Microsoft is adding two file types to the default Outlook block list, according to The Register (October 6, 2026). We did not open Microsoft's own message center post (listed by trackers as MC1488841), so this brief rests on press reports quoting it.
What is reported:
- The new blocked extensions are .msix and .msixbundle, the formats for Windows application packages and bundles.
- The change applies to New Outlook for Windows and Outlook on the web in Exchange Online. By default, users will not be able to download or open attachments with those extensions.
- The rollout is scheduled for early to mid-November 2026.
- Administrators who need these attachments can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the rollout.
- Microsoft is quoted as saying the update is part of "ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments," and that the file types are infrequently used.
Context from The Register: Outlook on the web already blocks types such as .py, .ps1 and .cab. Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after attackers abused it to spread malware. The Register notes that renaming a file or sending a download link can get around an attachment block, and that tricking someone into installing a malicious package remains a risk.
What we could not confirm: Microsoft's own wording, and whether classic Outlook is affected (the reports name only New Outlook for Windows and Outlook on the web).
Sources: The Register (October 6, 2026); Windows Report and Neowin coverage of the same change.