MICROSOFT has announced that MSIX and MSIXBundle attachments will be blocked by default in Outlook, beginning in November 2026. The change applies to Outlook on the web and the new Outlook client, and targets enterprise users on Microsoft Exchange Online. Once the policy is active, users will not be able to send or receive these installation files, and downloading or opening them will be restricted as well.
MSIX is a modern application packaging format, with MSIXBundles combining multiple MSIX packages for different processor architectures. The update places these file types on the BlockedFileTypes list, affecting both default OWA mailbox rules and custom enterprise policies. The article notes that while employees could still obtain such files through alternative channels, their installation would rely on IT-configured enterprise settings.
The security rationale cites opportunistic, financially driven actors abusing the App Installer protocol to distribute forged MSIX packages—often masquerading as legitimate software such as Zoom or TeamViewer through deceptive ads and poisoned search results. The piece also mentions that, in practice, corporate email transmission of MSIX packages remains uncommon, and IT admins can configure exceptions for specific mailboxes to permit necessary internal exchanges of these files.