Microsoft blocks .msix and .msixbundle files in Outlook for security

Microsoft is enhancing security in its Outlook email service by blocking two additional file types: .msix and .msixbundle. These file extensions are used for Windows application packages and bundles. The change applies to New Outlook for Windows and Outlook on the Web in Exchange Online. By default, users will no longer be able to download or open these attachments, which could otherwise be exploited to compromise devices.

Although Microsoft describes these file types as "infrequently used," there are legitimate reasons for their presence in emails. Administrators who need to allow these attachments can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the update rolls out in early to mid-November 2026.

The move is part of Microsoft's broader efforts to strengthen security against potentially unsafe file attachments. The company has previously taken steps to disable the ms-appinstaller protocol handler by default after attackers abused it to distribute malware. Other file types already blocked by Outlook on the Web include .py Python files, .ps1 PowerShell files, and .cab files.

While renaming an attachment's extension or sending a download link may bypass the block, neither approach makes the package safe. Cybercriminals could still persuade users to download and install malicious files, despite other protections in place.