Microsoft Expands Blocked Email Attachments to Boost Security in Outlook 2025

In a continuous effort to bolster email security, Microsoft has announced an expansion of its list of blocked file types for attachments in Outlook on the Web and the New Outlook for Windows. Starting in early July 2025, the company will add two new file extensions to the BlockedFileTypes list: .library-ms and .search-ms. This proactive measure aims to protect users from potential security threats associated with these file types.
Understanding the Newly Blocked File Types

• .library-ms: This extension is associated with Windows Library Description files, which define virtual folders aggregating content from various locations.
• .search-ms: This extension pertains to Windows Search Connector files, which facilitate saved search queries.

While these file types are not commonly used by the average user, they can be exploited by malicious actors to execute unauthorized actions or distribute malware. By blocking these extensions, Microsoft aims to mitigate such risks and enhance the overall security of its email platforms.
Impact on Users and Administrators
Microsoft anticipates that this update will have minimal impact on most users, as the newly blocked file types are rarely utilized. However, organizations that rely on these file types for legitimate purposes may experience disruptions. To address this, administrators have the option to add these extensions to the AllowedFileTypes property within their OwaMailboxPolicy objects before the rollout. This proactive step will ensure that users can continue to access necessary attachments without interruption.
Steps for Administrators to Modify Attachment Policies

• Identify the Relevant OwaMailboxPolicy: Determine which policy governs the affected users.
• Modify the AllowedFileTypes Property: Add the .library-ms and .search-ms extensions to the AllowedFileTypes list.
• Apply the Changes: Implement the updated policy to ensure that users can receive these file types as attachments.

Detailed instructions on modifying OwaMailboxPolicy objects can be found in Microsoft's official documentation.
Historical Context and Ongoing Security Measures
This update is part of Microsoft's ongoing efforts to enhance email security. In 2019, the company expanded its list of blocked file types to include extensions associated with Python, PowerShell, digital certificates, and Java, among others. These measures are designed to protect users from evolving security threats and to ensure a safer email experience.
Conclusion
Microsoft's decision to block .library-ms and .search-ms file types in Outlook on the Web and the New Outlook for Windows underscores the company's commitment to user security. While the impact on most users is expected to be minimal, administrators should review their organization's use of these file types and adjust their policies accordingly to maintain seamless operations.

---

Source: Neowin Microsoft to default-block more files in New Outlook and Outlook Web