- Understand and adjust the Trust Center options to control macro execution and reduce risks.
- Use digital certificates and signatures to guarantee the origin and integrity of the VBA code you are going to run.
- Work with Trusted Locations to minimize alerts without lowering security to unsafe levels.
In Excel, macros are a powerful tool for automating tasks, but they can also be a gateway for malicious code if not managed carefully. Therefore, it's essential to understand how macro security settings work , what options are available, and when to enable or disable them.
In this guide, you'll find everything you need to navigate Excel with ease: from the Trust Center and various security policies to digitally signing VBA projects with certificates (including how to create your own with SelfCert). You'll also learn what to do when you see the "Microsoft has blocked macros because the source of this document is not trusted" message, which is very common with files downloaded or shared via OneDrive. We'll get straight to the point, with clear explanations and step-by-step instructions for the most widely used versions of Excel.
What is a macro and why can it pose a risk?
A macro is essentially a sequence of instructions (usually written in VBA, Visual Basic for Applications) that automates repetitive actions: updating pivot tables, hiding rows, recording transactions, and so on. So far, so good. The problem arises when a macro contains malicious code capable of modifying files, downloading malware , or manipulating data without your knowledge; hence, Excel, by default, is conservative and blocks or warns you before running them.
It's important to distinguish between two historical families of macros in Excel: VBA macros , the most common today, and Excel 4.0 ( XLM ) macros, which predate VBA. The latter are disabled by default in modern versions and only run if you explicitly enable the corresponding option. Naturally, each type of macro is subject to specific security controls in the Trust Center.
Digital signatures and certificates: authenticity and integrity (Microsoft Authenticode)
To increase trust, Office uses Microsoft Authenticode technology , which allows you to digitally sign a macro project or file. The digital signature serves two purposes: confirming that the content comes from the signer (authenticity) and ensuring that it hasn't been modified since signing (integrity). If a signed document is altered, the signature becomes invalid, and Excel will notify you.
Where do I get the certificate for signing? You can obtain it from a commercial certification authority (CA) , request it from your security administrator or IT team, or, if you need it for internal testing, create it yourself using the SelfCert.exe tool. Certificates issued by a CA that is part of the Microsoft Root Certificate Program are more readily recognized within the Windows ecosystem , making it easier to validate trust.
It's also possible to generate a self-signed certificate with SelfCert.exe (very useful for development or personal environments). Keep in mind that a self-signed certificate won't automatically be considered fully trusted on all computers: the user or organization must explicitly trust the publisher for the signed macro to run without further prompts.
Once the certificate is installed, you can go to your VBA project and sign it. From that point on, if the signature is valid and the publisher is trusted, Excel will allow you to run the code without blocking it. Signing isn't just a technical quirk: it's a security measure that helps ensure only identifiable, unmodified code circulates and makes it easier to audit changes in Excel files.
Convert a document to a trusted format to enable macros
If the classic warning bar appears when you open a workbook, you can make that document trusted. The typical process in Excel involves clicking "Enable Content" in the message bar and, when the security warning appears, confirming that you want to trust the document . This will allow the macros in that file to run without further warnings on subsequent openings.
This is very practical when you always work with the same templates from a well-known source. If you ever change your mind, you can revoke trust by deleting the trusted documents from the Trust Center. Keep in mind that on computers managed by your organization, the administrator may prevent you from modifying certain security settings to maintain a consistent policy.
Change macro settings in the Trust Center
The heart of macro security lies in the Trust Center . To access it: File > Options > Trust Center > Trust Center Settings > Macro Settings. From there, you choose the level of restriction that best suits your context (personal, corporate, development, etc.).
- Disable all macros without notificationExcel blocks all macros and does not display warnings. In this mode, macros will only be executed from a specific location. Trusted locationIn Excel it appears as “Disable VBA macros without notification” and applies to VBA.
- Disable all macros with notificationThis is the default option. The file opens with a warning, and you decide whether to proceed. enable the content for that session (or make the document reliable).
- Disable all macros except digitally signed onesOnly macros signed by a publisher you have previously trusted are allowed; unsigned macros will trigger errors. alertsIn Excel, it appears as "Disable VBA macros except those that are digitally signed."
- Enable all macros (not recommended)Excel runs macros without asking. It's the most convenient option. insecure and it only makes sense in isolated or controlled test environments.
In addition, Excel includes a selector for legacy XLM macros: “Enable Excel 4.0 macros when VBA macros are enabled .” If you don't select this option, XLM macros are disabled without notification. This is an extra control to minimize legacy attack surfaces.
Finally, there's the "Trust access to the VBA project object model" checkbox . This option allows automated external programs to manipulate the VBA environment (for example, by generating code). It's best to leave it disabled and only enable it when a trusted solution truly needs it.
Blocking macros from the internet in Excel 365 and the OneDrive warning
Since 2022, Microsoft has tightened its policy for files with "Internet branding" (downloaded from email, the web, etc.). In these cases, you'll see messages like: " Security Risk . Microsoft has blocked the macros because the source is not trusted." This is normal and part of the strategy to prevent the execution of potentially dangerous code.
If the file comes from a trusted source and you need to use its macros, a quick solution is to save the file locally, right-click on it, open Properties , and check the "Unblock" box on the General tab. When you reopen it, Excel will allow you to run the macros (provided your security settings permit it). This removes the flag indicating that the file came from the internet.
In the case of books shared via OneDrive using a link, the file sometimes retains that mark. If you don't see the "Unlock" checkbox, save a copy to your computer and repeat the process, or add a Trusted Location (local folder) and work from there. Another corporate alternative is to digitally sign the project with a certificate from a trusted publisher within your organization.
If the computer is managed by your company (for example, with group policies), some options may be blocked. In that case, consult your IT team to assess the possibility of setting up trusted network locations or mandatory signature policies, and review the Google Workspace vs. Microsoft 365 comparison so you can work with macros without compromising overall security.
Enable macros depending on your version of Excel
Although the Trust Center is the universal route in recent versions, you'll see slight interface variations depending on the edition you're using. Here's an overview with best practices for each.
Excel 2010, 2013, 2016, 2019
When you open a file containing macros, a yellow bar with an "Enable Content" button usually appears . If you trust the source, simply click it. To change the default policy, go to File > Options > Trust Center > Trust Center Settings > Macro Settings , and select the appropriate level.
For convenience, many people enable "Enable all macros," but this is a bad idea except in isolated environments. It's preferable to keep " Disable with notification " enabled and use trusted documents or locations for the files you actually need to automate daily.
Excel 2007
In this version, when you open a workbook with macros, you'll see a Message Bar with a security warning; click "Options" and choose "Enable Content" if you trust the file. To modify the general policy, click the Office button (top left) > Excel Options > Trust Center > Settings > Macro Settings.
Here too it's tempting to activate " Enable all macros " to avoid seeing warnings, but remember: trusted locations solve that problem without opening the door to any code.
Excel 2000 and 2003 (legacy environments)
If you're still using very old versions, the path is Tools > Macros > Security . Many people used to choose "Low" to avoid warnings, but this is now discouraged. If you rely on these versions, consider moving your files to a trusted folder and upgrading to take advantage of modern security controls.
Trusted locations: folders where macros run without warning
A safe and convenient way to work with trusted macros is to create a Trusted Location . Any file opened from that folder will be considered trusted and will not display warnings, even if the general policy is set to "Disable with notification." This is especially useful when downloading templates from trusted authors or working with common corporate documentation.
To add a location: Open Excel and go to Developer > Macro Security > Trusted Locations > Add New Location > Browse. Select your folder (for example, “TRUSTFUL FILES”) and confirm. From then on, any workbook with macros that you save there will open without restrictions.
This approach addresses two typical scenarios: a file created by you (or your team) and one downloaded from the internet. In both cases, if you place them in the trusted folder, Excel will treat them as safe and allow you to run the code without displaying the security warning each time.
Other key options: Excel 4.0 (XLM) and access to the VBA object model
Regarding Excel 4.0 macros: as a general rule, keep them disabled unless you have a clear need and fully understand their origin. If you enable "Enable Excel 4.0 macros when VBA macros are enabled," remember that this setting applies to all files, so consider its impact on your security environment.
Regarding “Trust access to the VBA project object model”: leave the box unchecked unless a trusted add-in or script requires automating Excel through the VBA environment . Allowing this access opens the door to external automations that, if misused, can be problematic.
How to react to the message “Microsoft has blocked macros because the source is not trusted”
This warning often appears with books shared via OneDrive , email attachments, or web downloads. If you know and trust the author, you have several safe alternatives: mark the file as "Unblocked" in Properties, move it to a Trusted Location , or, even better, use a digitally signed book from a publisher that your team has marked as trusted.
On a shared PC, the cleanest approach is to establish a trusted local folder and open files from there only if their origin is verified. If you manage the team, you can also define trusted locations at an organizational level or require digital signatures for all macro projects. This reduces alerts and helps you maintain control.
Best practices to avoid "taking risks" with macros
A little digital hygiene works wonders. Here are some simple guidelines to avoid surprises with macros and, at the same time, take advantage of their potential without unnecessary friction, promoting safe and efficient use.
- Enable macros only when trust at the source. If you have any doubts, don't activate the content and consult the author.
- He prefers documents digitally signedIf the signature is valid and the publisher is trustworthy, you have much more guarantees.
- Works with Trusted Locations For recurring templates. You'll avoid warnings without lowering the security bar.
- Keep access to the object model of VBA unless a legitimate workflow requires it.
- Do not use “enable all macros"as a permanent policy. It's a dangerous shortcut."
- Update Office and your antivirus, and check the origin of the files before opening them.
Resources and related topics that may interest you
If you want to delve deeper, you can review content on how to change macro security settings in Excel with more examples, " Quick Start : Creating a Macro in Excel" guides, procedures for blocking suspicious macros in editions like Windows 10 S, and educational material on how malware can infect a computer. All of this will help you understand the reasons behind these policies and implement best practices.
The key is to combine convenience and security with sound judgment: use digital signatures (or your own certificates for testing), rely on trusted locations, keep unnecessary features disabled (such as XML or programmatic access to VBA), and decide on a case-by-case basis when to enable content . Following these guidelines, macros will remain a productivity ally without becoming a headache.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.