Microsoft will block .msix and .msixbundle file attachments by default in new Outlook for Windows and Outlook on the web, according to a Microsoft 365 Message Center post (MC1488841). The change applies to Exchange Online, and the rollout is scheduled for early to mid-November 2026.

Once the block is active, users of the two affected Outlook clients will no longer be able to download or open attachments with either extension. The .msix format is used for Windows application packages, and .msixbundle files hold bundles of those packages.

Microsoft describes both file types as "infrequently used" in email. The company says the update is part of its ongoing work to strengthen security and protect organizations from unsafe file attachments.

A malicious .msix package that a user installs without checking can compromise a Windows device. Microsoft has dealt with abuse of its app packaging system before. In December 2023, the company disabled the ms-appinstaller protocol handler by default after attackers used it to distribute malware.

The attachment block adds another layer of protection on top of that change. Outlook on the web already blocks other file types that can run code, including .py Python files, .ps1 PowerShell scripts, and .cab files.

The restriction has limits. Renaming the extension of an attachment or sending a download link instead can get a package past the block, and neither method makes the package any safer.

An attacker who persuades a recipient to download and install a package still has a route onto the device, even with the other protections in Windows in place.

The two file types do have legitimate uses in email, and Microsoft gives administrators a way to keep them working. The exemption has to be configured in the Outlook on the web mailbox policy before the rollout reaches the tenant:

1. Identify the OwaMailboxPolicy that applies to the affected users in Exchange Online.
2. Add the .msix and .msixbundle extensions to the AllowedFileTypes property of that policy.
3. Apply the change before early November 2026, when the default block starts rolling out.

Senders who need to share an app package with users in a tenant that keeps the default block will have to use another delivery method approved by their organization, since recipients will not be able to open the attachment in either client.

Organizations that leave the policy unchanged do not need to do anything, and attachments with these extensions will be blocked automatically in new Outlook for Windows and Outlook on the web.

The Message Center post names only those two clients, and Microsoft has not said whether classic Outlook for Windows will receive the same block.