The short version: if your estate sits on Semi-Annual Enterprise Channel, version 2606 merges you into Monthly Enterprise Channel and hands you fifteen months of accumulated change in one go. Nothing shipped this month that broke anything. What arrived this month was the backlog.
Two organisations contacted us this week with variations of the same message. Both had the MDS Excel add-in stop working after what one of them called “a current O365 feature upgrade”, and both assumed Microsoft had just shipped something that killed it. So they go through this month's release notes and find nothing, which is exactly what you'd expect when the change you're hunting for is more than a year old.
The change everyone lands on first
In build 2504, Microsoft turned off ActiveX by default across Office. Sensible enough; ActiveX has been an attack surface for two decades. If you run the MDS Excel add-in, this is the item in the backlog you'll hear about, because Microsoft notes on the add-in’s product page that you must enable ActiveX controls in Excel, “otherwise the data from the MDS database might not complete the load”.
Be careful how much weight you put on that, though. The internet has turned it into a certainty it hasn't earned, and we were repeating that certainty ourselves until fairly recently. Microsoft added the note in December 2023, sixteen months before build 2504, so it describes an existing quirk of the add-in and not a consequence of that update. The wording hedges too: “might not complete the load”. Then there is the machine sitting next to me, on Semi-Annual Enterprise Channel, running 2606 with ActiveX off by default, where the add-in loads and publishes without a murmur. So put ActiveX on your list of things to rule out, somewhere below the two faults that actually take the ribbon away.
If your add-in is the thing that stopped, work through the causes properly rather than assuming this one: the three faults worth checking, and how to tell them apart. A missing Master Data tab and a tab that loads no rows are different problems with different fixes.
ActiveX is only the headline item. Fifteen months of an Office release train covers a great deal more than one security default, and whatever else in that window touches your estate arrived on the same day.
So why is it hitting you now?
Because you were on Semi-Annual Enterprise Channel, and that was the whole point of being there. Two feature updates a year, each one already run in by everyone on Current Channel. It's the channel you pick when you have thousands of seats, a change advisory board, and no appetite for surprises.
It worked as designed. While Current Channel users lost the add-in in spring 2025, your estate sat on version 2508 and carried on.
That ended in June, when Microsoft published MC1274325. From version 2606, released this month, Semi-Annual Enterprise Channel and Monthly Enterprise Channel become one channel. Devices on SAEC receive 2606 through their normal update process. No admin action, and no announcement your users would recognise. Microsoft puts the download at around 1.6 GB, which tells you how much is in it.
Somewhere in that 1.6 GB is the ActiveX default from April 2025, along with every other change Microsoft shipped between then and now. Your users open Excel on Monday morning on an Office that is fifteen months newer than the one they closed on Friday, and nobody told them.
The date that matters more than this month
If you've pinned your update tooling to hold 2606 back, you've bought weeks. Microsoft supports Semi-Annual Enterprise Channel version 2508 until 8 September 2026, and after that the choice is between an unsupported Office build and an add-in nobody maintains. Six weeks or so from the day this post goes up.
How to check where you stand
On one machine, open Excel and go to File → Account. The panel names your update channel and gives a version and build, written as “Version 2504 (Build 18730.20142)”. If that first number is 2504 or higher, ActiveX is already off by default on that machine.
To see the ActiveX state itself rather than infer it from the version, go to File → Options → Trust Center → Trust Center Settings → ActiveX Settings. The new default selects Disable all controls without notification. Anything else selected means someone has moved it, and there's your answer.
For a machine you can't sit at, or a script you want to push across the estate, the same facts live in the registry. There are two places to look, which is the part people get wrong: Group Policy writes to a Policies key, the Trust Center writes to a separate one, and the policy wins where both are set. Read only one and you'll draw the wrong conclusion.
$c2r = 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration'
$usr = 'HKCU:\Software\Microsoft\Office\Common\Security'
$gpo = 'HKCU:\Software\Policies\Microsoft\Office\Common\Security'
$cfg = Get-ItemProperty $c2r
$build = [int]($cfg.VersionToReport -split '\.')[2]
$p = (Get-ItemProperty $gpo -ErrorAction SilentlyContinue).DisableAllActiveX
$u = (Get-ItemProperty $usr -ErrorAction SilentlyContinue).DisableAllActiveX
$eff = if ($null -ne $p) { $p } elseif ($null -ne $u) { $u } else { $null }
$state = if ($eff -eq 0) { 'ON - override in place' }
elseif ($eff -eq 1) { 'OFF - explicitly disabled' }
elseif ($build -ge 18730) { 'OFF - blocked by the 2504 default' }
else { 'ON - pre-2504 default' }
$channel = switch -Wildcard ($cfg.CDNBaseUrl) {
'*492350f6-3a01-4f97-b9c0-c7c6ddf67d60*' { 'Current Channel' }
'*55336b82-a18d-4dd6-b5f6-9e5095c314a6*' { 'Monthly Enterprise' }
'*7ffbc6bf-bc32-4f92-8982-f9dd17fd3114*' { 'Semi-Annual Enterprise' }
default { $cfg.CDNBaseUrl }
}
"Build : $($cfg.VersionToReport)"
"Channel : $channel"
"Policy : $(if ($null -ne $p) { $p } else { 'not set' })"
"User : $(if ($null -ne $u) { $u } else { 'not set' })"
"ActiveX : $state"On a machine that has the change, it prints something like this:
Build : 16.0.20131.20154 Channel : Current Channel Policy : not set User : not set ActiveX : OFF - blocked by the 2504 default
The build number decides it. Version 2504 starts at build 18730, and that middle number only ever climbs, so anything at or above it carries the new default whichever channel delivered it. A device still reporting Semi-Annual Enterprise Channel on a lower build hasn't taken 2606 yet, and that gap is your remaining window.
Two things trip people up here. The first: your other Excel add-ins carrying on as normal proves nothing at all. Most add-ins never touch ActiveX, so they're unaffected either way. Power Pivot, Data Streamer and the Acrobat toolbar all keep working on a machine where ActiveX is fully blocked.
The second: when no registry value is set, the script reports the default for your build. It doesn't read what Excel actually applies. A 0 on the Policy or User line means someone deliberately turned ActiveX back on, quite possibly through Group Policy years ago for a reason nobody remembers, and that machine now runs with document security relaxed across every Office application. If you can sit at the machine, believe the Trust Center over this script.
One thing this is not
It would be easy to read this as Microsoft phasing out COM and VSTO add-ins in Excel. That isn't happening, and if you tell your architecture board it is, someone will check.
The retirement is real for Outlook: classic Outlook moves onto a deprecation path in 2026 and the new client doesn't support VSTO or COM add-ins at all. For Excel, Word and PowerPoint, Microsoft has announced no end-of-support date for either model. Your other Excel add-ins are fine, and so is the MDS add-in as far as the add-in model goes. It loads through that same VSTO mechanism. What moved underneath it was a security default.
What you can actually do
If you've worked through the causes and ActiveX really is yours, the registry key still works. Set DisableAllActiveX to 0 under HKCU\Software\Microsoft\Office\Common\Security, push it through Group Policy, and you have your rows back today.
Before you do, look at what that switch actually controls. It's called DisableAllActiveX for a reason: it isn't scoped to the MDS add-in, or even to Excel. Turning it off restores ActiveX for Word, Excel, PowerPoint and Visio, across every document those applications open, including the one that arrives as an email attachment.
Microsoft didn't disable it for tidiness. ActiveX controls embedded in Office documents have been used to deploy TrickBot and Cobalt Strike into enterprise networks, and the model carries a long history of zero-days used by criminal and state-backed groups alike. The previous default was a prompt, and social engineering defeats prompts reliably. The whole point of the change was to stop asking users a question they were never equipped to answer.
Then think about who you'd be granting the exception to. Data stewards: the people whose machines reach your master data and your chart of accounts. Of all the places in the estate to weaken document security, that group is close to the worst you could pick.
The exception may not last either. The override works today, but Microsoft has closed similar escape hatches before, once enough of the estate had moved to the secure default. If that happens you're back where you started, only this time you didn't plan for it.
All of that to keep alive a client for a product that isn't in SQL Server 2025. Master Data Services shipped its last version in SQL Server 2022. No successor, no team.
Plenty of organisations will do it anyway, and if you're a few months out from a planned migration, that's a defensible call. Just write it down as a temporary exception with an end date on it, because that's what it is.
The uncomfortable version
Whatever the cause turns out to be, an add-in that stops working is the first time in years that MDS being abandoned has produced a consequence somebody outside IT can feel. Your data stewards don't care that the product is deprecated. They care that the Excel tab they've opened every Tuesday morning for six years has stopped doing its job, and that nobody can tell them when it'll be back. In our experience that is usually the week the migration conversation finally gets budget.
If you're at that point, we built Primentra for this handover. It runs on your own SQL Server, it maps MDS models, entities and attributes onto the same concepts, and the editing grid is a browser page rather than an add-in a future Office update can switch off. A 60-day trial installs in about an hour.
If you're working out what happens after MDS, do get in touch. Happy to share what we've seen from other migrations, including the parts that were harder than we expected.