GoKawiilMicrosoft to block .msix and .msixbundle email attachments in Outlook
Microsoft will add .msix and .msixbundle files to Outlook's default blocked attachment list starting early November, rolling out to Exchange Online users with general availability expected by mid-November. Once applied, Outlook on the web and the new Outlook for Windows will block users from sending, receiving, opening or downloading these file types by default. Admins can whitelist the formats via the AllowedFileTypes property if their organization needs them.
GoKawiil's interpretation of the reporting above, not reported fact.
The change reflects Microsoft's ongoing pattern of disabling file types and features that have been exploited in malware attacks, following earlier restrictions on other attachment formats in Outlook. Because .msix packages can install software, blocking them by default reduces a potential delivery vector for malicious installers sent via email. Microsoft says most organizations won't be affected since these formats are rarely used, suggesting the move targets a narrow but real security risk.
- Outlook will block .msix and .msixbundle attachments by default starting November, reaching general availability by mid-November.
- Admins can restore functionality by adding these file types to the AllowedFileTypes property in OwaMailboxPolicy.
- The update continues Microsoft's broader effort to curb file types previously abused in attacks on its customers.
Source: bleepingcomputer.com, 2026-10-07
Published there as: “Microsoft Outlook to block MSIX attachments starting November”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.