Microsoft Will Block MSIX Files in Outlook in November
IT administrators should prepare for changes to Outlook file attachments that will limit potential malware exposure.
Updated on Oct. 7, 2026 in Remote Work
Live Poll
Do you trust companies to decide which file attachments are safe for you to open?
Microsoft is updating its security protocols to block .msix and .msixbundle file attachments in New Outlook for Windows and Outlook on the Web, with the rollout beginning in early November 2026. This change aims to protect organizations from potentially unsafe attachments.
Why it matters
By adding these extensions to the BlockedFileTypes list, Microsoft is tightening security to mitigate malware risks that often exploit executable file formats. Operators must now proactively manage their security policies to ensure business-critical files remain accessible.
Microsoft is adding two new file types to the BlockedFileTypes list in Exchange Online, joining a restricted group that previously included .py, .ps1, and .cab formats. The update affects all organizations using New Outlook for Windows and Outlook on the Web.
The players
Microsoft
A global technology company that develops the Windows operating system and the enterprise-grade Outlook email and productivity suite.
The details
The restriction operates through the OwaMailboxPolicy object, which dictates the security filtering for Exchange Online environments. While the block will be active by default starting in mid-November, administrators retain the ability to override these settings. IT teams can manually modify the AllowedFileTypes property within their policy objects to permit .msix or .msixbundle files if they are required for internal software distribution.
Timeline
December 2023: Microsoft disabled the ms-appinstaller protocol handler.
Early November 2026: General rollout of the new file blocks begins.
Mid-November 2026: Rollout of the file restrictions is expected to be complete.
Market Landscape
This move follows the 2023 disabling of the ms-appinstaller protocol handler as Microsoft continues to restrict executable formats in its mail clients. The update aligns with broader industry efforts to harden enterprise platforms against sophisticated attachment-based malware.
IT administrators should audit their current software deployment workflows to determine if they rely on .msix files before the mid-November completion date. If business operations depend on these formats, modify the OwaMailboxPolicy objects now to explicitly allow these file types.
The takeaway
The addition of these file types to the block list signals a narrowing of allowed attachment formats for enterprise users. Consult with your IT department to confirm if existing internal applications require these extensions and document your whitelist policy before the rollout concludes.
Further reading
For more on managing digital security and access, see the Remote Work section.
Live Poll
Do you trust companies to decide which file attachments are safe for you to open?
