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%23mark-of-the-web-motw-and-trusted-documents%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3ELearn%20more%20in%20this%20Admin%20article%3C%2FA%3E%3CSPAN%3E.%20However%2C%20if%20OneDrive%20and%20SharePoint%20365%20are%20Trusted%20Locations%20in%20your%20organization%20the%20macros%20will%20continue%20to%20be%20enabled%2C%20since%20files%20your%20organization%20saves%20to%20Trusted%20Locations%20are%20considered%20safe.%20Your%20organization%20has%20tools%20to%20restrict%20or%20allow%20macros%20with%20policy%2C%20Trusted%20Documents%2C%20or%20only%20allowing%20signed%20macros%20with%20Trusted%20Publishers%2C%20please%20see%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EAdmin%20article%20for%20more%20details.%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3208639%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3208639%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20can%20we%20test%20the%20impact%20of%20this%20update%20on%20our%20excel%20files%20with%20macro's%20enabled%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3210356%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3210356%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1316623%22%20target%3D%22_blank%22%3E%40JoeriBruneel%3C%2FA%3E%26nbsp%3BOne%20way%20to%20understand%20the%20impact%20of%20this%20change%20is%20to%20enable%20the%20policies%20%22Block%20macros%20from%20running%20in%20files%20from%20the%20internet.%22%20Enabling%20these%20polices%20for%20Office%20apps%20is%20the%20same%20behavior%20as%20the%20upcoming%20default%20change%3B%20however%2C%20the%20red%20message%20bar%20does%20not%20have%20a%20%5BLearn%20more%5D%20button.%20In%20addition%2C%20if%20you%20implement%20this%20policy%20in%20your%20organization%2C%20the%20default%20change%20will%20have%20no%20effect%20since%20IT%20Admin%20set%20policies%20take%20precedence%20over%20Office%20defaults.%20We%20encourage%20and%20recommend%20doing%20this%2C%20it's%20part%20of%20our%20Microsoft%20365%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-security-baselines%2Fsecurity-baseline-for-microsoft-365-apps-for-enterprise-v2112%2Fba-p%2F3038172%22%20target%3D%22_self%22%3Esecurity%20baseline%20recommendations%3C%2FA%3E.%20More%20information%20in%20the%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%23block-macros-from-running-in-office-files-from-the-internet%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3E%20Admin%20article%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3212209%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3212209%22%20slang%3D%22en-US%22%3E%3CP%3EListen%2C%20taking%20features%20AWAY%20from%20people%20isn't%20IMPROVING%20a%20product....%26nbsp%3B%20just%20because%20you%20can't%20address%20this%20properly%2C%20it%20doesn't%20mean%20you%20should%20turn%20these%20features%20off%20on%20everybody.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3212605%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3212605%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F861804%22%20target%3D%22_blank%22%3E%40Kellie_msft%3C%2FA%3E%26nbsp%3B%3A%20The%20problem%20we%20have%20is%20that%20our%20customers%20download%20our%20pricetool%20(excel%20with%20macro's%20enabled)%20from%20our%20website.%26nbsp%3BThey%20need%20this%20to%20make%20quotes%20to%20the%20end%20customer.%20These%20are%20small%20companies%20(5%20fte)%20with%20no%20IT%20department%20and%20based%20in%20region%20with%20poor%20mobile%20coverage.%3CBR%20%2F%3E%3CBR%20%2F%3EEvery%20quarter%2C%20they%20download%20our%20the%20latest%20version%20from%20our%20website.%20Same%20file%20name.%20Is%20this%20considered%20a%20previous%20trusted%20document%3F%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EWhat%20if%20we%20send%20them%20the%20file%20by%20usb%20stick%3F%20Is%20this%20also%20%22a%20file%20from%20the%20internet%22%3F%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EThx%20for%20helping%20out%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3213453%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3213453%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20sorry%2C%20but%20why%20didn't%20you%20simply%20disable%20'AutoRun'%20instead%20of%20ripping%20the%20whole%20subsystem%20out%20by%20default%3F%3CBR%20%2F%3E%3CBR%20%2F%3E%22Hey%2C%20my%20car%20doesn't%20start%2C%20I%20better%20throw%20it%20away...%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20whole%20%22Secure%20by%20Default%22%20is%20a%20pretty%20totalitarian%20methodology.%20Very%20very%20disappointing.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3262386%22%20slang%3D%22de-DE%22%3ESubject%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3262386%22%20slang%3D%22de-DE%22%3E%3CP%3EThanks%20a%20lot%20for%20the%20provided%20information%20so%20far.%20I%20have%20further%20questions%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E-%20When%20will%20the%20change%20probably%20arrive%20%22Office%202016%22%3F%26nbsp%3B%20Even%20it%20is%20a%20quite%20unprecise%20estimation%20like%20%22end%20of%20the%20year%202022%22%20it%20would%20be%20very%20helpful%20for%20us%2C%20too.%3C%2FP%3E%3CP%3E-%20Is%20it%20possible%20to%20get%20to%20know%20the%20kb-number%20in%20advance%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20%26amp%3B%20best%20regards%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3272325%22%20slang%3D%22de-DE%22%3ESubject%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3272325%22%20slang%3D%22de-DE%22%3E%3CP%3EWe%20are%20dealing%20internally%20with%20the%20topic%20%22MC322553%22%20(Blocking%20internet%20macros%20by%20default%20in%20Office)%20as%20part%20of%20Service%20Management%2C%20IT%20Security%20and%20User%20Adaptation.%20We%20know%20the%20following%20sources%20of%20information%2C%20but%20they%20do%20not%20yet%20help%20us%20in%20detail%3A%3C%2FP%3E%3CUL%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fadmin.microsoft.com%2F%3F%23%2FMessageCenter%2F%3A%2Fmessages%2FMC322553%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fadmin.microsoft.com%2F%3F%23%2FMessageCenter%2F%3A%2Fmessages%2FMC322553%3C%2FA%3E%3C%2FLI%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fde-de%2Ftopic%2Fdie-einstellungen-f%25C3%25BCr-vertrauensw%25C3%25BCrdige-dokumente-wurden-ge%25C3%25A4ndert-0be30e4c-926a-4761-bdef-3f91097beb5a%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fde-de%2Ftopic%2Fdie-einstellungen-f%25C3%25BCr-vertrauensw%25C3%25BCrdige-dokumente-wurden-ge%25C3%25A4ndert-0be30e4c-926a-4761-bdef-3f91097beb5a%3C%2FA%3E%3C%2FLI%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-365-blog%2Fhelping-users-stay-safe-blocking-internet-macros-by-default-in%2Fba-p%2F3071805%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-365-blog%2Fhelping-users-stay-safe-blocking-internet-macros-by-default-in%2Fba-p%2F3071805%3C%2FA%3E%3C%2FLI%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexcel-blog%2Fexcel-4-0-xlm-macros-now-restricted-by-default-for-customer%2Fba-p%2F3057905%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexcel-blog%2Fexcel-4-0-xlm-macros-now-restricted-by-default-for-customer%2Fba-p%2F3057905%3C%2FA%3E%3C%2FLI%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%3C%2FA%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETherefore%2C%20we%20have%20summarised%20some%20questions%20for%20clarification%3A%3C%2FP%3E%3CUL%3E%3CLI%3EWhich%20default%20setting%20is%20recommended%20by%20Microsoft%3F%3C%2FLI%3E%3CLI%3EWhat%20central%20setting%20options%20(e.g.%20GPO)%20are%20there%20in%20this%20context%3F%3C%2FLI%3E%3CLI%3EHow%20are%20documents%20uploaded%20by%20guests%20in%20M365%20classified%3F%3C%2FLI%3E%3CLI%3EHow%20are%20shared%20documents%20classified%20that%20are%20located%20in%20another%20tenant%20or%20MS%20OneDrive%20for%20Business%3F%3C%2FLI%3E%3CLI%3EIf%20VBA%20macros%20are%20blocked%20(by%20default)%3A%3CBR%20%2F%3Eo%20What%20exactly%20are%20the%20effects%3F%3CBR%20%2F%3E%20o%20What%20is%20the%20easiest%20way%20to%20share%20the%20macro%20in%20the%20file%3F%3CBR%20%2F%3E%20o%20How%20does%20macro%20sharing%20work%20on%20MS%20OneDrive%20for%20Business%20and%20MS%20Teams%20and%20MS%20SharePoint%20online%3F%3CBR%20%2F%3E%20o%20Does%20%22macro%20release%22%20also%20apply%20directly%20to%20other%20users%20or%20does%20everyone%20who%20wants%20to%20use%20this%20file%20with%20the%20macro%20have%20to%20%22release%22%20it%20individually%3F%3C%2FLI%3E%3CLI%3EIs%20it%20possible%20to%20trace%20who%20has%20classified%20a%20document%20(with%20a%20macro)%20as%20%22secure%22%3F%3C%2FLI%3E%3CLI%3EHow%20does%20the%20signature%20of%20VBA%20macros%20work%3F%3C%2FLI%3E%3CLI%3EWhat%20user%20adoption%20measures%20does%20Microsoft%20recommend%3F%3C%2FLI%3E%3CLI%3EWhat%20material%20is%20there%20from%20MS%20that%20we%20can%20use%3F%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3272784%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3272784%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F861804%22%20target%3D%22_blank%22%3E%40Kellie_msft%3C%2FA%3E%26nbsp%3B%26nbsp%3BI%20hope%20you're%20working%20with%20our%20Teams%20colleagues%20to%20prepare%20them%20for%20this%2C%20so%20they%20won't%20make%20problems%20for%20you%3F%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fhtml%2F%408341BD79091AF36AA2A09063B554B5CD%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CP%3E%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETesting%20I%20have%20done%20shows%20that%20all%20files%20downloaded%20through%20the%20Teams%20Desktop%20Client%2C%20be%20it%20ODB%20from%20a%20chat%2C%20or%20SPO%20from%20a%20Team's%20channel%2C%20get%20the%26nbsp%3BMark%20of%20the%20Web%20(MOTW)%20irrespective!%26nbsp%3B%20Now%20that%20would%20be%20expected%20when%20logged%20into%20a%203rd%20party%20tenant%20and%20downloading%20a%20file%2C%20but%20not%20when%26nbsp%3Bdownloading%20files%20from%20one's%20own%20corporate%20tenant%2C%20but%20unfortunately%20this%20seems%20to%20be%20the%20case!%26nbsp%3B%20%E2%80%8C%E2%80%8C%20If%20the%20macro%20change%20was%20to%20go%20ahead%20before%20Teams%20is%20%22fixed%22%20I%20can%20foresee%20a%20bumpy%20road%20ahead%20and%20many%20disgruntled%20enterprise%20users.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFYI%2C%20access%20Teams%20via%20the%20web%20browser%2C%20and%20the%20MOTW%20is%20absent%2C%20as%20expected%20for%20files%20downloaded%20from%20our%20corporate%20tenant%20(we%20use%20ODB%20and%20SPO%20vanity%20URLs%20btw)%2C%20and%20present%20for%20files%20downloaded%20from%203rd%20party%20tenants.%3CBR%20%2F%3EI%20would%20call%20this%20%22expected%22%20behaviour.%3C%2FP%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3275940%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3275940%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1338770%22%20target%3D%22_blank%22%3E%40Mike_D2022%3C%2FA%3E%26nbsp%3B%26nbsp%3BFor%20consumer%20versions%20of%20Office%202016%2C%20such%20as%20Office%202016%20Home%20%26amp%3B%20Student%2C%20it%20will%20arrive%20when%20available%20in%20Current%20Channel.%20Which%20is%20listed%20currently%20as%20June%202022%20in%20this%20table%20--%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fdeployoffice%2Fsecurity%2Finternet-macros-blocked%23versions-of-office-affected-by-this-change%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EVersions%20of%20Office%20affected%20by%20this%20change%3C%2FA%3E.%26nbsp%3B%20We'll%20update%20that%20table%20when%20we%20have%20more%20specific%20info.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20volume%20licensed%20versions%20of%20Office%202016%2C%20such%20as%20Office%20Professional%20Plus%202016%2C%20we%20don't%20yet%20have%20a%20date%2C%20and%20we%20don't%20know%20the%20KB%20number%20yet.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3275941%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3275941%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51673%22%20target%3D%22_blank%22%3E%40DM51673%3C%2FA%3E%26nbsp%3BWe%20have%20updated%20the%20admin%20documentation%20with%20more%20information%20about%20OneDrive%20and%20SharePoint%20scenarios.%26nbsp%3B%20See%20here%3A%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fdeployoffice%2Fsecurity%2Finternet-macros-blocked%23files-on-onedrive-or-sharepoint%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EFiles%20on%20OneDrive%20or%20SharePoint%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3276479%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3276479%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F573580%22%20target%3D%22_blank%22%3E%40DHB-MSFT%3C%2FA%3E%26nbsp%3Bthank%20you.%3C%2FP%3E%3CP%3EUnfortunately%20you%20missed%20a%20Teams%20scenario.%20My%20testing%20shows%20the%20action%20below%20will%20result%20in%20the%20MOTW%2C%20irrespective%20of%20zone%20mapping%20under%26nbsp%3B%3CEM%3EControl%20Panel%20%26gt%3B%20Internet%20Options%20%26gt%3B%20Security%3C%2FEM%3E%20configuration%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22DM51673_0-1649167050546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22DM51673_0-1649167050546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22DM51673_0-1649167050546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22DM51673_0-1649167050546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22DM51673_0-1649167050546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22DM51673_0-1649167050546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F361413iD9CD413636755DE3%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22DM51673_0-1649167050546.png%22%20alt%3D%22DM51673_0-1649167050546.png%22%20%2F%3E%3C%2Fspan%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt's%20the%20same%20for%20Teams%20chat%20files%20shared%20by%20colleagues%20in%20your%20own%20organization%2C%20they%20are%20tattooed%20with%20the%20MOTW!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278114%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278114%22%20slang%3D%22en-US%22%3E%3CP%3EHi!%3CBR%20%2F%3EI'm%20playing%20around%20with%20version%202203%20build%2015028.20160%20click-to-run%20Current%20Channel%20(Preview).%3C%2FP%3E%3CP%3EI'm%20downloading%20a%20macro-enabled%20file%20from%20our%20cloud%20application%2C%20the%20resulting%20XLSM%20file%20in%20my%20Downloads%20folder%20has%20MOTW%2C%20but%20it's%20still%20prompting%20me%20with%20the%20old%20%22Macros%20have%20been%20disabled%22%20warning...%20i.e.%20the%20new%20Excel%20build%20doesn't%20appear%20to%20be%20using%20the%20new%20behavior%20yet.%20Am%20I%20missing%20something%3F%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22JamesB1110_2-1649272193845.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_2-1649272193845.png%22%20style%3D%22width%3A%20285px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_2-1649272193845.png%22%20style%3D%22width%3A%20285px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_2-1649272193845.png%22%20style%3D%22width%3A%20285px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_2-1649272193845.png%22%20style%3D%22width%3A%20285px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_2-1649272193845.png%22%20style%3D%22width%3A%20285px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F361887i28A5906FF6257F42%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22JamesB1110_2-1649272193845.png%22%20alt%3D%22JamesB1110_2-1649272193845.png%22%20%2F%3E%3C%2Fspan%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22JamesB1110_1-1649272118070.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_1-1649272118070.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_1-1649272118070.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_1-1649272118070.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_1-1649272118070.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_1-1649272118070.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F361886i9B0251D5D026CF8C%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22JamesB1110_1-1649272118070.png%22%20alt%3D%22JamesB1110_1-1649272118070.png%22%20%2F%3E%3C%2Fspan%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22JamesB1110_0-1649272098546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_0-1649272098546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_0-1649272098546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_0-1649272098546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_0-1649272098546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cspan%20class%3D%22lia-inline-image-display-wrapper%22%20image-alt%3D%22JamesB1110_0-1649272098546.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3Cimg%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F361885i636AD502B51A0F19%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22JamesB1110_0-1649272098546.png%22%20alt%3D%22JamesB1110_0-1649272098546.png%22%20%2F%3E%3C%2Fspan%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3ETIA!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278126%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278126%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1355613%22%20target%3D%22_blank%22%3E%40JamesB1110%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BWe%20haven't%20started%20rolling%20out%20the%20new%20behavior%20in%20Current%20Channel%20(Preview).%20Once%20we%20do%2C%20we'll%20update%20the%20table%20in%20the%20admin%20article%20--%26nbsp%3B%3CA%20title%3D%22Versions%20of%20Office%20affected%20by%20this%20change%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fsecurity%2Finternet-macros-blocked%23versions-of-office-affected-by-this-change%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EVersions%20of%20Office%20affected%20by%20this%20change%3C%2FA%3E%26nbsp%3B.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278439%22%20slang%3D%22de-DE%22%3ESubject%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278439%22%20slang%3D%22de-DE%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F861804%22%20target%3D%22_blank%22%3E%40Kellie_msft%2Csorry%3C%2FA%3E%3CBR%20%2F%3E%20but%20it%20looks%20like%20MS%20has%20implemented%20another%20technical%20feature%20without%20being%20aware%20of%20the%20user%20adoption.%20All%20technical%20features%20are%20described%20in%20depth.%20But%20how%20the%20end%20user%20must%20deal%20with%2C%20is%20easy%3A%20just%20download%20and%20open%20the%20file%20locally.%20But%20this%20is%20not%20the%20way%2C%20end%20users%20work!%20They%20want%20to%20open%20the%20fil%20in%20place%3A%20ODB%20or%20MS%20Teams.%20Where%20is%20the%20detailed%20documentation%20for%20this%20point%3F%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3EWhat%20you%20need%20to%20do%20to%20prepare%3A%3C%2FP%3E%3CP%3EYou%20might%20want%20to%20notify%20your%20users%20about%20this%20new%20capability%20and%20update%20your%20training%20and%20documentation%20as%20appropriate.%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278787%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278787%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20Excel%20there%20will%20be%20a%20Catch%2022%20situation%20for%20downloaded%20digitally%20signed%20macro%20files%3A%20the%20certificate%20needs%20to%20be%20trusted%20by%20the%20user%20but%20the%20user%20cannot%20trust%20the%20certificate%20because%20the%20file%20is%20blocked.%3C%2FP%3E%3CP%3EThis%20has%20the%20(presumably%20unintended)%20consequence%20of%20making%20it%20more%20difficult%20to%20use%20signed%20code%20than%20unsigned%20code.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278790%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278790%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20on%20Beta%20Channel%20Excel%20Version%202205%20build%2015130.2000%20but%20as%20far%20as%20I%20can%20tell%20the%20new%20blocking%20behaviour%20is%20not%20enabled.%3C%2FP%3E%3CP%3EIs%20this%20expected%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278875%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278875%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F428214%22%20target%3D%22_blank%22%3E%40fastexcel%3C%2FA%3E%26nbsp%3B%2C%26nbsp%3B%3CSPAN%3E15130.20000%20should%20including%20the%20new%20change%2C%20could%20you%20check%20more%20on%20the%20file%20property%20you%20are%20using%20or%20policy%20setting%3F%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnd%20for%20your%20comment%20on%20%22%3CSPAN%3Efor%20downloaded%20digitally%20signed%20macro%20files%3A%20the%20certificate%20needs%20to%20be%20trusted%20by%20the%20user%20but%20the%20user%20cannot%20trust%20the%20certificate%20because%20the%20file%20is%20blocked%3C%2FSPAN%3E%22%2C%20the%20end%20users%20can%20follow%20these%20steps%20to%20unblock%20themselves%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EIf%20the%20user%20trusts%20this%20file%2C%20he%2Fshe%20can%20move%20this%20file%20to%20a%20trusted%20location%20to%20unblock%20this%20file%3C%2FLI%3E%0A%3CLI%3EReopen%20the%20file%3C%2FLI%3E%0A%3CLI%3EThen%20the%20user%20will%20be%20promoted%20to%20choose%20trusting%20the%20publisher%20or%20not%3C%2FLI%3E%0A%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278902%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278902%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1304055%22%20target%3D%22_blank%22%3E%40donlv%3C%2FA%3E%20AFAIK%20The%20only%20way%20to%20add%20a%20trusted%20publisher%20to%20Excel%20is%20to%20open%20a%20signed%20file%20from%20that%20publisher%20and%20choose%20to%20trust%20the%20publisher%20(hence%20the%20Catch22%20-%20you%20cannot%20do%20that%20when%20the%20file%20is%20blocked).%20If%20there%20is%20another%20way%20I%20have%20not%20been%20able%20to%20find%20it.%3C%2FP%3E%3CP%3EPeople%20seem%20to%20think%20that%20a%20valid%20certificate%20from%20a%20certified%20Authority%20will%20be%20automatically%20trusted%2C%20but%20sadly%20that%20is%20not%20the%20way%20Excel%20works.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3278947%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3278947%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F573580%22%20target%3D%22_blank%22%3E%40DHB-MSFT%3C%2FA%3E%26nbsp%3Bany%20feedback%20on%20my%20observation%20regarding%20the%20MOTW%20generated%20by%20downloads%20via%20the%20desktop%20Teams%20client%3F%20To%20prepare%20for%20the%20change%20in%20default%20behavior%2C%20we're%20beginning%20testing%20by%20forcing%20the%20proposed%20configuration%20via%20policy%20to%20groups%20of%20users.%26nbsp%3B%20We're%20already%20receiving%20negative%20sentiment%20towards%20the%20change%2C%20as%20every%20file%20downloaded%20though%20the%20Teams%20desktop%20app%20from%20our%20own%20tenant%20is%20being%20tattooed%20with%20the%20MOTW%2C%20irrespective%20of%20the%20zone%20mapping.%26nbsp%3B%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3279493%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3279493%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51673%22%20target%3D%22_blank%22%3E%40DM51673%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BWhich%20policy%2Fpolicies%20have%20you%20set%3F%26nbsp%3B%20What%20banner%20appears%20when%20you%20open%20the%20file%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3280227%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3280227%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F573580%22%20target%3D%22_blank%22%3E%40DHB-MSFT%3C%2FA%3E%26nbsp%3Bit's%20not%20about%20the%20policies%2C%20or%20banner%20at%20this%20stage...%20the%26nbsp%3B%3CSTRONG%3EBlock%20macros%20from%20running%20in%20Office%20files%20from%20the%20Internet%3C%2FSTRONG%3E%26nbsp%3Bwill%20be%20in%20place%20in%20a%20couple%20of%20weeks%20or%20so%20for%20our%20testers.%26nbsp%3B%20It's%20the%20fact%20that%20it's%20already%20been%20observed%20that%20files%20downloaded%20from%20our%20own%20ODB%2FSPO%20through%20Teams%20all%20have%20the%20MOTW%2C%20so%20there%20is%20a%20clear%20expectation%20these%20will%20all%20see%20the%20banner%20%22Microsoft%20has%20blocked%20macros%20from%20running%20because%20the%20source%20of%20this%20file%20is%20untrusted%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3280366%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3280366%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20a%20terrible%20implementation.%20All%20you%20needed%20to%20do%20was%20disable%20Macros%20from%20autorun%2C%20period%2C%20a%20feature%20you%20added%202%2B%20decades%20ago%20to%20make%20things%20easier%20but%20now%20should%20do%20away%20with.%20Then%20we%20all%20can%20decide%20which%20macros%20we%20want%20to%20run%20and%20not%20have%20to%20fight%20with%20this%20whole%20Mark%20of%20the%20Beast%20thing%20you're%20implementing.%20Let%20us%20worry%20about%20it%20because%20you're%20not%20capable%20of%20security.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20don't%20need%20parental%20oversight%2C%20we%20need%20software%20that%20functions.%20Secure%20by%20Default%20is%20destroying%20the%20product.%20It's%20like%20having%20a%20bank%20app%20that%20you%20can't%20take%20screenshots%20on%20even%20though%20it's%20your%20info%20and%20your%20phone%20and%20your%20account.%20It's%20not%20on%20my%20bank%20to%20be%20my%20parent%2C%20it's%20not%20on%20my%20phone%20OS%20to%20be%20my%20parent%2C%20it's%20not%20on%20my%20software%20vendor%20to%20be%20my%20parent%2C%20it's%20not%20on%20my%20email%20provider%20to%20be%20my%20parent%2C%20it's%20on%20me.%20I%20trust%20me%20more%20than%20any%20of%20those%20groups.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDisable%20the%20right%20functionality%20and%20everything%20gets%20fixed%20much%20cheaper%20and%20easier%20than%20the%20path%20Microsoft%20is%20on...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3280631%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3280631%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F319536%22%20target%3D%22_blank%22%3E%40VNJoe%3C%2FA%3EI%20am%20not%20a%20fan%20of%20the%20current%20MOTW%20implementation%20but%20if%20you%20mean%20getting%20rid%20of%20things%20like%20Workbook_Open%20events%20(which%20AFAIK%20have%20been%20there%20since%20the%20first%20VBA%20Excel%20implementation)%20that%20would%20break%26nbsp%3B%20a%20very%20large%20number%20of%20existing%20VBA%20solutions%20and%20addins.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3282027%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3282027%22%20slang%3D%22en-US%22%3E%3CP%3ENo%2C%20I'm%20simply%20referring%20to%20autorun%20on%20open%20for%20macros.%20Turn%20that%20off.%20It's%20been%20around%20for%20years%20and%20it's%20always%20been%20an%20issue.%20Getting%20a%20file%20with%20macros%20is%20often%20important%2C%20and%20as%20long%20as%20they%20don't%20start%20up%20automatically%2C%20users%20can%20review%20the%20source%20and%20verify%20it's%20integrity%20of%20their%20own%20accord.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3282187%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3282187%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51673%22%20target%3D%22_blank%22%3E%40DM51673%3C%2FA%3E%26nbsp%3B%3CSPAN%3EIf%20the%20%E2%80%9CLaunching%20applications%20and%20unsafe%20files%E2%80%9D%20setting%20is%20set%20to%20Prompt%20(for%20a%20zone%20under%20Control%20Panel%20%26gt%3B%20Internet%20Options%20%26gt%3B%20Security%20%26gt%3B%20Custom%20level)%2C%20then%20the%20Mark%20of%20the%20Web%20attribute%20is%20set%20on%20the%20file.%20%E2%80%9CPrompt%E2%80%9D%20is%20the%20default%20setting%20for%20%E2%80%9CLaunching%20applications%20and%20unsafe%20files%E2%80%9D%20for%20both%20the%20%E2%80%9CInternet%E2%80%9D%20zone%20and%20the%20%E2%80%9CTrusted%20sites%E2%80%9D%20zone.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EBut%20we%E2%80%99re%20only%20blocking%20macros%20(by%20default)%20from%20files%20that%20are%20tagged%20as%20being%20from%20the%20%E2%80%9CInternet%E2%80%9D%20zone.%20If%20the%20file%20is%20tagged%20as%20being%20from%20the%20%E2%80%9CTrusted%20sites%20zone%E2%80%9D%20then%20macros%20won%E2%80%99t%20be%20blocked%20by%20default.%20For%20those%20files%2C%20the%20VBA%20macro%20notification%20settings%20in%20the%20Trust%20Center%20will%20apply.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ESo%20that%E2%80%99s%20why%20one%20of%20the%20options%20we%20list%20in%20the%20admin%20article%20is%20to%20assign%20the%20OneDrive%20and%20SharePoint%20(which%20includes%20Teams)%20URLs%20to%20the%20%E2%80%9CTrusted%20sites%E2%80%9D%20zone%20if%20you%20don%E2%80%99t%20want%20macros%20blocked%20by%20default%20in%20files%20downloaded%20from%20those%20locations.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3282195%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3282195%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20Trusted%20Sites%20in%20Internet%20Explorer%20zones%20that's%20being%20retired%20a%20month%20or%20two%20in%20a%20completely%20different%20application%2C%20rather%20than%20simply%20stopping%20autorun%2C%20is%20that%20right%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUsing%20a%20decade%20plus%20old%20solution%20and%20adding%20an%20extremely%20complex%20resolution%20for%20systems%20in%20the%20SMB%20market%20is%20failed%20design.%20Users%20don't%20know%20about%20this.%20Your%20assumption%20is%20everyone%20using%20Office%20has%20an%20IT%20staff.%20Just%20disable%20Autorun%20macros%20and%20the%20entire%20problem%20goes%20away.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt's%20constantly%20using%20a%20sledgehammer%20to%20crack%20a%20nut%20with%20Microsoft%20anymore.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3282215%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3282215%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F319536%22%20target%3D%22_blank%22%3E%40VNJoe%3C%2FA%3E%20You%20mean%20automatically%20running%20a%20macro%20when%20a%20workbook%20is%20opened%3F%20That%20is%20what%20I%20was%20referring%20to%20-%20disabling%20that%20would%20break%20things%20very%20badly.%3C%2FP%3E%3CP%3EUsers%20can%20always%20open%20a%20workbook%20in%20safe%20mode%20if%20they%20want%20to%20inspect%20the%20code.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3282502%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3282502%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F573580%22%20target%3D%22_blank%22%3E%40DHB-MSFT%3C%2FA%3E%26nbsp%3Bwe%20use%20vanity%20URLs.%20Our%20domain%20is%20in%20our%20intranet%20zone.%20The%20intranet%20zone%20is%20the%20most%20permissive%20of%20all%20the%20zones%2C%20we%20don't%20need%20to%20add%20any%20domains%20to%20Trusted%20Sites.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELet%20me%20be%20clear%2C%20if%3CSPAN%3E%26nbsp%3Bthe%20site%20is%20in%20the%20Intranet%20Zone%20the%20MOTW%20is%20not%20applied%20to%20downloaded%20files%20in%20the%20Edge%20web%20browser.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20same%20is%20NOT%20true%20for%20files%20downloaded%20through%20the%20Teams%20Desktop%20Client.%20From%20my%20testing%20it%20seems%20that%20the%20Teams%20desktop%20client%20is%20not%20aware%20of%20zoning%2C%20as%20all%20files%20(those%20from%20our%20vanity%20domain)%20downloaded%20direct%20through%20the%20Teams%20client%20are%20given%20the%20MOTW%20irrespective.%20Please%20do%20test%20and%20see%20for%20yourself.%20Thank%20you.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3283906%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3283906%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51673%22%20target%3D%22_blank%22%3E%40DM51673%3C%2FA%3E%26nbsp%3BThe%20information%20we%20added%20to%20the%20admin%20article%20is%20based%20on%20testing%20that%20we've%20done%2C%20including%20with%20Teams.%20We%20see%20zone%20info%20when%20we%20run%20this%20command%20in%20the%20location%20of%20the%20downloaded%20file%3A%3C%2FP%3E%0A%3CP%20dir%3D%22ltr%22%3E%3CBR%20%2F%3Enotepad%20%22%7Bfilename%7D%3AZone.Identifier%22%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EWe%20suggest%20you%20contact%20support%20to%20do%20more%20investigation%20into%20the%20results%20you're%20seeing.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3291501%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3291501%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F573580%22%20target%3D%22_blank%22%3E%40DHB-MSFT%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3EWe've%20opened%20up%20a%20case%20with%20CSS%20for%20downloads%20from%20the%20Teams%20client%20(from%20our%20own%20tenant)%20leaving%20the%20MOTW.%3C%2FLI%3E%3C%2FUL%3E%3CP%3Ee.g.%3C%2FP%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%5BZoneTransfer%5D%3CBR%20%2F%3EZoneId%3D3%3CBR%20%2F%3EReferrerUrl%3Dabout%3Aclient%3CBR%20%2F%3EHostUrl%3Dabout%3Ainternet%3CBR%20%2F%3E%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CUL%3E%3CLI%3EWe're%20opening%20a%20case%20for%20%3CEM%3E%3CSTRONG%3Ethis%26nbsp%3B%3C%2FSTRONG%3E%3C%2FEM%3Enew%20behaviour%20in%20Office%20too%2C%20as%20it's%20not%20reacting%20to%20the%20MOTW%20as%20we%20would%20expect%20it%20to%20when%20we%20emulate%20the%20new%20behaviour%20by%20enabling%20the%20policy%20%22Block%20macros%20from%20running%20in%20Office%20Files%20from%20the%20Internet%22.%26nbsp%3B%20I.e.%20with%20%22Disable%20VBA%20Macros%20with%20Notification%20set%2C%20and%20the%20aforementioned%20policy%20set%2C%20we%20still%20only%20see%20the%20%22Enable%20Content%22%20softblock%20and%20not%20the%20hardblock.%20And%20I'm%20pretty%20confident%20in%20my%20test%20cases%2C%20none%20of%20the%20subsequent%20evaluations%20as%20documented%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2FDeployOffice%2Fsecurity%2Finternet-macros-blocked%23how-office-determines-whether-to-run-macros-in-files-from-the-internet%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ehere%3C%2FA%3E%20would%20result%20in%20the%20hardblock%20being%20avoided.%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3369157%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3369157%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EI%20can%20confirm%20that%20when%20we%20download%20a%20Excel%20Marco%20File%20from%20Teams%20the%20MOTW%20is%20not%20modified%2C%20or%20comparing%20the%20trusted%20sites%20(%3CSPAN%3EGet-Content%20*%20-Stream%20Zone.Identifier%3C%2FSPAN%3E).%20However%2C%20when%20you%20access%20the%20file%20on%20sharepoint%20online%20and%20add%26nbsp%3Beuc-excel.officeapps.live.com%20as%20trusted%20site%20the%20file%20with%20marco%20can%20be%20used.%20I%20hope%20this%20will%20be%20changed%20with%20a%20later%20update%20of%20Teams%2C%20or%20maybe%20I%20am%20just%20mistaken.%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EEdit%3A%3C%2FP%3E%3CP%3Eit%20seems%20working%20fine%20with%20teams%20version%201.5%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3369492%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3369492%22%20slang%3D%22en-US%22%3E%3CP%3EWe've%20had%20it%20confirmed%20by%20CSS%20that%20indeed%20the%20Teams%20Desktop%20client%20leaves%20the%20MOTW%20on%20downloads.%20It's%20a%20known%20issue%20and%20is%20being%20worked.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3384613%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3384613%22%20slang%3D%22en-US%22%3E%3CP%20class%3D%22p1%22%3E%3CSPAN%20class%3D%22s1%22%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1174393%22%20target%3D%22_blank%22%3E%40Stephan2k%3C%2FA%3E%2C%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CDIV%3E%0A%3CP%3EIf%20the%20macro-enabled%20file%20is%20downloaded%20from%20Teams%2C%20there%20will%20be%20a%20MoTW%20attribute%20and%20be%20blocked%20by%20default.%20However%2C%20if%20users%20selected%20%22Open%20in%20Desktop%20App%22%20on%20Teams%20so%20that%20the%20file%20is%20opened%20from%20OneDrive%20or%20SharePoint%2C%20then%20there%20will%20be%20no%20MoTW%20attribute%20and%20thus%20no%20blocking.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EPlease%20check%20%3CA%20tabindex%3D%22-1%22%20title%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fsecurity%2Finternet-macros-blocked%23files-on-onedrive-or-sharepoint%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fsecurity%2Finternet-macros-blocked%23files-on-onedrive-or-sharepoint%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3EFiles%20on%20OneDrive%20or%20SharePoint%3C%2FA%3E%20for%20detailed%20information.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EYou%20can%20remove%20the%20MoTW%20to%20open%20the%20file%20by%20%3CSTRONG%3Eright-click%20%26gt%3B%20Properties%20%26gt%3B%20Unblock%3C%2FSTRONG%3E%20in%20the%20File%20Explorer%20if%20you%20are%20sure%20it's%20safe.%20Also%2C%20you%20can%20try%20to%20open%20the%20file%20from%26nbsp%3B%3CA%20tabindex%3D%22-1%22%20title%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fsecurity%2Ftrusted-locations%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fsecurity%2Ftrusted-locations%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3ETrusted%20Locations%20for%20Office%20files.%3C%2FA%3E%3C%2FP%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3385759%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3385759%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1365859%22%20target%3D%22_blank%22%3E%40AdrianWu%3C%2FA%3E%26nbsp%3Bas%20you'd%20appreciate%20this%20is%20not%20a%20sustainable%20workaround%20in%20large%20enterprises.%20Many%20users%20regularly%20decide%20to%20download%20files%20through%20the%20Teams%20client%2C%20rather%20than%20open%20them%20immediately%20in%20the%20native%20app.%20It's%20not%20feasible%20to%20tell%20them%20to%20either%20not%20do%20that%2C%20or%20if%20they%20do%2C%20to%20unblock%20the%20file%20each%20time.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20assume%20therefore%20the%20Teams%20PG%20will%20be%20fixing%20this%20behaviour%20%3CEM%3Ebefore%3C%2FEM%3E%20the%20new%20macro%20blocking%20feature%20is%20turned%20on%20by%20default%20in%20any%20of%20the%20M365%20Apps%20Enterprise%20Channels%3F%26nbsp%3B%20We've%20been%20told%20the%20issue%20is%20being%20worked%20but%20there%20is%20no%20ETA.%20Thanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3386192%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3386192%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20any%20progress%20on%20resolving%20the%20problems%20with%20Excel%20XLAM%20files%20reported%20several%20weeks%20ago%3F%3C%2FP%3E%3CP%3EWe%20are%20getting%20uncomfortably%20close%20to%20the%20planned%20June%20Current%20Channel%20release.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EExact%20reproduction%20steps%20are%20available%20on%20request.%3C%2FP%3E%3CP%3E--------%26gt%3B%3C%2FP%3E%3CP%3EI%20created%202%20XLAM%20files%2C%20both%20signed%20using%20my%20certificate.%3C%2FP%3E%3CP%3EThe%20XLAM%20files%20are%20very%20simple%20%E2%80%93%20the%20only%20VBA%20they%20contain%20is%20a%20Workbook%20Open%20subroutine%20that%20contains%20a%20MSGBOX%20%E2%80%9CBook1%E2%80%9D%20or%20MSGBOX%20%E2%80%9CBook2%E2%80%9D.%20So%20when%20their%20VBA%20is%20enabled%20and%20they%20are%20opened%20the%20MsgBox%20fires.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EFailure%20points%20include%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CUL%3E%3CLI%3ENo%20messages%20at%20all%20when%20opening%20a%20signed%20XLAM%20with%20MOTW%20%E2%80%93%20it%20silently%20disables%3C%2FLI%3E%3CLI%3EA%20Trusted%20publisher%20does%20NOT%20allow%20a%20signed%20XLAM%20with%20MOTW%20to%20be%20loaded%3C%2FLI%3E%3CLI%3ENo%20view%20of%20either%20the%20yellow%20message%20bar%20or%20the%20red%20message%20bar%3C%2FLI%3E%3CLI%3EWeb%20page%20links%20do%20not%20mention%20MOTW%20at%20all%3C%2FLI%3E%3CLI%3EThere%20does%20not%20appear%20to%20be%20any%20benefit%20at%20all%20to%20signing%20code%20%E2%80%93%20the%20user%20just%20has%20to%20perform%20an%20extra%20step%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3429051%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3429051%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F428214%22%20target%3D%22_blank%22%3E%40fastexcel%3C%2FA%3E%26nbsp%3Bthank%20you%20for%20reaching%20out%2C%20and%20my%20apologies%20on%20the%20delayed%20response.%3C%2FP%3E%0A%3CP%3EThe%20behavior%20of%20XLAM%20files%20with%20MOTW%20is%20not%20new%3B%20it%20was%20introduced%20in%20Summer%202016%20as%20part%20of%20a%20security%20patch%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Farchive%2Fblogs%2Fthe_microsoft_excel_support_team_blog%2Fexcel-workbooks-may-not-open-after-installing-ms16-088%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Farchive%2Fblogs%2Fthe_microsoft_excel_support_team_blog%2Fexcel-workbooks-may-not-open-after-installing-ms16-088%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20behavior%20stems%20from%20the%20fact%20that%20Protected%20View%20allows%20users%20to%20view%20documents%2C%20not%20add-ins.%20Add-ins%20with%20MOTW%20will%20not%20open%20because%20there%20is%20no%20Protected%20View%20support.%3C%2FP%3E%0A%3CP%3ESigning%20the%20VBA%20code%20in%20XLAM%20files%20is%20still%20beneficial%3A%20once%20the%20file%20is%20unblocked%20and%20if%20the%20publisher%20has%20already%20been%20trusted%2C%20the%20user%20will%20not%20be%20asked%20to%20%22enable%20content.%22%20In%20addition%2C%20Excel%20will%20detect%20if%20the%20VBA%20code%20has%20been%20modified%20after%20it%20was%20signed%2C%20alerting%20the%20user%20that%20the%20file%20has%20been%20tampered%20with%20and%20is%20unsafe.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20Excel%20team%20is%20working%20on%20improving%20this%20experience%20by%20informing%20the%20user%20that%20the%20add-in%20cannot%20be%20loaded.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI'm%20happy%20to%20follow%20up%20with%20you%20over%20private%20message%20if%20that%20would%20be%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3433307%22%20slang%3D%22en-US%22%3ERe%3A%20Helping%20users%20stay%20safe%3A%20Blocking%20internet%20macros%20by%20default%20in%20Office%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3433307%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20-%20the%20article%20does%20not%20mention%20XLAM%20at%20all%20but%20I%20can%20see%20that%20it%20might%20apply.%3C%2FP%3E%3CP%3ESo%20what%20will%20the%20new%20expected%20behavior%20be%20when%20a%20signed%20XLAM%20with%20MOTW%20is%20opened%20from%20an%20untrusted%20location%3F%3C%2FP%3E%3CUL%3E%3CLI%3EBy%20the%20user%20double-clicking%20the%20XLAM%3C%2FLI%3E%3CLI%3EBy%20the%20user%20using%20File%20Open%20from%20Excel%3C%2FLI%3E%3CLI%3EBy%20the%20user%20using%20the%20Excel%20Addins%20to%20dialog%20to%20install%20the%20XLAM%3C%2FLI%3E%3CLI%3EBy%20VBA%20in%20the%20workbook.open%20event%3C%2FLI%3E%3CLI%3EBy%20Excel%20when%20Excel%20opens%20and%20finds%20a%20Registry%20Open%20key%20has%20been%20created%20for%20the%20XLAM%3C%2FLI%3E%3C%2FUL%3E%3CP%3EAnd%20how%20does%20this%20behavior%20change%20with%20a%20signed%20XLAM%20with%20MOTW%20from%20a%20trusted%20location%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Co-Authors
Version history
Last update:
‎Apr 08 2022 01:15 PM
Updated by: