Microsoft Outlook: Update to default blocked file types in OwaMailboxPolicy

🚨 The Signal: Microsoft is blocking .msix and .msixbundle file types in Outlook on the web and new Outlook for Windows by default. This enhances email security by preventing potentially unsafe application package attachments.

The Impact

Exchange Online administrators and users sending/receiving .msix/.msixbundle files are affected, reducing malware risk from these attachment types.

• Exchange Online administrators: Default OWA policies will be updated automatically.
• Users: Cannot open or download .msix/.msixbundle attachments.
• Security teams: Reduced attack surface from specific application package types.
• Organisations: Enhanced protection against email-borne threats.

The Action

1. Review existing OWA Mailbox policies for any explicit allowances of .msix or .msixbundle files.
2. Communicate to users about the upcoming block of .msix and .msixbundle attachments.
3. Evaluate alternative secure methods for sharing .msix or .msixbundle files if business-critical.

Domain: Exchange · Impact: medium · Workload: Exchange Online · Essential Eight: User Application Hardening · ISM: ISM-1412, ISM-1485, ISM-1486, ISM-1542, ISM-1585, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860