Microsoft Outlook to Block MSIX and MSIXBUNDLE Attachments Starting November

New Attachment Blocks Implemented

Microsoft announced that it will add .msix and .msixbundle files to the list of blocked attachments in Outlook Web and the new Outlook Windows client. This change will prevent users from sending, receiving, opening, or downloading these file types by default.

Rollout Schedule

The update will begin rolling out to Exchange Online users in early November. The new file types will be added to the BlockedFileTypes list in all OWA Mailbox policies, with general availability expected by mid-November.

Purpose of the Change

Microsoft stated this update is to enhance security in Outlook on the web and the new Outlook for Windows. It is part of a broader initiative to disable features that attackers have exploited in past attacks against Microsoft customers. Most organizations are not expected to be affected as these file types are infrequently used.

Administrator Actions

Admins do not need to take action if their organization does not use .msix or .msixbundle files. However, if these file types are required, admins can whitelist them by adding them to the AllowedFileTypes property of their users' OwaMailboxPolicy objects.

Broader Security Initiatives

This move follows previous security updates, including the blocking of .library-ms and .search-ms file types in June 2025, which were exploited in phishing and malware attacks. In October 2025, Microsoft also stopped displaying risky inline SVG images in Outlook for Web and the new Outlook Windows client due to their use in attacks.