Microsoft Outlook to block MSIX attachments starting November

Microsoft announced that starting November 2026, .msix and .msixbundle attachments will be blocked by default in Outlook on the web and the new Outlook Windows client. These file types are modern Windows installation packages and their blocking will be enforced by updating the BlockedFileTypes list in OwaMailboxPolicy for Exchange Online users. The rollout begins in early November and is expected to reach general availability by mid-November. Administrators can override this block by whitelisting these file types if needed. This measure is part of a broader security initiative to prevent exploitation of file types used in attacks targeting Microsoft customers.

The blocking of .msix and .msixbundle attachments will prevent users from sending, receiving, opening, or downloading these file types in Outlook on the web and the new Outlook Windows client by default. Organizations that rely on these file types for legitimate purposes may experience disruption unless they whitelist the file types. This change reduces the attack surface by preventing potentially unsafe installation package files from being delivered via email, mitigating risks associated with malware or phishing attacks leveraging these file types.

No action is required if your organization does not use .msix or .msixbundle attachments. If these file types are needed, administrators can whitelist them by adding them to the AllowedFileTypes property of their users' OwaMailboxPolicy objects. Microsoft manages the rollout through Exchange Online policies, and the update will be applied automatically starting November 2026. Organizations should review their usage of these file types and adjust mailbox policies accordingly.