Remove file extensions blocked as Level 1

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\outlook\security\fileextensionsremovelevel1

This string value (REG_SZ) specifies the file name extensions that classic Outlook no longer treats as Level 1 attachments. Multiple extensions are represented as a semicolon-separated list.

The listed extensions are demoted from Level 1 to Level 2. The policy therefore does not make the affected attachments completely unrestricted: users can save a Level 2 attachment and then open it outside the message, but they cannot open it directly from the Outlook message.

For Level 1 attachments, Outlook prevents actions including opening, saving, printing, or otherwise working with the attachment in Outlook. The attachment remains part of the message.

Notes

Security

This policy reduces the protection applied to file types that Outlook normally blocks at Level 1 because they might contain scripts, executable code, or other harmful content. Users can save affected attachments to disk and subsequently execute them or open them with an associated application.

Level 2 classification does not validate a file's trustworthiness or inspect its actual content. It only requires the file to be saved before it is opened. The resulting risk therefore depends substantially on the extensions removed from Level 1 and the applications that process those files.

Notes

The value contains file name extensions, not complete file names or MIME types. Its name can be misleading: listed extensions are not necessarily made fully unrestricted; Microsoft documents the effect specifically as demotion from Level 1 to Level 2.

This setting is one of Outlook's dependent Security Form Settings policies. Outlook Security Mode must select the Outlook Security Group Policy as its security-policy source for these Group Policy values to be applied.

This ADMX-based policy applies to classic Outlook. New Outlook for Windows uses different, mailbox-based controls for attachment handling.

Microsoft documentation

Microsoft Learn: Information for administrators about e-mail security settings in Outlook

Microsoft Learn: List of settings for the Microsoft 365 Apps for Enterprise security baseline in Intune

Microsoft Support: Outlook blocked access to the following potentially unsafe attachments

Microsoft Learn: Map classic Outlook policies to new Outlook

See also

• Entry in the reference