Do Son 
According to a recent support bulletin, Microsoft will block MSIX and MSIXBundle attachments by default. This change affects Outlook on the web and the new Outlook client. Furthermore, the update begins in November 2026. Specifically, this adjustment targets enterprise users utilizing Microsoft Exchange Online. Once the policy activates, users cannot send or receive these installation files. Additionally, downloading or opening these formats will become completely restricted.
Understanding These Modern File Formats
MSIX represents a modern application packaging format developed by Microsoft. Developers primarily utilize this format for seamless software installation and distribution. Meanwhile, an MSIXBundle compiles multiple MSIX packages for various processor architectures into one file. Consequently, the Microsoft Store and enterprise distribution platforms heavily rely on these formats.
Impact on Exchange Online Policies
Through this security update, Microsoft adds these formats to the BlockedFileTypes list. Therefore, this modification impacts both default OWA mailbox rules and custom enterprise policies. Naturally, employees can still acquire these application files via alternative download channels. However, successful installation strictly depends on configurations managed by enterprise IT administrators.
The Growing Threat of MSIX Malware
Microsoft implemented this restriction due to escalating security concerns. Previously, the Threat Intelligence team discovered numerous financially motivated hacker groups. These malicious actors actively exploit the App Installer protocol to distribute dangerous MSIX packages. Typically, attackers craft convincing counterfeits of popular software like Zoom and TeamViewer. Subsequently, they deceive victims using malicious advertising and poisoned search results. Ultimately, these phishing tactics trick users into downloading fake system updates.
Configuring Enterprise Security Exceptions
Fortunately, transmitting MSIX packages via corporate email remains remarkably rare. Thus, this strict blockade will not disrupt daily operations for most businesses. However, specific software development firms might occasionally need to share test packages internally. In these unique situations, IT administrators can easily configure system exceptions. Ultimately, this flexibility allows designated mailboxes to safely exchange necessary MSIX files.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
