Dwi Wanna
In an ongoing effort to harden its ecosystem against evolving cyber threats, Microsoft has announced a significant update to its security posture for Exchange Online. Starting next month, the company will officially add .msix and .msixbundle file types to the list of blocked attachments in both Outlook Web and the new Outlook for Windows client. This move is the latest in a string of proactive measures designed to eliminate potential attack vectors that malicious actors have increasingly leveraged to deliver malware and facilitate phishing campaigns.
The rollout is scheduled to commence in early November 2025, with full implementation across all Exchange Online environments expected by mid-November. Once the update takes effect, users will be unable to send, receive, open, or download these specific file types, as they will be automatically flagged and quarantined by the platform’s security policies.
Understanding the Targeted File Types
To grasp the significance of this change, it is essential to understand the nature of the files being restricted.
What are .msix and .msixbundle files?
Introduced by Microsoft as a modern replacement for older installer formats like .msi and .exe, the .msix format was designed to provide a more reliable, secure, and streamlined packaging experience for Windows applications.
- The .msix format: These files are tailored for specific computer architectures or system configurations, offering better integration with the modern Windows App SDK.
- The .msixbundle format: This is a container file designed to group multiple
.msixpackages. By bundling these components, developers can provide a single download that automatically selects the appropriate architecture for the user’s specific machine, making installation seamless.
While these formats were designed for legitimate software distribution, their ability to execute code and install software packages makes them highly attractive to threat actors. By disguising malicious payloads as legitimate installers, attackers can bypass basic user scrutiny, potentially leading to unauthorized system access, data exfiltration, or the deployment of ransomware.
A Chronology of Outlook’s Security Evolution
This decision does not exist in a vacuum. It is part of a deliberate, multi-year strategy by Microsoft to reduce the attack surface of its productivity suite. Over the past several years, the company has methodically identified and deprecated file types and display features that have proven to be vulnerable to exploitation.
The 2022-2025 Security Timeline
- June 2022: Microsoft observed a surge in phishing campaigns abusing the Windows Search protocol. Attackers were embedding malicious scripts within
.library-msand.search-msfiles, often targeting government entities and high-value corporate targets. - June 2025: Responding to the sustained abuse of these formats, Microsoft officially began blocking
.library-msand.search-msfiles in Outlook. This move effectively neutralized a primary delivery method for early-stage malware loaders. - October 2025: Just last month, Microsoft took further action to address the risks posed by inline SVG images. Recognizing that attackers were utilizing these images to host malicious payloads or track user activity, the company announced that Outlook for Web and the new Outlook for Windows would no longer render inline SVGs.
- November 2025: The current initiative to block
.msixand.msixbundlerepresents the latest milestone in this security trajectory, signaling that Microsoft remains committed to a "default-deny" approach for high-risk file types.
Official Stance: Protecting the Enterprise
In a message center update directed at administrators, Microsoft articulated the rationale behind this policy change: "To enhance security in Outlook on the web and new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy. As part of this update, the .msix and .msixbundle file types will be added to the BlockedFileTypes list in the default OWA Mailbox policy and any custom policies created in your tenant."
Microsoft has been careful to reassure organizations that the impact on day-to-day business operations will likely be minimal. "Most organizations are not expected to be affected by this update because these file types are infrequently used," the company noted. By restricting these formats, Microsoft is prioritizing the protection of the vast majority of its user base, even if it introduces minor friction for the small percentage of organizations that legitimately rely on .msix deployment via email.
Implications for IT Administrators
While the update is automatic, IT administrators are not entirely without recourse. Microsoft has provided a mechanism for organizations that have a legitimate, business-critical need to exchange these files.
Managing the Blocked List
If an organization frequently uses .msix or .msixbundle files for internal distribution or collaboration, administrators can override the default block. By modifying the AllowedFileTypes property within the users’ OwaMailboxPolicy objects, admins can whitelist these extensions.
However, security experts advise that such exceptions should be handled with extreme caution. Whitelisting should be limited to specific, verified internal senders and should ideally be accompanied by rigorous endpoint detection and response (EDR) monitoring to ensure that no malicious packages are distributed under the guise of legitimate software.
Steps for IT Departments:
- Audit current traffic: Review logs to determine if your organization currently receives or sends
.msixor.msixbundlefiles. - Evaluate necessity: If the files are not essential, do nothing; the policy will automatically protect your environment.
- Implement whitelisting (if required): If your business model necessitates the use of these files, update your OWA Mailbox policies through PowerShell to include them in the
AllowedFileTypeslist. - Communicate with end-users: Inform staff of the change to prevent confusion if legitimate files are suddenly blocked.
The Broader Landscape of Email-Based Threats
The restriction of .msix files highlights a fundamental shift in the threat landscape. Email remains the primary gateway for cyberattacks, and attackers are constantly moving toward more sophisticated "container" formats to bypass legacy security filters.
Why File-Based Attacks Persist
Even with robust email filtering, attackers often rely on "social engineering plus execution." By convincing a user to open a file that appears to be a legitimate software update, they can execute code with higher privileges. The .msix format, while technically superior for developers, functions in a way that allows for complex package contents, making it difficult for traditional signature-based antivirus solutions to inspect every component within the bundle in real-time.
By blocking these files at the gateway level, Microsoft is moving the security perimeter further upstream. This approach is significantly more effective than relying on individual endpoint defenses, which may be disabled or bypassed by sophisticated malware.
Conclusion: A Proactive Future
The move to block .msix and .msixbundle files is a clear indicator that Microsoft is prioritizing the "security by default" principle. As the threat environment grows more complex—particularly with the integration of AI in generating highly personalized phishing content—the ability to restrict potentially dangerous file types becomes a critical defensive layer.
Organizations that have not yet reviewed their OWA Mailbox policies should take this opportunity to audit their current configurations. By staying ahead of these updates, IT departments can ensure that their security posture remains resilient without unnecessarily hindering productivity.
For those interested in how these defensive strategies fit into the wider picture of modern cyber resilience, Microsoft continues to emphasize the importance of comprehensive security blueprints. In an era where attacks occur at machine speed, relying on automated, platform-level protections is not just a best practice—it is an operational necessity. As Microsoft continues to prune its feature set to eliminate legacy vulnerabilities, users and administrators alike can expect a more secure, if more restricted, communication environment.
For more information on the full list of blocked attachments in Outlook, administrators are encouraged to consult the official Microsoft documentation on OwaMailboxPolicy.
Ali Ikhwan
Basiran
