How well can your business fend off malicious email attachments? Even legitimate Windows installer formats can turn into malware delivery vehicles in the wrong hands.

Microsoft is fortifying its defenses against risky files in Outlook with new default restrictions that may change how your team shares certain software packages.

Outlook Attachment Blocking Expands to Two More File Types

Starting in early November 2026, Microsoft will expand Outlook's list of blocked email attachments to include two Windows application installer formats: .msix and .msixbundle. This affects New Outlook on Windows and its web version for organizations that use Exchange Online. Users will no longer be able to open or download attachments containing these extensions by default.

Microsoft will enforce the new email security restrictions through its Outlook Web App (OWA) mailbox policies. Both the default and custom policies within an organization's Exchange Online environment will receive the update automatically. The rollout should finish by mid-November.

Why Are These File Types Risky?

Both .msix and .msixbundle are Microsoft-developed file formats that help distribute and install Windows applications. They serve the following purposes:

  • .msix: This modern alternative to traditional .exe and .msi installers contains the files and instructions Windows needs to install an application, with built-in features that make software installation and updates more reliable.
  • .msixbundle: This package conveniently combines multiple .msix versions into one file so Windows can select the appropriate version automatically.

Unfortunately, cybercriminals have found ways to exploit these formats. They can sign malicious installer packages with abused certificates, so a valid digital signature doesn't always guarantee a file is safe.

Threat actors use these risky files in phishing attacks and malicious online advertising campaigns, disguising ransomware, remote access trojans, and other malware as legitimate software like Google Chrome or Microsoft Teams.

How Will It Affect Your Business?

The change should barely cause a ripple for the average company, as Microsoft considers these installer formats uncommon in everyday email exchanges. If no one in your team regularly uses these two file types, you don't have to do anything when the update arrives.

Internal development departments and IT administrators who rely on the MSIX format to distribute custom in-house applications or updates will experience disruptions if they send these packages via email. Businesses with these kinds of workflows should have IT administrators add the file extensions to the "AllowedFileTypes" section of the OwaMailboxPolicy objects of select users.

Protecting Your Company From Malicious Files

Even with the latest Microsoft Outlook security updates, workarounds still exist to bypass restrictions on risky files in Outlook, such as changing an attachment's extension or sending users a download link instead. That's why a vigilant, informed team remains your biggest defense.

Consider restricting MSIX attachment exceptions to select individuals and enforcing application control policies for approved software. Your employees should also verify installer signatures and publisher certificates for every .msix or .msixbundle file.

A few simple yet effective controls make it harder for a disguised installer to reach employees and run on their computers.

Used with permission from Article Aggregator