Add-ins can add a lot of functionality to Microsoft 365, but they are often used by people with bad intentions to distribute malware to unsuspecting victims.
Add-ins aren't required for everyday use like reading or editing Excel workbooks. In most cases you can do everything you need to do in Excel without allowing add-ins to run.
A .XLL file is an Excel add-in file. It allows users to extend the functionality of Microsoft Excel by adding custom functions or other features.
An untrusted location is a place, generally on the internet, where files can be stored by other people. If you, or your organization, hasn't designated that location as trusted, it's considered untrusted because the source and contents of the files can't be confirmed.
What should I do now?
Still wondering if you should proceed?
❒ Were you expecting to receive an add-in? Never open a file attachment you weren't expecting, even if it appears to come from somebody you trust. Phishing attacks often appear to come from a person or organization you trust in an effort to get you to open them.
❒ Are you being encouraged to enable content by a stranger? A common tactic of attackers is to create some pretense such as cancelling an order or reading a legal document. They'll have you download an add-in and try to persuade you to allow the add-in. No legitimate company will make you open an Excel file to cancel an order and you don't need add-ins just to read a workbook in Excel.
❒ Are you being encouraged to enable content by a pop-up message? If you downloaded the file from a website, you may see pop-ups or other messages encouraging you to enable active content. Those are also common tactics of attackers and should make you suspicious that the file is actually unsafe.
If a downloaded file from the internet or a file opened from a network share wants you to allow an add-in, and you're not certain what that add-in does, you should probably just delete that file.
If you’re sure the add-in is safe and want to unblock it
There are a few different ways to do it, depending on your situation.
Unblock a single Excel XLL Add-in
In most cases you can unblock an XLL by modifying the properties of the file as follows:
-
Open Windows File Explorer and go to the folder where you saved the file.
-
Right-click the file and choose Properties from the context menu.
-
At the bottom of the General tab, select the Unblock checkbox and select OK.
Unblock all files from a specific network share or website
If you often download files or directly open files from a trusted cloud location, such as your company’s website or an internal file server, you can set the site as a trusted site in Windows so XLL files from the site won’t be checked.
Important: You’ll trust all the files from this site if you choose to apply this setting, so only do this if you know that every file opened from this location is trustworthy.
-
Tap the start button or Windows key and type Internet Options.
-
Select Internet Options from the search results and the Internet Properties dialog box will appear.
-
On the Security tab, select Trusted Sites, then select Sites.
-
Type the URL of the site or server that contains the Microsoft 365 files with the XLL files you want to run, and then select Add.
Note: If you want to add URLs that begin with http:// or network shares, uncheck Require server verification (https:) for all sites in this zone.
-
Select Close and then OK.
Select a heading below for more information
If the file you want to trust was sent to you through email, you can:
-
Save it to your OneDrive before opening it. -or-
-
Save it to your computer’s hard drive then follow the instructions for unblocking a single file, above.
If you're comfortable that the source of the add-ins is a person or company that you know, you can add them as a trusted publisher to unblock this add-in and any future add-ins the publisher signs with the same certificate.
First, you'll need to unblock this particular file using the steps above, Then, you can add the publisher as a trusted publisher so that future add-ins will run seamlessly.
See Add, remove, or view a trusted publisher for more information.
If you have a specific folder on your computer with many files that are blocked, and you want to trust every file in this folder, you can add it as a Trusted Location.
Warning: You should only do this if you know that every file saved here is trustworthy.
In Excel:
-
Select File > Options.
-
Select Trust Center > Trust Center Settings > Trusted Locations.
-
Select Add new location.
-
Select Browse to find the folder, select a folder, and then select OK.
If you need time to modify your workflow to unblock add-ins using one of the methods above, you can choose receive an additional warning for Excel XLL Add-ins that come from untrusted locations after choosing to enable them.
Important: This should only be done as a temporary measure to unblock Excel XLL Add-ins.
To receive a warning instead of a block, you’ll need to add a value to your Windows registry.
Important: The following steps show you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Please make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, go to How to back up and restore the registry in Windows.
Open the Registry editor
-
To open Registry Editor, click Start, click Run, type regedit, and then click OK.
-
Back up your registry .
-
Before making any changes to the registry it's always best practice to make a backup of your current registry. Select File > Export and create an export file of your registry. Set the export range to All and give it a name like that makes sense to you such as "Registry backup".
Tip: For more information see How to back up and restore the registry in Windows.
-
Navigate to the following key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security
-
Add the new value: Select Edit > New > DWORD (32-bit) Value to create the value.
-
Name the key: BlockXLLFromInternet
-
Select Edit > Modify and set the Value data to 0.
-
Exit Registry Editor
-
Fully Close Excel
Important: You need to fully close and reopen Excel for this change to take effect.
Still unable to unblock the add-in?
Visit the Microsoft Answers community to see what others have said or ask your own questions.
