Why does Outlook say it blocked access to potentially unsafe attachments?

The message "Outlook blocked access to the following potentially unsafe attachments" means Outlook recognized the file's extension as one that can run code on your computer, so it refuses to open it. It isn't a virus alert and it doesn't mean the sender is malicious. This guide explains which files trigger it, which Outlook version uses which list, the safe ways to receive a file you really need, and what admins can change.

What does "Outlook blocked access to the following potentially unsafe attachments" mean?

It means the attachment's file extension is on Outlook's list of blocked file types, so Outlook won't let you open, save or print it. Microsoft's KB 829982 gives the exact wording as "Outlook blocked access to the following potentially unsafe attachments: [file name]" and explains that the attachment stays in the message but is inaccessible from Outlook.

Microsoft's reasoning is simple. Its Blocked attachments in Outlook page opens with: "One of the most common ways of transmitting computer viruses is through file attachments." Programs, scripts and shortcuts can do anything you can do on your PC, so Outlook stops them by name before you get the chance to double-click.

Three things are worth knowing straight away:

• The block is by file extension, not by scanning. A harmless internal tool with a .exe name is blocked just like malware.
• It happens in the Outlook app, not on the server. The message was delivered. Your spam filter or Microsoft 365 didn't quarantine it, so the sender won't get a bounce.
• Classic Outlook calls these "Level 1" files. KB 829982 describes Level 1 files as ones you can't open, and adds that forwarding the message drops the attachment. Level 2 files make Outlook ask you to save the file to disk first.

Outlook on the web and new Outlook show a different message for the same idea. Microsoft's troubleshooting article says users see "Access to attachments has been blocked. Blocked attachments: <FileName>", or just a generic "1 Attachment" placeholder that can't be opened.

Which file types does Outlook block?

Outlook blocks file types that run code, install software, change system settings or mount as a drive. The full list on Microsoft's support page runs to more than a hundred extensions at the time of writing (November 2026). The table groups the ones people run into most.

The last row matters. Outlook's list is not a full attachment security policy. HTML and SVG files are common phishing carriers and aren't on it, and macro-enabled Office files are handled by Office itself. Our guide to dangerous email attachment types covers what a filter should block or quarantine on top of Outlook's list, and macros blocked from the internet explains the separate Office macro block.

Which version of Outlook uses which list?

Each Outlook client reads its blocked list from a different place, which is why two people can see the same message differently. Classic Outlook for Windows uses a list built into the app plus registry or administrative policy settings on the PC. Outlook on the web and new Outlook for Windows use the Outlook on the web mailbox policy stored in Exchange Online.

Microsoft's new Outlook policy management page confirms that admins control which file types can be opened in new Outlook "using the AllowedFileTypes and BlockedFileTypes parameters on the Set-OwaMailboxPolicy cmdlet", and that most mailbox policies "apply to both Outlook on the web and new Outlook for Windows". So if you move from classic to new Outlook, a registry change you made on your PC stops mattering.

The lists also include some less familiar Windows types. At the time of writing (November 2026), both Microsoft's support page and the default BlockedFileTypes list in the Set-OwaMailboxPolicy reference include .library-ms, which Microsoft describes as a "Windows Library Description File format", and .search-ms, a "Microsoft Vista Saved Search file". If a file type you rely on suddenly stops opening in Outlook on the web, check the current default list in that reference.

What should I do if I need the blocked file?

Confirm the file is genuine first, then ask for it in a form Outlook doesn't block. Don't look for a way round the block until you've done the first step, because a blocked attachment you didn't expect is a classic malware delivery attempt.

1. Check that you expected it. Did you ask for a program, script or disk image from this person? If not, treat it as suspicious.
2. Confirm with the sender out of band. Call them on a number you already have, or message them on a channel you already use. Don't reply to the email, which could come from an attacker in their mailbox.
3. Ask for a link instead. Microsoft's first suggestion is to upload the file to OneDrive or SharePoint and send a link. Links also avoid the attachment size limits covered in our email attachment size limits guide.
4. Or ask for a ZIP file. Microsoft notes that compressing the file gives it an extension Outlook doesn't block. Ask the sender not to password-protect it, so your filter can still scan the contents.
5. Ask IT if it's a recurring business need. If your team regularly receives one blocked type, such as installers from a software vendor, an admin can change the policy for the people who need it.
6. Report it if you didn't expect it. Use Report > Report phishing in Outlook, and see our guide to reporting phishing emails.

Is renaming the file a good idea?

Renaming is the workaround Microsoft lists last, and it is the one attackers like best. The idea is that the sender renames setup.exe to setup.docx, and you rename it back after saving. It works because Outlook only checks the name.

That's also why "rename the attachment to open it" in an email body is a red flag. A real colleague would rarely tell you to rename a file. If someone does, confirm it with them by phone before you touch it. A file that arrives as a password-protected ZIP with the password in the same email is a similar warning sign; our guide to password-protected ZIP attachments explains why.

How do admins allow a blocked file type?

Admins change the Outlook on the web mailbox policy for Outlook on the web and new Outlook, and the registry or Office policy settings for classic Outlook. Before you do either, ask whether a link to OneDrive or SharePoint would solve the problem. Every type you allow is a type an attacker can send to everyone covered by the policy.

Outlook on the web and new Outlook (Exchange Online PowerShell)

Microsoft's troubleshooting article gives this pattern, which removes a type from the block list and adds it to the allow list. Here it is for Windows Installer packages, as an example:

Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -BlockedFileTypes @{Remove=".msi"}
Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AllowedFileTypes @{Add=".msi"}

Notes from Microsoft's documentation:

• The @{Add=...; Remove=...} syntax changes one entry without overwriting the rest of the list.
• Get-OwaMailboxPolicy | Set-OwaMailboxPolicy changes every policy in the tenant. To limit the change, create a separate policy and assign it only to the people who need it, then run Set-OwaMailboxPolicy -Identity "<policy name>" instead.
• Microsoft says changes "may take several minutes" to take effect, and warns that allowing types that are blocked by default "may make your system more vulnerable to security threats".
• There's also a ForceSaveFileTypes list for types users can save but not open in the browser, and matching BlockedMimeTypes and AllowedMimeTypes lists.

Classic Outlook for Windows (registry)

KB 829982 documents a string value named Level1Remove under HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security for Outlook 2016 and Microsoft 365 versions of Outlook (version 16.0). Its data is the extension to allow, with multiple types separated by semicolons, for example .exe;.com. Microsoft notes that Microsoft 365 builds older than 16.0.12923.10000 need the extensions without the dot. Restart Outlook after the change.

Microsoft's own cautions apply: back up the registry first, allow only the types you need, and consider allowing a type temporarily and then removing it. KB 829982 adds that if your Exchange administrator "has disallowed changes to the Outlook attachment security behavior", the change has to be made on the Exchange side, and Microsoft's support page tells people with work (Exchange) accounts to ask their administrator. Admins who manage Office through policy have settings named Prevent users from customizing attachment security settings and Remove file extensions blocked as Level 1; Microsoft's security baseline for Microsoft 365 Apps turns on the first and leaves the second's list of removed extensions empty. For most businesses, the better policy is to leave Level 1 alone and use links.

How is this different from a blocked or quarantined message?

Outlook's attachment block is the last step, on your own screen. Your mail filter acts earlier, when the message arrives, and can stop the whole message instead of hiding one file. The two are easy to confuse because both say "blocked".

• Outlook attachment block: the message is in your inbox and you can read it, but one file is greyed out. Nothing appears in quarantine.
• Microsoft 365 common attachments filter: an admin-set list in the anti-malware policy. Microsoft Learn says matching messages are rejected with a non-delivery report by default, or quarantined if the admin chooses. It uses "true type matching", so an .exe renamed to .txt is still caught. The default list also includes types Outlook allows, such as .docm.
• Malware detection: Microsoft 365 "quarantines messages when malware is found in any attachment", and by default only admins can view and release those messages.
• A filtering gateway in front of Microsoft 365: a service on your MX record can apply its own attachment-type rules before mail reaches the mailbox. Our what is email quarantine guide explains how held messages are reviewed.

Read the message headers if you're unsure which layer acted. Paste them into the Microsoft 365 Spam Header Decoder to see the verdict Microsoft 365 recorded. A message with a normal verdict and a greyed-out attachment was blocked by Outlook, not by your filter.

Should you ever turn the block off?

Almost never for a whole organization. Outlook's list is a backstop that costs very little. Business users rarely need to receive executables, scripts or disk images by email, and the people who do can usually get them from a vendor's download portal or a shared folder.

There are a few reasonable exceptions. A software team might need .ps1 or .py files from a known partner. A finance team might use an old Access database. Even then, allow the specific type for a specific group through a separate mailbox policy, keep your filter's attachment rules and Safe Attachments scanning in place, and write down who asked and why. Review the exception when the project ends.

If attachment-borne threats keep reaching your users, the fix is upstream. Filter by true file type at the edge, quarantine risky types such as HTML and macro-enabled files, and keep Outlook's own block as a last line of defense. Our Microsoft 365 platform page shows how a filtering gateway with attachment-type filters sits in front of Exchange Online.

Next steps

• Ask the sender for a OneDrive or SharePoint link, or a ZIP without a password, after confirming by phone that they sent it.
• Admins: check which Outlook on the web mailbox policies exist with Get-OwaMailboxPolicy | Format-List Name,AllowedFileTypes,BlockedFileTypes before changing anything.
• Review your server-side attachment rules against our dangerous attachment types list.
• If you want attachment-type and Office macro filtering before mail reaches Microsoft 365, see how iBlockSpam works with Microsoft 365.