Microsoft to block Excel Workbook Links to risky file types from 2025

Microsoft’s new FileBlockExternalLinks policy, introduced via the Microsoft 365 admin center, will expand existing File Block Settings, with Excel Build 2509 showing warnings for workbooks containing external links to newly blocked file types

Microsoft has announced a significant Excel security update that will begin rolling out between October 2025 and July 2026, aiming to reduce risks posed by unsafe file references. The tech giant plans to block external workbook links that point to potentially dangerous or unsupported file types by default.

Once the policy is in place, Excel files that reference these blocked file types will either return a #BLOCKED error or fail to refresh. This move is designed to safeguard users from phishing attacks and other threats where malicious workbooks redirect victims to harmful payloads.

The update introduces a new group policy setting — FileBlockExternalLinks — which expands the existing File Block Settings to cover external links. Microsoft explained the policy in a recent Microsoft 365 admin center post, noting that starting with Excel Build 2509, users will begin to see a warning bar when opening workbooks containing external links to blocked formats.

By the time Build 2510 is released, if administrators have not configured the policy, users will be unable to create or refresh links to these high-risk file types. “We recommend reviewing existing files and informing users about the upcoming changes to avoid workflow interruptions,” Microsoft advised.

Administrators who wish to maintain functionality for affected links can manually configure the Windows registry via the HKCU\Software\Microsoft\Office<version>\Excel\Security\FileBlock\FileBlockExternalLinks path, following guidance in Microsoft’s support documentation.

Expanding Microsoft’s security overhaul

This change is part of a wider security overhaul across Microsoft Office and Windows platforms. In 2024 alone, Microsoft has added .library-ms and .search-ms to Outlook’s blocked attachments list and disabled all ActiveX controls in Office 2024 and Microsoft 365 apps.

The broader initiative began in 2018 with expanded AMSI (Antimalware Scan Interface) support and has since included disabling VBA and Excel 4.0 macros, restricting XLL add-ins, and phasing out VBScript.

In a related security update, Microsoft also announced it has increased its bug bounty rewards to $40,000 for qualifying vulnerabilities in .NET and ASP.NET Core platforms.