Why is Microsoft blocking .msix and .msixbundle files in Outlook now?
Microsoft is taking proactive steps to prevent users from receiving potentially dangerous application installer packages (.msix and .msixbundle) as email attachments in Outlook on the Web and the New Outlook for Windows. These file types, while designed to safely package Windows applications, have been added to Outlook's default blocked file type list to reduce risks of malware spreading via email. This change reflects the increasing efforts to restrict executable-like files that can be weaponized in phishing attacks.
These formats, which bundle software installers often used in distribution through official channels like the Microsoft Store, can also be exploited to deliver malicious payloads if sent through email unsolicited. By blocking these file types by default, Microsoft aims to improve email security and reduce user exposure to unsafe attachments.
Who will be affected and how?
The change will impact users of Outlook on the Web and New Outlook for Windows connected to Exchange Online starting in November 2026. For most organizations and employees, this may have little immediate effect because these file types are not commonly used as email attachments. Businesses typically distribute software through secure internal portals, package managers, or official app stores rather than email.
However, organizations actively sending or receiving .msix or .msixbundle files via Outlook will find these attachments blocked by default. Administrators managing OWA mailbox policies will be responsible for explicitly allowing these file types if necessary by configuring their mail policies before the rollout. Without such adjustments, users will be unable to download or open these files from emails.
What should organizations do to prepare?
Exchange administrators should audit whether their users or business processes require receiving .msix or .msixbundle files via Outlook. If they do, it is critical to add these file types to the AllowedFileTypes property in the OwaMailboxPolicy objects during the grace period prior to rollout. This proactive step will ensure uninterrupted workflow and avoid blocking needed software delivery.
Conversely, organizations that do not use these file types for legitimate purposes do not need to take any action, benefiting from added protection without extra management workload.
How does this fit into the wider context of email security?
This move continues Microsoft's longstanding practice of blocking risky file types in email to defend users against inadvertent malware infection. Similar actions include recent blocking of Python (.py), PowerShell (.ps1), and cabinet (.cab) files. Blocking executable installers like .msix aligns with reducing attack surfaces from files capable of running code.
It's a balancing act between operational flexibility and security. Email remains a prime vector for malware distribution, so restricting executable attachments minimizes larger-scale compromise risks. The trade-off for organizations is configuring policies carefully to maintain business needs while enforcing prudent safety defaults.
Key takeaway: What this means for users and admins
Microsoft’s decision to block .msix and .msixbundle files in Outlook is a security-first approach that helps protect users from emerging email-based threats delivered through application installer files. Most organizations will be unaffected, but those who rely on these file types via email must update their OWA mailbox policies to whitelist them before November 2026.
End users will benefit from safer inboxes with fewer opportunities for downloading harmful executables disguised as legitimate application packages. Administrators should take this month-long window to assess and adjust mail policies accordingly to avoid operational disruptions while enhancing organizational security.