Outlook to reject MSIX attachments by default next month
Microsoft will add .msix and .msixbundle files to Outlook's blocked attachment list for Outlook on the web and the new Outlook for Windows. The rollout begins for Exchange Online in early November and should be broadly available by mid-November. Administrators can allow the file types through mailbox policy settings if their organizations need them.
Microsoft will classify .msix and .msixbundle as blocked attachment types in Outlook on the web and the new Outlook for Windows. The former are architecture- or configuration-specific Windows installer packages; the latter bundle several such packages so one file can support multiple architectures. Exchange Online tenants will see the change begin in early November, with wider availability expected by mid-November.
Once mailbox policies update, these attachments will be barred by default, preventing sending, receiving, opening, or downloading. Administrators may permit them through OwaMailboxPolicy's AllowedFileTypes setting. Microsoft says few organizations use these formats, and the step continues earlier efforts to restrict attachment types and inline content abused in attacks.
The change may mainly affect organizations that distribute or receive MSIX packages through email, including IT administrators, developers, and vendors. Because these formats are uncommon, most users could see little disruption. However, blocked attachments might interrupt some workflows, prompting admins to adjust mailbox policies. The move could also reduce a potential malware delivery path, though its broader security effect may be limited if attackers shift to other file types or channels.