You know the moment. A vendor emails “please review the updated invoice” and your team replies, “Outlook blocked it, can you resend?” Or worse, someone forwards it to a personal Gmail account “just to get it done”.

Outlook blocking certain attachment types isn’t Microsoft being difficult. It’s Microsoft trying to stop the most common way malware gets into a business: a file that looks normal enough to open.

What Outlook is actually blocking (and why)

Outlook blocks attachments that can directly run code on a computer, or that are commonly used to sneak code in. Think of them as “one double-click away from trouble”.

A few common examples you’ll see blocked include:

  • Executable and installer files. Things like.exe and.msi are designed to run software.
  • Scripts. File types like.js,.vbs, and PowerShell scripts can run commands.
  • Shortcuts and system files. Items like.lnk can point somewhere unexpected.

Outlook has a built-in blocked list, and in many businesses there are extra blocks added at the organisation level. That’s why one company might receive a file type that another company cannot.

The business reason this matters is simple: a lot of real-world attacks are delivered as attachments that “do something” when opened. Blocking the attachment type removes the temptation and the accident.

The vendor and invoice problem (where teams get stuck)

Most blocked-attachment conversations start in accounts payable, operations, or HR, not IT.

Here are the patterns we see most often:

  • A vendor sends an “invoice” as a weird file type. It might be a script, a macro-enabled file, or an archive that contains something executable.
  • A vendor sends a link, but it’s a consumer file share. Your team can’t tell if it’s legitimate, and nobody wants to click.
  • A customer asks you to send “the installer” by email. Your team tries, Outlook blocks it, and someone starts looking for a workaround.

Your goal is not “let everything through”. Your goal is “keep the work moving without training people to bypass controls”.

Safer ways to share files (that don’t break your workflow)

If email attachments are your default, this is the shift to make: send fewer files, share more links, with permissions.

A practical menu that works for most growing businesses:

  • Share a OneDrive or SharePoint link. Put the file in the right place, then share a link with the right permissions (view vs edit). This avoids sending risky file types as attachments, and it gives you control over access.
  • Use “attach as a link” instead of attaching a copy. In Outlook, you can share cloud files as links. It’s faster, and if you need to revoke access later, you can.
  • Ask vendors for PDFs for invoices and statements. For billing documents, a PDF is usually the right format. If a vendor insists on sending something else, that’s a good moment to ask why.
  • Use a secure portal for sensitive documents. For items like tax forms, payroll files, or anything with bank details, a portal beats email every time. Even a well-run SharePoint vendor folder can be a big step up.

One small but important point: zipped files are not automatically “safe”. A.zip can carry the same dangerous file types inside it. Treat “it’s zipped” as packaging, not protection.

What to set up in Microsoft 365 so people don’t use personal email

Most workarounds happen because the official path is slower than the unofficial one. Fix the path.

Here are the Microsoft 365 settings and habits that make blocked attachments a non-issue day to day:

  • Clear rules for where files belong. If your team knows “vendor docs go in this SharePoint site” and “finance working files go in this Team”, sharing links becomes normal instead of awkward.
  • Sharing settings that match how you work. If sharing is too locked down, people will route around it. Set sensible defaults, and make sure external sharing is allowed where the business genuinely needs it (with guardrails).
  • Anti-malware attachment filtering. Exchange Online and Defender policies can block or quarantine specific file types at the mail layer. That way, you are not relying on each person to notice a risky attachment.
  • Safe Attachments (where licensed). Defender for Office 365 can detonate attachments in a safe environment and help catch threats that are not blocked purely by file extension.
  • Macro controls for Office files. A lot of “invoice” and “shipping document” malware relies on macros. Microsoft has been tightening macro behaviour for files that come from the internet, and you want that protection in place.
  • A simple escalation path. When a blocked file is legitimate (it happens), your team needs a clear process: who reviews it, where it gets uploaded, and how it gets shared back safely.

If you do just one thing, make it this: give your team a fast, approved way to request a secure upload link for vendors. When the path is easy, personal email stops being tempting.

A quick policy you can send to vendors

Vendors often keep doing what you accept. A short standard reply helps.

You can give your team wording like:

  • “Please resend as a PDF or share a link.” For invoices and statements, this is a reasonable default.
  • “We can’t accept executable or script attachments by email.” It’s firm, and it signals that this is policy, not preference.
  • “If you need to send a large file, we’ll provide a secure upload link.” This keeps control on your side.

Over time, this reduces the back-and-forth and trains your vendor ecosystem to work in safer formats.

The takeaway

Outlook blocking attachments is a productivity issue only when file sharing is improvised. Once you standardise on sharing links from OneDrive and SharePoint, and you back it up with the right Microsoft 365 policies, the “just forward it to Gmail” habit fades fast.

If you would like help tightening your Outlook and Microsoft 365 attachment controls without breaking vendor and invoice workflows, the Flexnet Networks team can set that up with you.

Sources