Microsoft will block two Windows installer formats in Outlook from November
Microsoft will add .msix and .msixbundle to Outlook’s blocked attachment list in early November, closing an email route for a packaging format its own threat researchers watched four criminal groups abuse in 2023. Renaming the extension still gets a package through, and the change lands as a default policy edit in every Exchange Online tenant, […] This story continues at The Next Web
Microsoft will add .msix and .msixbundle to Outlook’s blocked attachment list in early November, closing an email route for a packaging format its own threat researchers watched four criminal groups abuse in 2023. Renaming the extension still gets a package through, and the change lands as a default policy edit in every Exchange Online tenant, including those of European governments now trying to leave.
From early November, Outlook on the web and the new Outlook for Windows will stop users opening or downloading two kinds of attachment. Both are Microsoft’s own Windows installer formats. Microsoft says most organisations will not notice.
Notice MC1488841, published on 5 October, adds both to the default Outlook web mailbox policy and to every custom policy in a tenant. Rollout runs from early November to mid-month. Administrators needing the formats must add them to an allowed list first, per Microsoft’s support documentation .
MSIX is the packaging format Microsoft introduced to replace .exe and .msi. A bundle holds several builds of one application, so Windows installs the right one. Microsoft Store apps use it.
Microsoft built the format to be safer than what it replaced.
That did not hold. In December 2023 Microsoft disabled the ms-appinstaller protocol handler by default after four financially motivated groups abused it, tracked as Storm-0569, Storm-1113, Sangria Tempest and Storm-1674.
They delivered BATLOADER, EugenLoader, IcedID, DarkGate and Black Basta ransomware, Microsoft’s threat intelligence team wrote. The handler bypassed Defender SmartScreen and the browser warnings that greet an executable download.
Microsoft cited no attack this time, and the block is narrow. Renaming the extension or sending a download link gets a package past it. Europe’s 24-hour reporting clock under NIS2 starts when an organisation notices, not when a client refuses a file.
The list it joins is older than that episode suggests. Outlook on the web blocked 104 extensions before September 2019, when Microsoft added 38 more, including Python and PowerShell, BleepingComputer reported.
What is new is how it arrives. Microsoft is editing the default policy in every Exchange Online tenant, European governments included, and anyone wanting the old behaviour must opt out. The Dutch tax office decided this week to move its email off that cloud.
The Belastingdienst, Dutch Customs and the Benefits Agency, 47,500 staff, cited missing encryption controls and no workable exit strategy. France went further in April, ordering ministries towards sovereign alternatives for email, covering 2.5 million civil servants.
Blocking an installer format is housekeeping. The complaint underneath is about who decides.
The Commission’s proposed Cloud and AI Development Act would put sensitive public workloads behind EU ownership requirements Amazon, Microsoft and Google cannot currently meet. Until it passes, the policy governing Europe’s public sector email is written in Redmond, and announced afterwards.
