Outlook on the web does not provide a general user setting to turn off blocked-attachment protection. For a work or school account, an administrator may be able to adjust which file types are blocked, depending on the organization’s Exchange or Microsoft 365 configuration. For a legitimate blocked file, Microsoft recommends sharing it through OneDrive or SharePoint as a link.
What you can and can’t change in Outlook on the web
Outlook blocks certain potentially unsafe file types, including examples such as .exe, .bat, .vbs and .js. Microsoft’s instructions do not document a personal Outlook on the web switch for disabling this protection. The rules that apply to a work or school mailbox may be managed by the organization. Microsoft’s blocked-attachments guidance says an Exchange administrator may be able to unblock certain types or adjust mailbox security settings; it does not guarantee that every organization allows exceptions.
As an Amazon Associate I earn from qualifying purchases.
Attachment protection is different from preview behavior. Outlook on the web lets you open or preview, download, or save supported attachments to OneDrive, and edit supported Office files in a browser or desktop app. Those actions do not make a blocked file type safe or turn off its protection. Microsoft’s attachment instructions describe these file actions.
For a blocked file in a work or school account
Ask your Microsoft 365 or Exchange administrator
If you need a blocked file for work, contact your organization’s Microsoft 365 or Exchange administrator and ask whether the file type can be allowed under its security policy. The administrator, not an individual Outlook on the web preference, is the right person to check. Policies and available exceptions vary by organization, so there is no universal menu path for users to change.
#1 Best Overall
Ask the sender to share it through OneDrive or SharePoint
For a legitimate file, the supported alternative is for the sender to upload it to OneDrive or SharePoint and share a link with you, using access permissions appropriate to the recipients. Microsoft recommends this instead of attaching a blocked file: “If you need to send one of these file types to an email recipient, we recommend using OneDrive and sending the recipient a link to the file instead.” See Microsoft’s guidance on blocked attachments.
Do not treat renaming a file extension as a safety fix. A renamed executable can remain dangerous when restored. If an attachment arrives unexpectedly, verify it with the sender before opening it. Microsoft’s Outlook.com account-protection guidance advises against opening a message when Outlook.com displays a red safety bar indicating potentially unsafe content has been blocked.
Don’t confuse attachment blocking with other Outlook settings
Attachment Preview in classic Outlook for Windows
The documented “Turn off Attachment Preview” control is for classic Outlook for Windows, under File > Options > Trust Center > Trust Center Settings > Attachment Handling. It changes preview behavior in that desktop application; it is not an Outlook on the web setting and does not unblock risky file types. Microsoft’s attachment workflow instructions distinguish these actions.
Recommended Free Tools
Link Preview
The Settings > Mail > Compose > Link preview preference controls rich previews of URLs in messages. It does not control scanning or blocking of file attachments. Microsoft’s Link Preview instructions cover that separate feature.
Rank #3
- The Microsoft Office 365 Bible: The Most Updated and Complete Guide to Excel, Word, PowerPoint, Outlook, OneNote, OneDrive, Teams, Access, and Publisher from Beginners to Advanced
- ABIS BOOK
External images
Blocking external images is a privacy-related setting for remote images and web beacons, not an attachment control. The cited Microsoft instructions are specific to Outlook mobile; they should not be taken as a setting path for Outlook on the web. Read Microsoft’s mobile external-images guidance.
Personal Outlook.com accounts are a separate case
Eligible personal Outlook.com mailboxes with Microsoft 365 Personal or Family have separate advanced-security controls. In that context, Microsoft documents a Safelinks setting at Settings > Subscription > Security. Safelinks is not a general attachment-blocking switch, and this consumer feature does not apply to organization-managed Outlook on the web accounts. Microsoft also says changing the setting affects future messages rather than retroactively changing links in messages already received. See Microsoft’s Outlook.com advanced-security guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Older Outlook Web App guidance
Microsoft has separate legacy documentation for Outlook Web App with Exchange Server 2013 and 2010. Its advice to preview rather than download attachments on shared or public computers, then sign out, applies to that older environment; it is not a current setting path for Microsoft 365 Outlook on the web. See the legacy Outlook Web App security guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
