Microsoft Outlook to Block MSIX Attachments in Web and New Windows Client

Microsoft announced that it will expand its list of blocked email attachments to include .msix and .msixbundle files. The company confirmed that this security measure will be enforced in Outlook Web and the new Outlook for Windows client starting next month, according to a report by BleepingComputer.

This update adds two specific file extensions to the existing blocklist that Microsoft maintains for its email platforms. By preventing these files from being delivered as attachments, Microsoft aims to mitigate potential threats associated with executable software packages. The change applies specifically to the web-based version of Outlook and the newer Windows client application.

Context and Background

Microsoft has long maintained a blocklist of file extensions that are prohibited from being sent as email attachments. This security control is designed to prevent users from inadvertently downloading malicious software, such as malware or ransomware, disguised as common file types. Over the years, the company has periodically updated this list to include newer or more dangerous file formats as threat actors evolve their tactics.

The .msix and .msixbundle formats are modern Windows application package formats. While they are legitimate tools for software distribution and deployment, they can also be exploited by attackers to deliver malicious code. By blocking these attachments, Microsoft is extending its existing protections to cover these newer package types, aligning with broader industry efforts to reduce the attack surface of email clients.

Who Is Affected

Users of Outlook Web and the new Outlook for Windows client will be directly affected by this change. Starting in November, any email containing a .msix or .msixbundle attachment will be blocked by the service. The attachment will not be delivered to the recipient’s inbox, and the sender may receive a non-delivery report or error message indicating that the file type is not permitted.

Users of the classic Outlook desktop application for Windows are not explicitly mentioned in the announcement regarding this specific update. However, Microsoft often aligns security policies across its platforms over time. Organizations relying on the classic client should monitor for future updates that may extend these restrictions. Users who need to share these file types must use alternative methods, such as cloud storage links or secure file transfer services, rather than attaching them directly to emails.

What should you do?

Security teams should prepare for this change by informing users that .msix and .msixbundle files will no longer be deliverable via email attachments in the affected clients. IT administrators should ensure that alternative file-sharing methods are available and that users are trained on how to use them securely. Once the vendor provides an update or further guidance, organizations should verify that their email security policies reflect these new restrictions.

What to do and how to stay safe: Microsoft

• Review internal communication policies to ensure users know how to share MSIX files using approved cloud storage or file transfer services.
• Monitor email logs for any errors or non-delivery reports related to blocked MSIX attachments after the change takes effect.
• Educate users on the security reasons for blocking executable package formats and the risks of opening such files from untrusted sources.
• Verify that alternative file-sharing solutions comply with organizational data security and compliance requirements.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When will Microsoft start blocking MSIX attachments in Outlook?

Microsoft will start blocking .msix and .msixbundle attachments in Outlook Web and the new Outlook for Windows client starting in November.

Which Outlook clients will block MSIX attachments?

The block will apply to Outlook Web and the new Outlook for Windows client. The classic Outlook desktop client is not explicitly mentioned in the current announcement.

Can I still send MSIX files to colleagues?

You cannot send them as direct email attachments in the affected clients. You must use alternative methods, such as cloud storage links or secure file transfer services, to share these files.