Microsoft will add the .msix and .msixbundle file types, used to package and distribute Windows applications, to the list of attachments Outlook blocks by default, The Register reported Tuesday. The change applies to new Outlook for Windows and Outlook on the web in Exchange Online and is scheduled to roll out from early to mid-November.

What Happened

Microsoft described the change as part of continuing work to protect organizations from potentially unsafe attachments, and noted that the two formats are rarely used in email. Once the block takes effect, recipients in affected clients will not be able to open or download those attachments.

An .msix file is a modern Windows installer package, and an .msixbundle groups several packages, typically for different processor architectures. Installing a malicious package can compromise the machine, The Register noted, because the user is in effect running software the attacker supplied.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Administrators who rely on emailing these packages have a way around the block. They can add the two extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the rollout reaches their tenant. Outlook on the web already blocks a list of risky types, including Python scripts (.py), PowerShell scripts (.ps1) and cabinet archives (.cab).

Why It Matters

App installer formats have been a favored disguise for malware because they can look like legitimate software and carry a familiar Windows installation prompt. In December 2023, Microsoft disabled the ms-appinstaller protocol handler by default after attackers used it to push malware that installed directly from web links. Blocking the package files at the mail layer closes a related path, where the installer arrives as an attachment instead of a link.

For most organizations the impact should be small, given Microsoft's own description of the formats as infrequently used in mail. The groups most likely to notice are IT and development teams that distribute internal line-of-business apps or test builds by email rather than through Intune, the Microsoft Store or a software deployment tool.

Context

Attachment filtering is one of the oldest and bluntest email defenses: rather than inspecting each file, the client refuses whole categories that are rarely needed and often abused. Microsoft has expanded Outlook's list over the years as attackers moved from macro-laden Office documents to scripts, disk images and installer files. The new Outlook for Windows shares its blocking rules with Outlook on the web, so one policy change covers both.

What to Watch

The rollout window runs from early to mid-November. Admins should check whether any business process depends on emailed .msix packages and, if so, update the mailbox policy beforehand or move distribution to a managed channel. It is also worth watching whether Microsoft extends the block to classic Outlook for Windows, which the announcement did not cover.