Microsoft to block MSIX attachments in Outlook by mid-November

Microsoft will block .msix and .msixbundle attachments in new Outlook and Outlook on the web starting early November 2026 unless admins allow them.

Microsoft will add .msix and .msixbundle to the default blocked attachment list for New Outlook for Windows and Outlook on the web in Exchange Online. The Register said the change, set for early to mid-November 2026, stops users from downloading or opening those packages unless an administrator allows them. BleepingComputer said the types join BlockedFileTypes in every OWA mailbox policy, with rollout starting in early November and general availability by mid-November, and that users also cannot send or receive them. Both reports say administrators can permit the extensions through AllowedFileTypes on the relevant OWA mailbox policy. Microsoft said most organizations rarely use the formats and tied the move to earlier blocks of .library-ms, .search-ms, and risky inline SVG images; The Register also noted the ms-appinstaller protocol handler was disabled by default in December 2023 after malware abuse. The sources agree on the file types, products, and November window, and differ only in that BleepingComputer explicitly includes sending and receiving in the block.

• Microsoft will block .msix and .msixbundle attachments in New Outlook for Windows and Outlook on the web in Exchange Online.
• The types will be added to BlockedFileTypes in every OWA mailbox policy.
• Rollout is scheduled for early to mid-November 2026, with BleepingComputer saying it starts in early November and reaches general availability by mid-November.
• Users cannot open or download the attachments unless an administrator allows them; BleepingComputer also says they cannot send or receive them.
• Administrators can permit the extensions via the AllowedFileTypes property of the relevant OwaMailboxPolicy before rollout.
• Microsoft said most organizations rarely use the formats and linked the change to earlier blocks of .library-ms, .search-ms, and risky inline SVG images.
• Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after attackers abused it to distribute malware.