Microsoft plans to expand the list of file extensions that are banned in Outlook for the Web (formerly known as Outlook Web Access (OWA).
The list, which included 104 file extensions, will be expanded “soon” with 38 new entries.
These new entries are file types that are regularly used to deliver malware to Outlook inboxes.
Once added to the list of blocked file extensions, users will not be able to download these file types from their inbox – unless the Outlook/Exchange administrator has whitelisted a specific file extension, using a special config.
"The newly blocked file types are rarely used, so most organizations will not be affected by the change," the Microsoft Exchange team said in a statement.
The 38 new file extensions that will soon be banned in Outlook for the web include:
- Java files: “.jar”, “.jnlp”
- Python files: “.py”, “.pyc”, “.pyo”, “.pyw”, “.pyz”, “.pyzw”
- PowerShell files: “.ps1”, “.ps1xml”, “.ps2”, “.ps2xml”, “.psc1”, “.psc2”, “.psd1”, “.psdm1”, “.psd1”, “.psdm1”
- Digital certificates: “.cer”, “.crt”, “.der”
- Files used to exploit vulnerabilities in third - party software : “.appcontent-ms”, “.settingcontent-ms”, “.cnt”, “.hpj”, “.website”, “.webpnp”, “.mcf”, “.printerexport”, “.pl”, “.theme”, “.vbp”, “.xbap”, “.xll”, “.xnk”, “.msu”, “.diagcab”, “.grp”
The list of 104 file types that Microsoft currently blocks in Outlook for the web is available here. Microsoft never stated when the 38 file types would be added to the Outlook ban list, but did say the change would come “soon.”
“Outlook for the web” is a web-based email client that Microsoft created as an alternative to the older Outlook desktop app.
It is included in Microsoft's Office 365 and Exchange Online subscription services and comes with self-hosted, on-premise Exchange email servers.
Administrators of Office 365, Exchange Online, or Exchange Server can whitelist any of the 142 blocked file extensions by following the steps listed on this page.
