Microsoft is adding two Windows app-package file types to Outlook’s blocked attachment list so users in affected cloud email clients cannot open or download them by default. The change affects New Outlook for Windows and Outlook on the Web in Exchange Online, with rollout planned for early to mid-November 2026. The blocked types are .msix and .msixbundle, which can install Windows applications and have been abused to deliver malware; admins can allow them again through the OwaMailboxPolicy AllowedFileTypes setting.
Why it matters: Organizations using Exchange Online should review whether they rely on these attachment types and prepare policy exceptions only if truly needed. For most users, this reduces a common path for malware delivery and means unexpected app-package attachments should be treated as suspicious.
2026.10.06
100% relevant
This article establishes a new tracked story because it is a distinct Microsoft security control rollout for Outlook and Exchange Online, not an update to an existing tracked breach, CVE, or prior Outlook attachment-blocking story.
← Back to all stories