We handle all your technical problems so you can focus on growing your business.
A single pink paper clip on a teal felt background.
Microsoft 365Practical insight for your business.

Teams Is Turning On File Attachments in Chats With Other Companies. Decide Before Late October.

Starting in late October 2026, Microsoft Teams will add the paperclip and drag-and-drop to chats with people at other organizations, unless an admin has already set the option. Who is affected, how it relates to fake help-desk chats, and the settings to decide on now.

Kevin R.

10 min read

Photo by Андрей Сизов on Unsplash

The takeaway

Before the rollout begins in late October, decide whether staff should attach files in Teams chats with other companies, set that choice explicitly with the PowerShell command in the Microsoft notice, and limit which outside organizations can chat with your staff.

Starting in late October 2026, Microsoft Teams will let people attach files in chats with people at other companies, using the paperclip button or drag-and-drop, unless someone at your organization has already set the option. That’s according to Microsoft 365 Message Center notice MC1479514, which Microsoft published on Friday, September 25, 2026 and last updated on Tuesday, October 6, 2026. Admins can read it in the Message Center of the Microsoft 365 admin center, and an independent site keeps a public copy of the text.

This affects any business whose staff use Teams to chat with clients, vendors or partners at other organizations. A default like this is easy to accept without noticing, so it’s worth making the decision on purpose before the rollout reaches you.

What is changing

Teams calls chats with people in other Microsoft 365 organizations “external” or “federated” chats. Under the current default, file attachments in those chats are off until an admin turns them on, according to Microsoft’s documentation for the feature. People can still paste a link to a file.

According to the notice:

  • The paperclip and drag-and-drop become available by default in external one-on-one chats, external group chats and meeting chats, in the Teams desktop and web apps.
  • The rollout begins in late October 2026 and is expected to finish by late November 2026.
  • Files uploaded from a computer are stored in the sender’s OneDrive. Files already in the cloud stay where they are. The chat shows them as links.
  • Teams gives the people in the chat access automatically. When automatic permission assignment is on, Teams grants chat participants access to files sent with the paperclip or drag-and-drop, “subject to existing OneDrive and SharePoint policies.” Microsoft’s documentation lists this automatic sharing as a public preview feature that is on by default. Senders can review or remove access before sending, and change or revoke it later.
  • Your existing sharing rules still apply. Microsoft says the update “does not change your OneDrive or SharePoint external-sharing settings or override existing access restrictions,” and that sensitivity labels and domain restrictions continue to apply.

Microsoft’s documentation page, last updated Thursday, March 12, 2026, still describes the feature as off by default. The notice is where the new default is announced.

Who is affected

Microsoft says the change “only impacts tenants who have not adjusted the policy that controls file attachment in an external Teams chat.” (A tenant is your organization’s Microsoft 365 account.) In its words, “Any customers who have left the configuration in the default state will be impacted.”

Two things suggest that includes a lot of small businesses:

  • External chat is on by default. Microsoft’s external access guide says Teams allows chat with all external domains unless an admin limits it.
  • The attachment setting has no button. Microsoft’s notice and documentation give PowerShell, its command-line tool for admins, as the way to change it. If nobody has run that command for your organization, you are most likely in the default state.

If you read early coverage of this notice, check the current version. Microsoft has revised it three times (September 29, October 1 and October 6), and it now says that if you opt out before the rollout, “your policy setting will be respected.”

One gap remains. The setting’s documented default value is “Disabled” (Microsoft Learn), so a check that shows Disabled doesn’t tell you whether anyone ever chose it, and Microsoft hasn’t said how it tells the two apart. The notice tells admins to apply the Disabled setting “if you have not already explicitly configured this setting.” If you want attachments off, run the command before the rollout instead of relying on what the check shows.

Why this matters: fake help-desk chats

External Teams chat is already a channel for scams. In a June 2024 update to a report first published May 15, 2024, Microsoft said a criminal group it calls Storm-1811, which it describes as known to deploy Black Basta ransomware, had used Teams messages and calls to pose as IT or help-desk staff. Microsoft said the group used tenants it created, with display names such as “Help Desk,” “Help Desk IT” and “IT Support.” Those contacts led to misuse of Quick Assist, a remote-support tool built into Windows, and then to stolen credentials.

In an analysis published October 7, 2025, Microsoft wrote that tech support scams “remain a generally popular pretext” and that “Threat actors attempt to deliver malware through file attachments in Teams chats or channels.”

Those reports describe earlier activity, not the new default. They do show why the default deserves a decision:

  • The paperclip appears for outside organizations too. Every organization that hasn’t set the option gets it, and that could include a real vendor whose account has been taken over. Microsoft’s documentation says people using the free version of Teams can’t attach files from their OneDrive in these chats, so the change mainly concerns people at organizations that use Teams for work.
  • Microsoft describes your setting in terms of your own staff. Its documentation explains the setting as controlling whether your users see the paperclip. It doesn’t say that turning it off blocks files that people at other organizations attach in chats with your staff.
  • An outsider’s file lives on their side. A file someone at another company attaches is stored in their OneDrive, under their organization’s sharing and security settings. Microsoft 365 includes built-in virus scanning for OneDrive and Teams files, but Microsoft says not every file is scanned and the built-in scanning isn’t “intended as a single point of defense against malware” (Microsoft Learn).

So for incoming files, the control that matters most is who can chat with your staff in the first place.

There’s an outgoing side as well. An employee can drag a spreadsheet into a chat with three people at a vendor, and Teams will give all three access. That’s convenient, and it also makes it easy to send the wrong file to the wrong group.

Where the settings are

1. The attachment setting (PowerShell). Whoever manages your Microsoft 365 account can run these commands, which come from Microsoft’s notice and documentation. To see the current value for every Teams files policy:

Connect-MicrosoftTeams
Get-CsTeamsFilesPolicy | Select Identity, FileSharingInChatsWithExternalUsers

To keep attachments off (the opt-out):

Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled

To turn them on deliberately, use Enabled instead. Microsoft says changes can take several hours to reach users.

Global is the organization-wide default. If the check lists other policies too, anyone assigned one of them gets that policy instead of Global (Microsoft Learn), so set each one.

2. Automatic sharing (optional middle ground). To allow attachments but stop Teams from granting access on its own, Microsoft gives this command:

Set-CsTeamsMessagingPolicy -Identity Global -AutoShareFilesInExternalChats Disabled

Senders then grant access themselves, and outside recipients may not be able to open a file until they do. As with files policies, staff assigned a messaging policy other than Global keep that policy’s setting, so set each one.

3. Who can chat with your staff. In the Teams admin center, go to Users > External access. Next to Teams and Skype for Business users in external organizations, choose Allow only specific external domains, then add the domains of the clients and vendors you work with. All other domains are then blocked, and Microsoft notes the other organization must also allow yours (Microsoft Learn). On the same page, you can stop people with personal Teams accounts from starting chats with your staff by clearing External users with Teams accounts not managed by an organization can contact users in my organization.

An allowlist takes upkeep, because each new client or vendor has to be added before staff can chat with them. If that’s too much, a block list on the same page is a lighter but weaker option.

4. What can leave in the first place. In the SharePoint admin center, go to Policies > Sharing. The External sharing level there covers SharePoint and every user’s OneDrive, and More external sharing settings lets you limit sharing to specific domains (Microsoft Learn). According to Microsoft’s notice, these settings still decide what outsiders can open. They also govern pasted links, which the Teams setting doesn’t stop.

5. Guest accounts. Microsoft’s documentation says outside people who open files your staff share do so as guest accounts in your directory, created as needed “if allowed by policy.” By default, Microsoft says, all users in your organization, including guests, can invite outside people as guests (Microsoft Learn). Who can invite guests is set in the Microsoft Entra admin center under Entra ID > External Identities > External collaboration settings. To review the guests you have, open the Microsoft 365 admin center and go to Users > Guest users, where you can also remove access (Microsoft Learn).

A short decision list

  • Turn it off if staff rarely trade files with outside organizations in Teams, or if you handle sensitive records, such as patient, financial or legal files, that you’d rather send through a channel you control. Run the Disabled command before late October.
  • Turn it on deliberately if staff work with partners in Teams every day. Pair it with a domain allowlist for external chat, check your OneDrive sharing level, and decide whether automatic sharing should stay on.
  • Take the middle ground by allowing attachments with automatic sharing turned off, so staff choose who gets access to each file.

Whichever you choose, tell staff:

  • Teams labels people from other organizations as External. Microsoft advises users to check that label, “be cautious about what they share, and never share their account information or authorize sign-in requests over chat.”
  • Write down how your real IT support contacts staff, such as a ticket system, a known phone number or a named person, so a “Help Desk” chat from an unfamiliar organization stands out.
  • Treat an unexpected file in an outside chat like an unexpected email attachment. Confirm with the sender another way before opening it.
  • Opening a file from another company may ask them to consent to that organization and sign in as its guest, according to Microsoft’s documentation. If the organization isn’t one they expect, they should stop and ask.

Questions to ask your IT provider

  • “What is our external chat file-sharing setting, and was it set on purpose? Do we have Teams files policies other than Global?”
  • “Who can start a Teams chat with our staff: anyone, or only a list of domains?”
  • “What is our OneDrive and SharePoint external sharing level?”
  • “Do we review guest accounts, and how often?”

If you’d like help reviewing these settings before the rollout starts, NightSquawk Tech offers a free assessment.

Sources

Editorial note: This article was drafted with AI assistance from Microsoft’s Message Center notice MC1479514, Microsoft Learn documentation and Microsoft Security Blog reports, linked above. The notice was read through a public copy of the version updated October 6, 2026, because the Message Center itself requires an admin sign-in; Microsoft has revised it three times and may do so again. Setting names and commands are as Microsoft documented them on October 7, 2026. NightSquawk Tech uses remote-support tools to help its own clients; it did not test the new default.