Microsoft is adding two more file types to the list of attachments Outlook refuses to send or receive. From early to mid-November, .msix and .msixbundle files will be blocked in the new Outlook for Windows and in Outlook on the web in Exchange Online.
The two extensions are used for Windows application packages and bundles. Microsoft said the change "is part of our ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments", and described the file types as infrequently used.
The reasoning is specific. A malicious .msix package can compromise a device, and Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after attackers exploited it to distribute malware.
Administrators who need the file types can add them to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the rollout.
The two newcomers join a long list. Microsoft’s own published list of attachment types blocked by Outlook runs to 133 extensions, from .ade and .adp at one end to .xll and .xnk at the other.
It is not confined to programs. It includes .py, .pyc, .pyo, .pyw, .pyz and .pyzw for Python; .ps1, .ps1xml, .ps2, .ps2xml, .psc1, .psc2, .psd1 and .pssc for PowerShell; .iso, .img, .vhd and .vhdx for disk images; .mht, .mhtml and .website for saved web pages; and .pst, the file in which Outlook keeps mail.
Microsoft’s guidance on what to do instead is practical. Upload the file to OneDrive or SharePoint and send a link. Compress it, because Outlook does not recognise the resulting .zip as a potential threat. Or rename the file to an extension Outlook does not block, send it, and have the recipient rename it back afterwards.
Users without an Exchange account can unblock some file types through an advanced procedure that involves editing the Windows registry.
The direction of travel here deserves stating. Two extensions are being added in November to a list of 133, making 135. The mechanism by which an extension joins is that somebody misused it. There is no mechanism by which an extension stops being one somebody misused.
Email attachments are therefore a shrinking category defined by subtraction, and the only open question is the rate. The three published remedies all point the same way: the safest attachment is a link to the file, the second safest is the file inside a different file, and the third is the file wearing a different name.
Our analysts observe that the final state is already visible in the guidance. Once the list is long enough, every file goes to OneDrive and every message contains a link, at which point an attachment is a historical term for a link to a file that could not be attached.
The Department of Unnecessary Research notes one further implication and considers it the tidiest in computing. Outlook already blocks .pst, the format in which Outlook stores mail. The programme cannot send itself through itself. An attachment is safe at exactly the moment it stops being one.