Microsoft adds MSIX app packages to Outlook's default attachment block from early November
Microsoft will block .msix and .msixbundle attachments by default in Outlook on the web and the new Outlook for Windows from early November. Tenants that still mail app packages need a policy exception before general availability in mid-November.
The Watch · Security desk
What happened
- Microsoft is adding both file types to BlockedFileTypes in the default OWA Mailbox policy and in every custom policy already created in each tenant.
- Once a policy updates, users of the two clients can no longer send, receive, open or download .msix or .msixbundle attachments.
- Outlook began blocking .library-ms and .search-ms files in June 2025, after phishing and malware abuse dating to at least June 2022, including attacks on government entities.
- In October 2025 Microsoft said both clients would stop displaying risky inline SVG images that had been used in attacks.
Why it matters
- Who has to decide decision Tenants that distribute app packages by email must choose before mid-November between an AllowedFileTypes exception and moving that distribution off email.
- Who's exposed exposure Until the rollout reaches a given tenant, a mailed MSIX package still opens in both clients, so attackers keep the attachment route through the November window.
- What it sets up precedent Three restrictions on these two clients since June 2025 make more default file-type blocks the expected course, and custom policies offer no shelter from them.
Next story · Leadership · yesterday
Trade body for Amazon, Google and Meta funds study pricing EU cloud act at €115bnConfirmed2 publishers
The setting sits in OwaMailboxPolicy. "To enhance security in Outlook on the web and new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy," Microsoft said in a Microsoft 365 message center update [2].
An .msix file is a Windows installation package built for a specific architecture or configuration [7]. An .msixbundle packs several .msix packages into one file that works across architectures [7]. The block closes the attachment route for these packages only in the two clients Microsoft named [6].
Tenants that never use either type need to do nothing, according to Microsoft [9]. Tenants that do use them can add .msix and .msixbundle to the AllowedFileTypes property on their users' OwaMailboxPolicy objects [9]. The block covers both sending and receiving, so an allowance written to a policy reopens both directions for every mailbox assigned to it [15]. How wide the exception runs depends on how many mailboxes share that policy object [15].
"Most organizations are not expected to be affected by this update because these file types are infrequently used," Microsoft said [4]. The company called the change part of "ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments" [5]. The report does not tie the block to a named campaign that delivered MSIX packages by email.
The block on .library-ms and .search-ms came three years after the first recorded abuse of those types [16]. BleepingComputer places this run of changes inside a broader Microsoft effort to disable and remove Office and Windows features that attackers have abused in recent years [10].
What to watch
- A Microsoft 365 message center revision that moves the early-November start or the mid-November general availability date.
- Whether Microsoft extends the MSIX block beyond Outlook on the web and the new Outlook for Windows.
- Whether MSIX lures shift from attachments to download links once the block is live in tenants.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence78
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
After the policies are updated, .msix and .msixbundle attachments will be blocked by default, and users of Outlook on the web and new Outlook for Windows will no longer be able to send, receive, open, or download them.
- [2]
"To enhance security in Outlook on the web and new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy," Microsoft said in a Microsoft 365 message center update.
- [3]
"As part of this update, the .msix and .msixbundle file types will be added to the BlockedFileTypes list in the default OWA Mailbox policy and any custom policies created in your tenant."
- [4]
"Most organizations are not expected to be affected by this update because these file types are infrequently used," Microsoft said.
- [5]
"This update is part of our ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments," Microsoft said.
- [6]
Microsoft will add .msix and .msixbundle attachments to the list of blocked attachments in Outlook on the web and the new Outlook for Windows client starting in November.
- [7]
.msix files are modern Windows installation packages tailored for specific computer architectures or configurations; .msixbundle is a container that groups multiple .msix packages into a single file compatible with multiple architectures.
- [8]
The change begins rolling out to Exchange Online users in early November, when the file types are added to the BlockedFileTypes list in all OWA Mailbox policies, and is expected to reach general availability by mid-November.
- [9]
Admins don't need to take action if .msix or .msixbundle file types aren't used in their organization, but can allow them by adding them to the AllowedFileTypes property of their users' OwaMailboxPolicy objects.
- [10]
According to BleepingComputer, the move is part of a broader effort to disable and remove Office and Windows features that attackers have abused in attacks targeting Microsoft customers in recent years.
- [11]
In June 2025, Outlook began blocking .library-ms and .search-ms file types, which had been exploited in phishing and malware attacks since at least June 2022, including attacks targeting government entities.
- [12]
In October 2025, Microsoft announced that Outlook for Web and the new Outlook Windows client would no longer display risky inline SVG images that were being used in attacks.
- [13]
The MSIX block is the third restriction on what Outlook on the web and the new Outlook for Windows will handle since June 2025.
- [14]
Until the policy update reaches a tenant during the early-to-mid November rollout, .msix and .msixbundle attachments can still be sent, received and opened in those clients.
- [15]
Because the block covers both sending and receiving, an AllowedFileTypes exception on an OwaMailboxPolicy reopens both directions for every mailbox assigned to that policy; the exception's width depends on how many mailboxes share the policy object.
- [16]
The .library-ms and .search-ms block came three years after the earliest recorded abuse of those file types.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMicrosoft Outlook to block MSIX attachments starting November
1 article · October 7, 2026
- thenextweb.comMicrosoft will block two Windows installer formats in Outlook from November
1 article · October 7, 2026
Topics and entities
Topics
- Email Security
- Digital sovereignty
- Windows app packaging