Outlook Will Start Blocking MSIX Installer Attachments in November. Check Whether Anyone Relies on Them.

Microsoft says Outlook on the web and the new Outlook for Windows will block .msix and .msixbundle attachments starting in early November 2026. Most businesses need to do nothing, but anyone who emails Windows app packages should plan an alternative.

Kevin R.

Oct 10, 2026, 5:58 AM PDT4 min read

Microsoft is adding two more file types to the list of email attachments that Outlook blocks by default. According to Microsoft 365 message center post MC1488841, published Monday, October 5, 2026, Outlook on the web and the new Outlook for Windows will block .msix and .msixbundle attachments. Microsoft says the rollout begins in early November 2026 and should be complete by mid-November.

An MSIX file is a Windows app installer package. An .msixbundle groups several of those packages into one file. Microsoft says “most organizations are not expected to be affected by this update because these file types are infrequently used.”

What is changing

According to Microsoft, .msix and .msixbundle will be added to the BlockedFileTypes list in every Outlook on the web mailbox policy in your Microsoft 365 tenant. That covers the default policy and any custom policies your admin created. Microsoft says users “will no longer be able to open or download” these attachments in Outlook on the web or the new Outlook for Windows.

Microsoft lists the rollout for its worldwide service and for its GCC, GCC High and DoD government clouds. The notice names only Outlook on the web and the new Outlook for Windows. It doesn’t mention classic Outlook for Windows or the mobile apps.

Why Microsoft is doing this

The message center post describes the change as part of an effort “to help protect organizations from potentially unsafe file attachments.” It doesn’t name a specific attack. Microsoft has written about criminals abusing this file format before. In a December 2023 report, Microsoft Threat Intelligence said several financially motivated groups distributed “signed malicious MSIX application packages” disguised as popular software, in activity that could lead to ransomware.

BleepingComputer, which reported the change on October 7, notes earlier Outlook blocks of other abused file types, including .library-ms and .search-ms in 2025.

Who is affected

For most small businesses, nobody. Employees rarely have a reason to email Windows app installers to each other, and an unexpected installer arriving by email is a reason for suspicion in its own right.

The people who might notice are:

Software developers or vendors who email test builds of Windows apps to colleagues or customers.
IT staff or IT providers who send app packages to employees by email instead of through a management tool.
Anyone who receives app packages from a vendor by email. After the change, those attachments won’t open in Outlook on the web or the new Outlook.

What to do

1. Ask the question. Ask your IT provider, or anyone who builds or deploys software for you, whether they send or receive .msix or .msixbundle files by email. If the answer is no, Microsoft says no action is required.

2. If someone does rely on it, consider a different route first. A shared link from OneDrive or SharePoint, or your device-management tool, avoids sending installers as attachments at all. That’s usually the better fix than reopening a file type Microsoft has decided to block.

3. If you need to keep allowing them, Microsoft recommends that admins add the two file types to the AllowedFileTypes property of their users’ Outlook on the web mailbox policies before the rollout. This is done in Exchange Online PowerShell, not in the admin center. Your admin can list the current policies with Get-OwaMailboxPolicy and add the types to a policy without overwriting its existing list:

Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AllowedFileTypes @{Add=".msix",".msixbundle"}

Repeat that for any custom policies. One caution from the same Microsoft documentation: when a file type appears on both lists, “the Block list overrides the Allow list.” After mid-November, have your admin check that .msix and .msixbundle didn’t end up on the blocked list of a policy where you meant to allow them.

If you’re not sure

If you don’t know who manages your Microsoft 365 settings, or whether anyone at your business depends on this file type, NightSquawk Tech offers a free assessment that includes a review of your Microsoft 365 email settings.

Sources

Microsoft, “Microsoft Outlook: Update to default blocked file types in OwaMailboxPolicy,” Microsoft 365 message center post MC1488841, Oct. 5, 2026, as archived by the Microsoft 365 Message Center Archive. https://mc.merill.net/message/MC1488841
Microsoft Learn, “Set-OwaMailboxPolicy,” Exchange PowerShell reference. https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-owamailboxpolicy
Microsoft Learn, “Get-OwaMailboxPolicy,” Exchange PowerShell reference. https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-owamailboxpolicy
Microsoft Threat Intelligence, “Financially motivated threat actors misusing App Installer,” Microsoft Security Blog, Dec. 28, 2023. https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/
Sergiu Gatlan, “Microsoft Outlook to block MSIX attachments starting November,” BleepingComputer, Oct. 7, 2026. https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/

Editorial note: This article was drafted with AI assistance from Microsoft’s message center post MC1488841, Microsoft Learn documentation, a Microsoft Security Blog report and BleepingComputer’s coverage, linked above. The message center post is cited through a public archive because Microsoft’s message center requires an admin sign-in. Rollout dates and setting names are as published on October 9, 2026, and may change.