It's a small change on paper. It does, however, address a request that has been around since the new Outlook first appeared.
What Microsoft says is changing
The roadmap entry describes two new options alongside the current behavior. New settings will allow customers to block all external content, or to load all content by default if the customer admin allows. Microsoft also says the default stays put: Existing default behavior will not be changed (load external content only for safe senders).
That gives three possible behaviors:
| Behavior | What it means | Notes |
|---|---|---|
| Safe senders only (current default) | External content loads automatically only for safe senders | Stays the default, per the roadmap |
| Block all external content | External content does not load automatically for anyone | New; the strictest privacy option |
| Load all content by default | External content loads automatically for every sender | New; only available if the customer's admin allows it |
According to the roadmap listing as mirrored by M365 Admin, a tracker run by Microsoft MVP João Ferreira, the item has Release phase: General Availability; Release date: July CY2026; Platform: Web; Cloud Instance: Worldwide (Standard Multi-Tenant); Created: 2026-06-17 23:15:06Z. Its current status is "Rolling out." On Microsoft's roadmap, that means deployment has started but hasn't reached every eligible tenant. Microsoft also says all roadmap dates are estimates and subject to change. If your tenant still shows the old settings in November, this item alone doesn't tell you whether the rollout is late or simply hasn't reached you.
Summary: Two new options are being added to Outlook on the web and the new Outlook for Windows: block everything, or load everything if your admin allows it. Safe-senders-only remains the default.
Why this matters: the new Outlook couldn't block everything
The roadmap entry doesn't mention it, but this change fills a known gap. Slipstick Systems, the long-running Outlook help site, answered a reader who wanted to block all external content in the new Outlook the way classic Outlook allows. Its answer was blunt: "Unfortunately, it is not possible with the new Outlook app." Slipstick explained that if you are using an Outlook.com mailbox, you can block external content from people not in your safe list or address book but cannot block all external content like you can in Outlook desktop.
The closest option until now has been a Junk email setting. Slipstick describes it as "Block attachments, pictures, and links from anyone not in my Safe senders and domains list". That's the safe-sender filter, which isn't the same as blocking all external content.
Work accounts have had it worse. In one Microsoft Q&A thread, a user asked where Outlook on the web's setting for blocking automatic image downloads had gone. A responder said this option can only be applied to personal accounts, if it's a work account or organization account, there is no such option. The person who asked confirmed: "It is a work account, and there is indeed no such option." Those are community forum comments, not Microsoft documentation. Still, they show why this roadmap item matters to people who wanted their work mailbox to protect them as much as classic Outlook did.
Summary: This update largely restores a privacy control that classic Outlook users had and that users of the new Outlook and Outlook on the web had been asking for.
External images in plain English
The difference between external and embedded images explains what the setting can and can't do:
- External (remote) images stay on a server and load only when the message opens. That request back to the server is how read-tracking pixels, often called web beacons, work.
- Embedded images are carried inside the message itself. In its support article for Outlook mobile, Microsoft says blocking external images doesn't block embedded ones. So some pictures may still show up even with the strictest setting turned on.
- Privacy, not malware protection. Microsoft's mobile guidance calls external-image blocking an extra privacy protection and says external images aren't a security threat in themselves. Treat this new option as a way to stop tracking, not as a replacement for your mail security tools.
One caveat: that Microsoft support article covers Outlook for Android and iOS. It explains the concept well, but it doesn't document the menus or exact behavior of the new web and Windows settings.
What to expect, depending on who you are
If you're happy with how things work now: You don't need to do anything. The roadmap says the safe-senders default isn't changing.
If you care most about privacy: "Block all external content" is the option you've been waiting for. Be ready for the trade-off. Marketing emails, receipts and newsletters may look broken or show placeholder boxes until you choose to load their images. That's the point of the setting, not a bug.
If you care most about convenience: "Load all content by default" depends on your administrator. The roadmap doesn't say whether admins can turn that option on, enforce a setting for everyone, or hide choices entirely. It also doesn't name the admin control, policy or PowerShell command involved. Don't trust any guide that claims to know, unless it cites Microsoft documentation published after this item.
If you're an IT admin: Some practical planning points, based on the rollout status rather than official Microsoft guidance:
- Expect a mix during rollout. Some users may see the new options before others. Tell the help desk so they don't treat it as a configuration fault.
- Decide your policy on "load everything" before users ask. Since that choice depends on admin permission, someone will ask whether it's allowed.
- Be clear about which clients are covered. The roadmap lists only Outlook on the web and the new Outlook for Windows, in the Worldwide (Standard Multi-Tenant) cloud. It doesn't cover classic Outlook, Outlook mobile or government clouds, so don't assume the change applies there.
- Expect "my images disappeared" tickets. Users who pick "block all" and forget about it will come back confused. A one-line note in your support docs will save time later.
Analysis: small switch, real fix
Is this a headline feature? No. Nobody will pre-order a settings toggle. But the new Outlook has been criticized for missing controls that classic Outlook users relied on, and external-content handling has been one of the more visible gaps. Privacy-minded users wanted a strict option. Convenience-minded users wanted one that just loads everything. Admins wanted a say in the matter. This update addresses all three while leaving the default alone.
It also leaves open questions. The roadmap item is short. It doesn't give menu labels, admin controls or a completion date. It also uses "external content" in the settings description and "external images" in the title, so it's not clear whether other kinds of remote content are affected beyond images. Until Microsoft publishes support documentation, treat the details above as the whole confirmed picture.
Bottom line: Outlook on the web and the new Outlook for Windows are getting an option to block all external content, which they've been missing. They're also getting an admin-gated option to load everything automatically. Safe-senders-only stays the default. The rollout is under way in the worldwide commercial cloud and is behind its July 2026 target, so check your settings over the coming weeks.