Macro blocking is a security control that prevents Microsoft Office macros from running in files downloaded from the internet or other untrusted sources. Macros are small scripts used to automate tasks in Word, Excel, and similar applications, but they can also launch commands, download malware, or modify files. Blocking them by default reduces the chance that a user’s first click turns a document into code execution.
This control matters because Office documents are a common malware delivery format. Attackers often send malicious spreadsheets or documents that rely on the user enabling content. With macro blocking and Mark of the Web checks, many internet-sourced files open with active content disabled, forcing an attacker to use other techniques or the victim to bypass warnings. Defenders pair this with attachment filtering, sandboxing, and process monitoring to catch attempts to re-enable or sideload malicious code.