Microsoft to Block Two Windows Installer Formats in Outlook from November
From early November, Outlook on the web and the new Outlook for Windows will refuse to open .msix and .msixbundle attachments. This decision comes three years after Microsoft disabled the installer behind these formats for similar reasons, and it arrives as a change to the default policy in every tenant.
October 7, 2026 - 5:20 pm
Credit: 3aFW
Microsoft will add .msix and .msixbundle to Outlook’s blocked attachment list, closing a potential email route for a packaging format that its own threat researchers observed four criminal groups abusing in 2023. While renaming the extension can still get a package through, the change will be implemented as a default policy edit in every Exchange Online tenant, including those of European governments currently in the process of leaving.
From early November, users will no longer be able to open or download these two types of attachments in Outlook on the web and the new Outlook for Windows. Microsoft states that most organizations will not be affected.
Notice MC1488841, published on October 5, adds both formats to the default Outlook web mailbox policy and to every custom policy within a tenant. Rollout will occur from early to mid-November. Administrators requiring these formats must add them to an allowed list first, as outlined in Microsoft’s support documentation.
MSIX is the packaging format Microsoft introduced to replace .exe and .msi. A bundle contains multiple builds of a single application, allowing Windows to install the correct one. Microsoft Store apps utilize this format.
Microsoft designed MSIX to be safer than its predecessors. However, despite these efforts, criminal groups exploited it, leading Microsoft to disable the ms-appinstaller protocol handler by default in December 2023.
This time, Microsoft cites no specific attack, and the block is limited. Renaming the file extension or providing a download link can still bypass the restriction. Europe’s 24-hour reporting clock under NIS2 begins when an organization becomes aware of an issue, not when a client declines a file.
The list of blocked extensions is not new; Outlook on the web has already blocked 104 extensions before September 2019, when Microsoft added 38 more, including Python and PowerShell. What is different this time is the method of implementation. Microsoft is editing the default policy in every Exchange Online tenant, including European governments, and those wishing to maintain the old behavior must opt out. The Dutch tax office, for example, decided this week to shift its email off the cloud for reasons unrelated to attachments.
The underlying issue revolves around who makes these decisions. The European Commission’s proposed Cloud and AI Development Act aims to establish sensitive public workloads behind EU ownership requirements, currently unable to be met by major cloud providers like Amazon, Microsoft, and Google. Until this act passes, the policy governing Europe’s public sector email is largely written in Redmond and announced afterward.