Malware Filter Policy Updates in Office 365

Updated October 2026

In March 2017 I wrote a blog post that showed how to take the attachment filter list from Edge Server and add those attachment block types to EOP, as EOP had a very small list of attachments.

In June 2017 in one of my client tenants I noticed this precanned list of attachment extension types is now at 96 items, which is a considerable change from the list back in March 2017. The list in March 2017 was ace, ani, app, docm, exe, jar, reg, scr, vbe, vbs.

And in 2023 I wrote an article on updating the malware filter file types to a very long list, and including modifying the preset filters.

But while Microsoft has added new attachment types to the picker UI, there was no notification in 2017 to the administrators that they might want to update their MalwareFilterPolicy to take account of these new attachment types that Microsoft have considered worthy of being blocked. This was changed after the original writing of this blog post and now it is possible to add additional extensions, extensions of your choice and to enable blocking of attachments based on these extensions.

Therefore, now is the time to check your existing MalwareFilterPolicy to include the new extension types (listed below).

For reference, the new attachment filter types that have been added in March 2017 are

asp,cer,der,dll,dos,gadget,hta,inf,ins,isp,its,jse,ksh,lnk,mad,maf,mag,mam,maq,mar,mas,mat,mau,mav,maw,msh,msh1,msh1xml,msh2,msh2xml,mshxml,obj,os2,plg,pst,rar,tmp,vsmacros,vsw,vxd,w16,ws

Since 2017 and up to current time, Microsoft are adding more suggested file types for blocking, but not blocking them by default – for example .7z and .zip are now both in the list to select from and you can type into the Malware Filter Policy file type control your own extensions as well.

I am assuming attachment blocking is not case sensitive and so the following extensions are if added from the attachment list picker will be duplicates – Hta, Inf, Ins, Jse, Ksh if you imported a matching, but lower case, list from your Edge servers.

To turn on the attachment blocking (block attachments with the named file type extensions) as part of the malware filter policy (so block them even if they are not malware) you need to run the following:

$filetypes = (Get-MalwareFilterPolicy Default).FileTypes
$filetypes = $filetypes + "shtml" + "shtm"
# and to add many other file types
$filetypes = $filetypes + "ade" + "adp" + "cpl" + "app" + "bas" + "asx" + "bat" + "chm" + "cmd" + "com" + "crt" + "csh" + "exe" + "fxp" + "hlp" + "hta" + "inf" + "ins" + "isp" + "js" + "jse" + "ksh" + "lnk" + "mda" + "mdb" + "mde" + "mdt" + "mdw" + "mdz" + "msc" + "msi" + "msp" + "mst" + "ops" + "pcd" + "pif" + "prf" + "prg" + "ps1" + "ps11" + "ps11xml" + "ps1xml" + "ps2" + "ps2xml" + "psc1" + "psc2" + "reg" + "scf" + "scr" + "sct" + "shb" + "shs" + "url" + "vb" + "vbe" + "vbs" + "wsc" + "wsf" + "wsh" + "xnk" + "ace" + "ani" + "docm" + "jar" + "asp" + "cer" + "der" + "dll" + "dos" + "gadget" + "Hta" + "Inf" + "Ins" + "Isp" + "Its" + "Jse" + "Ksh" + "Lnk" + "mad" + "maf" + "mag" + "mam" + "maq" + "mar" + "mas" + "mat" + "mau" + "mav" + "maw" + "msh" + "msh1" + "msh1xml" + "msh2" + "msh2xml" + "mshxml" + "obj" + "os2" + "plg" + "pst" + "rar" + "tmp" + "vsmacros" + "vsw" + "vxd" + "w16" + "ws" + "apk" + "appx" + "cab" + "iso" + "library" + "lib" + "msix" + "mhtml" + "msixbundle" + "terminal" + "plugin" + "font" + "command" + "bundle"

# And then to apply the $filetypes list to the Default policy (sorted and duplicates removed)
$filetypes = $filetypes | Sort -Unique
Set-MalwareFilterPolicy Default -FileTypes $filetypes -EnableFileFilter $true

In October 2026 Microsoft announced they were going to add msix and msixbundle to all tenant. You will see from the above that if you had run this script before then you would have already have been protected.

To apply these changes to the Preset Policies, you need to collect the default filetypes from either the strict or standard policy rather than the default policy just in case they are different, though if you have made no changes then the default matches the two preset polices.

Then run the following to update the two preset policies with the above list that you have stored in the $filetypes array:

Get-MalwareFilterPolicy *preset* | Set-MalwareFilterPolicy -FileTypes $filetypes

This will return a warning (“WARNING: All recommended properties will be controlled by Microsoft.”) for each policy updated, but Microsoft do not centrally control the FileTypes policy so this warning can be ignored.