Microsoft is extending Outlook's attachment block list to include .msix and .msixbundle files, two formats used for Windows application packages and bundles. The change applies to New Outlook for Windows and Outlook on the Web in Exchange Online. By default, users will no longer be able to download or open attachments with these extensions, a step Microsoft says is part of ongoing efforts to protect organizations from unsafe file attachments.
The company notes the file types are "infrequently used," but legitimate uses do exist. Administrators who need to allow them can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the rollout, scheduled for early to mid-November 2026.
The move is not surprising given the history of Windows app packaging abuse. Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after attackers used it to distribute malware. Blocking the attachment types adds another layer of protection, though renaming a file or sending a download link can still bypass the restriction—neither makes the package safe to install.