Microsoft to block MSIX attachments in Outlook to improve security

Microsoft has announced that starting in early November 2026, Outlook on the web and the new Outlook for Windows will block .msix and .msixbundle attachments by default. This security measure will be automatically integrated into Exchange Online mailbox policies.

The decision aims to prevent cybercriminals from using these Windows installer formats to distribute malware. While MSIX was designed to simplify application management and improve upon older formats like .exe, threat researchers observed multiple criminal groups abusing the format in 2023 to deliver ransomware such as Black Basta and DarkGate.

The rollout is expected to begin in the first days of November and reach general availability by mid-month. Organization administrators who require these specific file types for legitimate business purposes can create exceptions by adding them to an allowed list.