Security Policy Errors

How to Block .HTM, .HTML, and .EXE Attachments in Microsoft 365 Outlook

John Wilson Oct 19, 2026 868 views

Question details

The user wants to know how to restrict or block inbound emails that contain specific, potentially dangerous file attachments like .htm, .html, and .exe in Microsoft 365.

How to Block Emails with .HTM, .HTML, or .EXE Attachments in Microsoft 365

Product: Microsoft 365 / Exchange Online
Device & OS: not provided
Scenario: An organization or user is trying to implement stricter email security policies to prevent phishing attacks and malware delivered via specific file extensions.
Observed behavior: Standard Outlook email clients lack a built-in user setting to block emails strictly by attachment file extension, requiring administrative server-level configuration.

Before you start

Ensure you have Microsoft 365 Global Administrator or Exchange Administrator privileges, as standard personal Outlook accounts cannot configure server-side attachment blocking rules.

Solution 1Recommended

Create a Mail Flow Rule in Exchange Admin Center

Use the Exchange admin center (EAC) to set up a server-wide mail flow rule that identifies and blocks specific file extensions before they reach users' inboxes.

This method ensures that potentially dangerous files like .htm, .html, and .exe are intercepted at the server level. Only administrators with a Microsoft 365 Business Exchange Online subscription can perform this action.

Log in to the Exchange Admin Center

Navigate to the Microsoft 365 admin portal and open the Exchange Admin Center (EAC) using your global administrator credentials.

Navigate to Mail Flow Rules

In the left-hand navigation menu, click on 'Mail flow' and then select 'Rules'.

Create a New Rule

Click the '+ Add a rule' button and select 'Create a new rule'. Give your rule a descriptive name, such as 'Block dangerous attachments'.

Define the Conditions

Under 'Apply this rule if...', select 'Any attachment' and then choose 'file extension includes these words'. Enter the extensions you want to block (e.g., htm, html, exe) and click 'Add'.

Set the Block Action

Under 'Do the following...', select 'Block the message' and choose whether to reject it with an explanation or delete it without notifying anyone.

Save and Enable the Rule

Review your settings, click 'Save', and ensure the rule's status is toggled to 'Enabled'.

Create a Mail Flow Rule in Exchange Admin Center

Rule Propagation Time: It may take up to 30 minutes for newly created mail flow rules to fully propagate and start filtering emails across your Microsoft 365 environment.

Solution 2

Submit a Feature Request for Personal Outlook

For standard personal Outlook users who cannot access Exchange Online mail flow rules, the official path is to submit feedback for future application updates.

Free Microsoft Office alternative

Looking for a Lightweight Alternative for Your Office Needs?

While enterprise email security requires Microsoft 365 administrative tools, everyday document creation doesn't have to be complex or expensive. WPS Office provides a fast, free, and highly compatible alternative to Microsoft Word, Excel, and PowerPoint for your daily productivity needs.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Install the Software: Run the downloaded executable file and follow the simple on-screen instructions.
3. Start Creating: Open WPS Office to instantly view, edit, and create documents perfectly compatible with Microsoft formats.

Completely free and lightweight Office suiteFully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Built-in PDF editing and secure document sharing toolsFamiliar tabbed user interface with zero learning curve required

microsoft office alternative - wps office

Frequently Asked Questions

Can a standard Outlook user block emails based on attachment types?

No, standard Outlook clients do not provide a user-level setting to block incoming emails based purely on specific attachment file extensions. This restriction must be configured at the server level by a Microsoft 365 global administrator.

Why are .htm and .html files often targeted by security policies?

Attackers frequently use HTML attachments to bypass standard email text filters. When a user opens these attachments, they can execute malicious scripts locally or silently redirect the user to deceptive phishing login pages.

Can I quarantine these attachments instead of deleting them outright?

Yes. When creating the mail flow rule in the Exchange Admin Center, administrators can choose the action 'Deliver the message to the hosted quarantine' instead of rejecting or deleting the message, allowing admins to manually review the blocked files.

Microsoft Office Security Issues