Microsoft adds MSIX app packages to Outlook's default attachment block from early November

The setting sits in OwaMailboxPolicy. "To enhance security in Outlook on the web and new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy," Microsoft said in a Microsoft 365 message center update ^[5].

An .msix file is a Windows installation package built for a specific architecture or configuration ^[2]. An .msixbundle packs several .msix packages into one file that works across architectures ^[2]. The block closes the attachment route for these packages only in the two clients Microsoft named ^[1].

Tenants that never use either type need to do nothing, according to Microsoft ^[7]. Tenants that do use them can add .msix and .msixbundle to the AllowedFileTypes property on their users' OwaMailboxPolicy objects ^[7]. The block covers both sending and receiving, so an allowance written to a policy reopens both directions for every mailbox assigned to it ^[13]. How wide the exception runs depends on how many mailboxes share that policy object ^[13].

"Most organizations are not expected to be affected by this update because these file types are infrequently used," Microsoft said ^[8]. The company called the change part of "ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments" ^[9]. The report does not tie the block to a named campaign that delivered MSIX packages by email.

The block on .library-ms and .search-ms came three years after the first recorded abuse of those types ^[14]. BleepingComputer places this run of changes inside a broader Microsoft effort to disable and remove Office and Windows features that attackers have abused in recent years ^[10].