Microsoft is changing the default behaviour of Office so macros are blocked by default, to improve security.

To increase preventative protection, Microsoft will be blocking all macros in files from the internet, starting in early April. When users open a file from the internet that contains macros, the following message will be displayed:

Macros (which use the Visual Basic Application, aka VBA, in Office applications) power many business automations, and are the precursor to more modern solutions like Power Automate. However, macros aren’t required for everyday use such as reading or editing documents.

As macros are relatively common, part of the globally used Office suite, and are relatively easy to write, they’ve become a simple way for attackers to deliver malicious hacks. Attackers can send a damaging macro hidden within a business orientated file to users, who inadvertently run the malware when opening the file. The National Cyber Security Centre (NCSC) sees macros as a significant threat, see their guidance here.

This change is being rolled out in early April 2022 for the Preview channel of Office, and will impact Office on Windows devices on the following applications: Access, Excel, PowerPoint, Visio, and Word. This will become default on other channels and for Office LTSC, Office 2021, Office 2019, Office 2016 and Office 2013 at a future date Microsoft have yet to confirm.

Microsoft allow organisations using Microsoft 365 to enable the ‘Block macros from running in Office files from the Internet’ policy ahead of schedule and to change how users are notified about macros. If you would like to enable this policy now, please contact us.