Is it just me or have Microsoft rolled this change back on the Current Channel?
I was trying to reproduce the pinkish-red 'Security Risk... Learn More' notification in the Message Bar, in preparation for demonstrating the new default behaviour for a YouTube video I'm putting together about my company's macro-enabled toolkit.
Created a simple .xlsm to show a MsgBox in the open event of the workbook, saved it and uploaded it to cloud storage, deleted it from my local storage, re-downloaded it from cloud storage (to a non-trusted location, my Downloads library)... did not use the Unblock checkbox on the Properties dialog to remove the mark of the web... then opened up the file.
It first went into Protected View (expected behaviour), but then after I clicked Enable Editing, instead of getting the pink/red message about macros being blocked altogether, I just got the old 'Security warning...' message with the 'Enable Content' button. The file's VBA project wasn't digitally signed, wasn't saved to a Trusted Location, and still had the mark of the web on it... so macros should have been blocked.
I also tried uploading it and re-downloading it from our Sharepoint document library, emailing it to my work address from my personal address, opening it directly from the attachment... still macros weren't blocked entirely. Even tried downloading an .xlsm from the internet that I hadn't created (from a known trustworthy source) that my installation of Office had never encountered before, so that it definitely wasn't a Trusted Document... and STILL macros weren't blocked.
It feels like something has undone this new default behaviour very recently... maybe Microsoft Defender is overruling the block?
I'm loathed to clear my Trusted Documents in an effort to trigger the red macro block message, just for the sake of the video, but I'm not sure what else to try at this point.