- Microsoft Excel will now disable blocked file types from workbook links by default
- The files will either fail to refresh or show a #BLOCKED error
- Other safety updates are coming to Excel soon, so be sure to update
External workbook links which point to file types blocked by Excel’s Trust Center will be disabled by default starting in October 2025, as Microsoft tightens down on reducing the potential security risks associated with indirect access to unsupported or high-risk file types in its spreadsheet software.
When the policy comes into play, workbooks with those types of links will either fail to refresh or show a #BLOCKED error.
Microsft confirmed users would see a business-bar banner warning in Build 2509, but new or refreshed links to blocked file types will be stopped from Build 2510 if the policy remains unconfigured by users or admins.
Excel to disable external workbook links to blocked file types
Once the change takes effect, any file type listed within the Trust Center’s File Block Settings will be blocked when referenced through external links. “Inspecting the error will confirm it’s due to a restricted file type,” Microsoft added in a support page.
Microsoft doesn’t recommend re-enabling refreshing external links to blocked file types: “Disabling these protections reduces security and should only be done with caution.”
Users willing to take that risk can open the Registry editor, click ‘Start’, click ‘Run’, type ‘regedit’, and then click ‘OK’. Performing a backup of the registry prior to making changes is highly recommended.
By disabling them by default, Microsoft will close a pathway often used in phishing and other malware delivery that exploits indirect access to risky file types.
A separate listing in the Microsoft 365 roadmap entitled “New Trust Center settings to block file opens using insecure protocols” explains “new settings in Trust Center will allow users to restrict or allow file opens uing FTP/HTTP protocols and fallback to FrontPage Remote Procedure Call (FPRPC) protocol.” That change is expected to roll out this month.
