Blocked Macros on OneDrive Files

Question

My small business uses a shared OneDrive account (not my own) to store all our client working files, which the team accesses together.  We use custom Excel templates with advanced macros that are essential for our work. Before switching to a new computer, I could access the shared drive, download Excel files, work on them, and save them back to OneDrive. The macros worked smoothly across all files.

After moving to a new computer, I can no longer open files with functional macros. When I try to open an Excel file, a pink ribbon banner appears with the message: "SECURITY RISK—Microsoft has blocked macros from running because the source of this file is untrusted."

Note the following:

·         We have not changed the OneDrive shared folder.

·         I have not changed MS app subscriptions, user names, etc.

·         I have Windows 11 Pro and the MS 365 Family Office subscription

·         I have an HP PC desktop

I have followed all of the steps in the “Learn More” link that comes with the above error message as follows

·         Unblock a single file: In the proateirs card, the Security text and “unblock” button described are not present

·         Internet Options: I have added the shared folder to the Trusted Sites window with no effect ( I have included the share folder, sub-folders, etc.)

·         Unblock a trusted publisher: not able to find the controls described.

I need to have the same capability that I had prior to switching PCs.  It is not possible to work in the online version of Excel, nor is it possible to treat files specifically. We open and share too many in a day for there to be issues with version control.

Answer 1

The new PC is treating the downloaded OneDrive files as coming from the Internet and adding Mark of the Web (ZoneId=3), so Excel blocks macros by default. To restore the previous behavior, the files must either lose Mark of the Web or come from a location/zone that Office trusts.

Use these approaches that scale for many files:

1. Remove Mark of the Web from downloaded files
   • When a file is downloaded to Windows, it gets Mark of the Web if it’s from the Internet or Restricted sites zones. Files with ZoneId=3 (Internet) have macros blocked by default.
   • To unblock macros in a file on the local device, remove Mark of the Web:
     1. Save the file locally.
     2. In File Explorer, right‑click the file > Properties.
     3. On the General tab, select the Unblock checkbox (if present) and select OK.
   • If the Unblock checkbox is missing or there are many files, use PowerShell’s Unblock-File cmdlet to remove the ZoneId for multiple files in a folder. Removing the ZoneId value allows VBA macros to run by default and is equivalent to selecting Unblock in Properties.
2. Prefer opening directly from OneDrive using the sync client or “Open in Desktop App”
   • If the OneDrive sync client downloads a file, that file does not have Mark of the Web.
   • Files in Windows known folders (Desktop, Documents, Pictures, Screenshots, Camera Roll) that are synced to OneDrive also do not have Mark of the Web.
   • For files stored on OneDrive or SharePoint (including those used by Teams):
     • Have users open the file using the Open in Desktop App option from OneDrive/SharePoint. Files opened this way do not get Mark of the Web.
     • Or ensure the shared OneDrive folder is synced locally via the OneDrive sync client and work from the synced folder path instead of downloading via a browser.
3. Use Trusted Locations for a shared macro-working folder
   • For users (or a department such as Finance) that must use macro-enabled files from OneDrive/SharePoint without macros being blocked:
     • Have them download the files to a folder configured as a Trusted Location in Office, then open and work from there.
     • This avoids per-file unblocking and keeps macros enabled for all files in that folder.
4. Configure OneDrive/SharePoint domains as Trusted Sites (admin-level change)
   • If the shared OneDrive is accessed via a browser and files are downloaded, the Windows Internet security zone configuration determines whether Mark of the Web is set.
   • Admins can use the “Site to Zone Assignment List” Group Policy to place the organization’s OneDrive/SharePoint domains (for example, https://{your-domain-name}-my.sharepoint.com) into the Trusted Sites zone. Files downloaded from Trusted Sites (ZoneId=2) do not have macros blocked by default.
   • This is a broad trust decision and should be managed carefully, because macros from these locations will not be blocked.
5. Verify zone and Mark of the Web behavior
   • To confirm why a file is blocked:
     • Check its ZoneId by running:

              notepad {file-name}:Zone.Identifier
       

       If ZoneId=3 (Internet), macros are blocked by default.
   • To see which locations are in Trusted sites or Local intranet zones, go to Control Panel > Internet Options > Security > select each zone and view the site list.

In practice for this scenario:

• Ensure the shared OneDrive is synced locally via the OneDrive sync client and always open the Excel files from the synced folder or via Open in Desktop App. Those files will not have Mark of the Web, so macros will run as they did on the old PC.
• If some files are already downloaded and blocked, bulk-unblock them using Unblock-File or by moving them into a Trusted Location and removing Mark of the Web once.

---

References:

• Macros from the internet are blocked by default in Office
• Block suspicious macros in Office on Windows 10 S
• What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams