💡 Our Technical Review in summary
- Microsoft is introducing a security enhancement for Excel that extends “File Block Settings” to external workbook links.
- Current Status: As of November 25, 2025, this change is currently on hold. Microsoft will provide updated timelines via the Message Center when they are ready to proceed.
- Once enforced, Excel will prevent workbooks from refreshing links to external files if those file types are restricted within the Trust Center.
- The goal is to reduce the attack surface by preventing data connections to potentially legacy or insecure file formats.
Impact
- User Experience (Build 2509): Users will see a warning business bar when opening workbooks containing links to blocked file types, alerting them to the upcoming enforcement.
- Enforcement (Build 2510): If the policy is not configured, users will no longer be able to refresh existing links or create new references to blocked file types.
- Data Integrity: Existing links will display the last successfully cached value but will fail to update, potentially leading to stale data in reports.
- Error Codes: New attempts to link to blocked file types will result in a
#BLOCKEDerror. - Visibility: The “Workbook Links” pane will explicitly flag links that failed to refresh due to security blockages.
Action Required
- Review File Block Settings: Audit your current Trust Center File Block configurations (Excel Options > Trust Center > Trust Center Settings > File Block Settings) to identify which file types are currently restricted.
- Inventory Critical Workbooks: Identify high-priority workbooks that rely on links to legacy formats (e.g., .xls, .xlt) and migrate them to modern formats (e.g., .xlsx, .xlsm) where possible.
- Configure Group Policy (Optional): If your organization requires continued access to links from blocked file types, administrators can bypass this change by setting the policy “File Block includes external link files” to Disabled.
- Registry Manual Override: For individual machines or testing, set the following Registry key to 0:
HKCUSoftwareMicrosoftOffice16.0ExcelSecurityFileBlockFileBlockExternalLinks. - User Communication: Prepare to notify users about the
#BLOCKEDerror and the “Workbook Links” pane updates once Microsoft announces the new rollout dates.
Microsoft Official Update
Service: N/A
Category: planForChange
Severity: normal
Updated November 25, 2025: This change is currently on hold. We will communicate via Message center when we are ready to proceed. We apologize for any inconvenience this may have caused and thank you for your patience.
Introduction
To enhance workbook security, a new group policy is being introduced to expand File Block Settings to external workbook links. This policy allows administrators to control whether links to blocked file types can be refreshed.
If not configured, no changes will take effect immediately. However, starting November 2025, the default behavior will block external links to file types currently blocked by the Trust Center. When this policy is enabled, new references to blocked file types will return a #BLOCKED error. Existing links will display the last successfully refreshed values but will no longer refresh.
When this will happen
General Availability: We will update this Message center post when we are ready to proceed.
How this affects your organization
- Policy not configured: No immediate change will occur.
- Build 2509 warning bar: Users will see a business bar when opening workbooks containing external links to blocked file types, alerting them to the upcoming change.
- Build 2510 enforcement: If the policy remains unconfigured, users will no longer be able to refresh or create new references to blocked file types.
- Existing links behavior: External links will retain the last successfully loaded value but will not refresh.
- New links behavior: Creating a new external link to a blocked file type will return a
#BLOCKEDerror. - Workbook Links pane: Will indicate which workbooks failed to refresh due to being blocked.
What you can do to prepare
Administrators who need to allow workbook links to blocked file types can revert to the previous behavior using the following methods:
- Registry setting: Set
HKCUSoftwareMicrosoftOffice16.0ExcelSecurityFileBlockFileBlockExternalLinksto 0. - Group Policy setting:
Set File Block Includes External LinkFiles toDisabled: Excel Group Policy Template > Excel Options > Security > Trust Center > File Block Settings > File Block includes external link files
We recommend reviewing existing workbooks and communicating this change to users who rely on external links to ensure continuity of workflows.
Learn more: Macros from the internet are blocked by default in Office
Learn more: External Workbook Links to Blocked File Types Will Be Disabled by Default
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.
