Outlook Is Cutting Off MSIX Attachments Over Security Risks

Outlook will block MSIX attachments starting in November as Microsoft tightens security around package files commonly used to install Windows apps.

Microsoft will begin blocking .msix and .msixbundle email attachments in Outlook on the web and New Outlook for Windows, according to Microsoft 365 Message Center ID MC1488841.

The company will add both extensions to the BlockedFileTypes list in OWA Mailbox Policy. Users will no longer be able to open or download these attachments unless administrators explicitly allow them.

The change will affect Microsoft’s default OWA policy as well as custom organizational policies.

Outlook will block MSIX attachments in November

Microsoft plans to start the rollout in early November 2026 and complete it by mid-November.

The change will apply across Worldwide, GCC, GCC High, and DoD environments.

Microsoft says most organizations should see little impact because MSIX packages are not commonly exchanged as email attachments.

Microsoft is targeting a known attack method

Microsoft is blocking the file types because attackers have previously abused MSIX packages in phishing and malware campaigns.

Attackers previously used the ms-appinstaller: protocol to convince users to install malicious packages. Microsoft disabled that protocol by default in 2023 after seeing repeated abuse.

The company also changed MSIX installation behavior so Windows generally downloads packages before installation, allowing local antivirus software to scan them first.

Blocking MSIX attachments in Outlook adds another barrier against malicious package delivery through email.

Admins can still allow MSIX attachments

Organizations that legitimately exchange MSIX packages by email can override the new restriction.

Administrators need to add .msix and .msixbundle to the AllowedFileTypes property of the relevant OwaMailboxPolicy.

That setting will allow users covered by the policy to continue opening and downloading those attachments after Microsoft’s default block takes effect.

In other Outlook news, Classic Outlook search is broken for shared mailboxes, while Outlook Web is getting a Copilot upgrade.

Via Neowin