Macro un-blocking from trusted site not working

Matt Karee 0 Reputation points
2026-09-11T16:07:38.54+00:00

I followed the steps under the heading "Unblock all files from a specific network share or website" at this link: https://support.microsoft.com/en-us/office/vba/a-potentially-dangerous-macro-has-been-blocked

However, when I download a macro-enabled excel file from the website that I added to Trusted Sites, I still get the security risk message at the top of my excel file and the macros are still blocked.

I know that you can unblock files individually, but I would prefer not to have to do this every time because I will be offloading this task to another person.

Microsoft 365 and Office | Excel | For business | Windows
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Aetherin 1,545 Reputation points Independent Advisor
    2026-09-11T16:44:21.64+00:00

    Hi @Matt Karee,

    Based on your description, the newly downloaded workbook may still be receiving a Mark of the Web (MOTW) tag. If so, Excel will continue to treat it as an Internet-originated file and block its VBA macros, even though the main website has been added to Trusted Sites. This can happen when the file is delivered through a different hostname, subdomain, CDN, storage endpoint, or redirected URL.

    A dedicated Excel Trusted Location can provide a supported operational approach. Files opened from a Trusted Location bypass several Office security checks, and active content, including VBA macros, can run. Because this location is highly trusted, only authorized users or applications should be permitted to add or modify files in it.

    The person taking over the process could download the workbook and then save or move it into a designated trusted folder before opening it. However, I strongly recommend against marking the entire Downloads folder as a Trusted Location, because Office files downloaded from any Internet source into that folder could bypass the usual protections.

    You can refer to: Trusted Locations for Office files

    If your organization controls the workbook and its VBA code, digitally signing the VBA project and centrally managing the publisher certificate is generally a more secure and scalable approach:

    • Sign the VBA project with an appropriate code-signing certificate.
    • Deploy the corresponding public certificate to the Trusted Publishers certificate store on the devices that need to use the workbook.
    • Configure the applicable Office macro policies according to your organization’s security requirements, such as allowing only macros that are validly signed by approved publishers.

    Microsoft recommends digitally signing VBA code as a best practice for organizations that develop and distribute their own macros. Trusted Publisher certificates can be deployed centrally through Group Policy. If the signed VBA project is modified after signing, the signature becomes invalid, helping users and administrators identify that the code has changed.

    Please note that other centrally enforced Office security policies can still affect whether a signed macro is allowed to run. Your IT administrator should review the effective macro policies on the affected device if the issue continues.

    You can also refer to: Trusted publishers for Office files

    These are simply my suggestions based on my experience and research, and I sincerely hope they provide some useful direction for your particular scenario.

    Thank you for taking the time to review them.

    If the answer is helpful, please kindly click "Yes" button below. If you have extra questions about this answer, please click "Comment".    

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-11T16:07:58.4166667+00:00

    If the site is already in Trusted Sites and downloaded Excel files still show Security Risk with macros blocked, check these points:

    1. Verify the file is being downloaded from the trusted domain actually added to Windows
      • For files downloaded from OneDrive or SharePoint, whether the browser applies Mark of the Web depends on the Windows internet security zone configuration.
      • Admins can place the exact SharePoint or OneDrive domain into Trusted Sites by using the Site to Zone Assignment List policy.
      • If the file is coming from a different host, subdomain, redirect, or CDN than the one added, the trusted site entry won’t apply.
    2. Confirm the site is listed in Windows Internet Options
      • Go to Control Panel > Internet Options > Change security settings.
      • Check whether the website appears under Trusted sites.
      • If adding http:// URLs or network shares, clear Require server verification (https:) for all sites in this zone.
    3. Use Trusted Sites rather than Local intranet when possible
      • Trusted Sites is the recommended approach because it has additional security compared to Local intranet.
      • If users are accessing a share by IP address, macros remain blocked unless that location is in Trusted sites or Local intranet.
    4. Check how the file is opened
      • If the file is stored on OneDrive or SharePoint, using Open in Desktop App avoids Mark of the Web.
      • If the OneDrive sync client downloads the file, the file also won’t have Mark of the Web.
      • Downloading through a web browser can still result in Mark of the Web being applied, depending on the zone configuration.
    5. If the file is downloaded locally, test whether it still has Mark of the Web
      • Right-click the file in File Explorer > Properties.
      • If Unblock appears on the General tab, the file still has Mark of the Web.
      • That means the trusted-site configuration did not match the actual download source or did not apply as expected.
    6. For a repeatable process, use one of these supported approaches instead of unblocking each file manually
      • Have users open the file with Open in Desktop App if the files are on OneDrive or SharePoint.
      • Save the files to a Trusted Location.
      • Use a trusted site configuration for the exact source location.
      • For groups that regularly use these files, admins can assign the SharePoint or OneDrive domain to Trusted Sites with policy.
    7. Be careful with broad trust settings
      • Adding a site to Trusted Sites means files downloaded from that domain can bypass the default macro block.
      • Access control on that site still matters, because anyone allowed to upload files there could add files with active content such as macros.

    If the goal is to avoid per-file unblocking for another person, the most reliable supported options are:

    • Open in Desktop App for files hosted in OneDrive or SharePoint
    • Trusted Location for local folders
    • Trusted Sites configured for the exact file-hosting domain

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.