Microsoft Outlook to Block MSIX and MSIXBundle Attachments Starting November
What Happened — Microsoft announced that .msix and .msixbundle files will be added to Outlook’s default blocked‑attachment list. The change rolls out to Exchange Online users in early November and reaches general availability by mid‑November. After the update, Outlook on the web and the new Outlook Windows client will prevent sending, receiving, opening, or downloading these files unless an admin explicitly whitelists them.
Why It Matters for Trust & Control Assurance
- Continuous control‑mapping programs must capture policy changes like attachment blocking to prove that data‑loss‑prevention (DLP) controls are enforced.
- Evidence of blocked‑file logs creates a defensible audit trail that maps to multiple framework objectives (e.g., NIST CSF “Protect” and ISO 27001 “Asset Management”).
- The ability to whitelist on a per‑user basis demonstrates granular policy governance, a key control‑assurance signal.
Who Is Affected – Enterprises and SaaS providers that rely on Microsoft 365/Exchange Online for email, across all verticals (finance, health, retail, etc.).
Recommended Actions – Review your OwaMailboxPolicy to verify that allowed file types align with business needs, enable logging of blocked attachment events, and update your control‑mapping inventory to reflect the new blocked file type. Document the policy change for audit readiness.
Technical Notes – .msix packages are modern Windows app installers that can carry executable payloads. Attackers have previously leveraged them to bypass traditional file‑type filters and deliver malware. Blocking these files reduces the attack surface for malicious payload delivery via email.