Microsoft will begin blocking Outlook MSIX attachments by default in November 2026, introducing new restrictions for Windows installation packages. The change affects Outlook on the web and the new Outlook for Windows for Exchange Online users.
The rollout should begin in early November and reach general availability by the middle of the month. Microsoft expects limited disruption because most organizations rarely use these attachment formats.
Two Windows Installer Formats Join the Blocked List
The update covers files with the .msix and .msixbundle extensions. Both formats support Windows software installation, but they serve slightly different purposes.
An .msix file contains an installation package for a particular computer architecture or configuration. Meanwhile, an .msixbundle combines multiple packages into one file, allowing distribution across different architectures.
Microsoft will add both extensions to the BlockedFileTypes setting in OWA Mailbox policies. This includes the default policy and any custom policies within an organization’s tenant.
Once the change takes effect, affected users will no longer be able to send, receive, open or download these attachments through the covered clients.
Organizations Can Review Their Attachment Policies
Organizations that do not exchange these installation packages need no administrative changes. The new default restrictions will apply through the policy update.
However, businesses that rely on Outlook MSIX attachments should review their software distribution workflows before November.
Microsoft says administrators can explicitly allow the formats through the AllowedFileTypes property in the relevant OwaMailboxPolicy objects. This provides an exception for organizations with a legitimate need to exchange these files.
The announced rollout specifically covers Outlook on the web and the new Windows client. It does not announce an equivalent change for every Outlook application.
Microsoft Continues Tightening Attachment Security
The upcoming restrictions form part of Microsoft’s broader effort to reduce exposure to features and file formats that attackers abuse.
In June 2025, Outlook began blocking .library-ms and .search-ms attachments. Attackers had used those formats in phishing and malware campaigns since at least June 2022, including attacks against government organizations.
Later, in October 2025, Microsoft announced restrictions on inline SVG images in Outlook on the web and the new Windows client. Those images had also appeared in attacks.
By adding Windows installation packages to its default blocked list, Microsoft aims to reduce another potential route for unsafe email attachments.
November Rollout Leaves Time to Prepare
For most organizations, the update should require little preparation. However, teams that distribute installers by email should identify any affected processes before the rollout begins.
Administrators can then determine whether their users need a policy exception. Meanwhile, informing affected staff ahead of time can help prevent confusion when the attachment restrictions arrive.
0 responses to “Microsoft to Block Outlook MSIX Attachments Starting in November”