Doesn’t Microsoft 365 already block macros by default?

Office for Windows now blocks macros in files from the internet or email by default. Users can work around it per file and settings can differ per laptop, so you set it centrally through Intune.

Will our macro-enabled Excel sheets still work?

Yes, if you prepare them. Business macros you still need are digitally signed or placed in a managed trusted location, so they keep working while unknown macros are blocked.

What is a trusted location?

A folder where Office always lets macros run. Use as few as possible, and never folders like Downloads or folders anyone can write to.

What should staff do with a file that asks them to ‘enable content’?

Do not enable it, and report the file to your IT partner. A normal invoice or quote does not need macros.

Does this also apply to Office on a Mac or in the browser?

Office in the browser does not run VBA macros. Office for Mac has separate settings; we include those if you use Macs.

Blocking Office macros: how an SME should handle Word and Excel files with macros safely in Microsoft 365

An invoice arrives as an Excel file. When it opens, a yellow bar says ‘Enable content’. Click it, and malicious code can start without anyone noticing. At the same time, the finance team has run on a macro-enabled Excel sheet for years that cannot simply stop. So an SME has to decide which macros are allowed and which never are.

Why macros are a well-known attack route

Macros are small programs inside Word, Excel or PowerPoint files that automate tasks. That is useful for a quote or timesheet, but the same technique can also download or start malicious software. Attackers therefore send files that look like an invoice, delivery note or payslip, asking you to ‘enable content’. One click is enough. A good filter for links and attachments stops a lot, but not everything, and a file can also arrive via a download link or a USB stick.

What Microsoft already does by default

Office for Windows marks files that come from the internet or email. For those files, Office now blocks macros by default; the user sees a red security warning bar instead of a button to enable them. That is a big improvement, but gaps remain. A user can ‘unblock’ a file in its properties, older settings or versions can differ, and files from other sources do not always get that mark. Without a central policy, you cannot be sure how each laptop is set.

What to set centrally

Block macros in internet files: use Intune to turn on the policy that blocks macros in Office files from the internet, for Word, Excel, PowerPoint and the other Office apps you use.
Allow only signed macros: set the macro setting to ‘disable all macros except digitally signed macros’. Sign business macros with a certificate from your own organisation or from the supplier.
Keep trusted locations to a minimum: a trusted location is a folder where macros always run. Use as few as possible, never the Downloads folder or a folder anyone can write to, and define them centrally.
Stop users changing the settings: because the policy comes from Intune, a user cannot switch it back in the Office options.
Extra rules on the laptop: with Defender for Business you can turn on rules that stop Office apps from starting other programs or creating executable files. That limits the damage if a macro does run.

How to keep business macros working

Take stock: ask each team which files use macros, such as a timesheet, price calculation or export from the accounting package. There are often fewer than expected.
Clean up or replace: some old macros are no longer needed or can be replaced by standard Excel features or an integration with your software.
Sign them or give them a fixed place: sign the macros that stay, or put them in one managed location. When moving to SharePoint, include this in the plan; see also our article on migrating the file server to SharePoint.
Pilot group: turn the policy on for a few colleagues for a week first, including someone from finance, and fix any issues before everyone moves over.
Explain why to staff: people who know an invoice should never ask them to ‘enable content’ are slower to click. Include it in your security awareness training.

How Floor ICT handles this

Floor ICT works with you to find out which Office files use macros and who needs them. We set up the macro policy through Intune for all managed laptops, sign or move the business macros that have to stay, and turn on the extra Defender rules where possible. First for a pilot group, then for everyone. That way finance keeps working, and a fake invoice with macros only produces a warning instead of an infected laptop.

View MSP packages Request an intake Microsoft 365