Microsoft to block MSIX package attachments in Outlook starting November

Beginning in early November, Microsoft will prevent users from sending and receiving .msix and .msixbundle attachments through Outlook Web and the new Outlook for Windows. These modern installation package formats, which allow software to be tailored for specific system architectures, will join the platform's blocked attachment list by mid-November.

The .msix format represents a contemporary approach to Windows application packaging designed for particular hardware configurations or system setups. In contrast, .msixbundle serves as a wrapper that consolidates multiple .msix packages into a unified file that works across different computer architectures.

The rollout will begin with Exchange Online subscribers in early November, when both file types are added to the BlockedFileTypes list within all OWA Mailbox policies. Full deployment across all users is anticipated by the middle of the month. Once the change takes effect, recipients using Outlook on the web or new Outlook for Windows will be unable to send, receive, open, or download these file types.

Microsoft stated in a 365 message center notification: "To enhance security in Outlook on the web and new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy. As part of this update, the .msix and .msixbundle file types will be added to the BlockedFileTypes list in the default OWA Mailbox policy and any custom policies created in your tenant."

Organizations that do not rely on these file types require no administrative intervention. However, administrators who need to preserve functionality can re-enable the formats by adding them to the AllowedFileTypes property of their users' OwaMailboxPolicy objects.

Microsoft noted that "Most organizations are not expected to be affected by this update because these file types are infrequently used. This update is part of our ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments."

Broader security hardening campaign

This action represents one element of Microsoft's wider initiative to disable and remove Office and Windows capabilities that threat actors have weaponized against its customer base over recent years.

In June 2025, Outlook began blocking .library-ms and .search-ms file types, which attackers had been leveraging in phishing and malware campaigns since at least June 2022. These attacks targeted government organizations among other victims.

October 2025 brought another protective measure when Microsoft disabled the display of risky inline SVG images in Outlook for Web and the new Outlook Windows client, after these images were similarly exploited in active attacks.

A comprehensive inventory of all attachments that Exchange Server and Exchange Online users cannot save or view in Outlook on the web is maintained in Microsoft's official documentation.