Microsoft has announced that it will add .msix and .msixbundle attachments to the blocked attachments list in Outlook Web and the new Outlook Windows client starting next month.
.msix files are modern Windows installation packages tailored to specific computer architectures or configurations, while .msixbundle is a container that groups multiple .msix packages into a single file that is compatible with multiple computer architectures.
The change will begin rolling out to Exchange Online users in early November, when the new file types will be added to the BlockedFileTypes list in all OWA mailbox policies, and is expected to be generally available in mid-November.
After the policies are updated, .msix or .msixbundle attachments will be blocked by default and users of Outlook on the web and the new Outlook for Windows will no longer be able to send, receive, open, or download them.
“To increase security in Outlook on the web and in the new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy.” Microsoft said in a Microsoft 365 Message Center update.
“As part of this update, the .msix and .msixbundle file types will be added to the BlockedFileTypes list in the default OWA mailbox policy and any custom policies created in your tenant.”
Administrators do not need to take any action if the .msix or .msixbundle file types are not used in their organization. However, you can whitelist them by adding them to the AllowedFileTypes property of your users’ OwaMailboxPolicy objects if necessary.
“Most organizations are not expected to be affected by this update because these file types are rarely used,” Microsoft added. “This update is part of our ongoing efforts to strengthen security and protect organizations from potentially insecure file attachments.”
The move is part of a broader effort to disable and remove Office and Windows features that attackers have abused in attacks on Microsoft customers in recent years.
In June 2025, Outlook began blocking the .library-ms and .search-ms file types, which have been exploited in phishing and malware attacks, including attacks against government entities, since at least June 2022.
Recently, in October 2025, Microsoft also announced that Outlook for web and the new Outlook Windows client would no longer display risky inline SVG images, which were also used in attacks.
For the complete list of attachments that Exchange Server and Exchange Online users cannot save or view in Outlook on the web, see Microsoft documentation website.
