Microsoft Teams To Give Administrators Greater Control Over Dangerous File Attachments

Microsoft is preparing to expand security controls in Microsoft Teams by allowing administrators to decide which file extensions should be blocked from chats and channels, giving organisations more control over how the collaboration platform handles potentially dangerous attachments.

The forthcoming capability extends Teams’ existing Weaponizable File Protection system, which prevents users from sending files with extensions commonly associated with malware, scripts and executable content. Until now, Microsoft has maintained the list of restricted extensions, leaving administrators unable to adapt it to their organisation’s particular risks or operational requirements.

According to Microsoft, administrators will soon be able to customise which file types Teams blocks or continue using Microsoft’s recommended default list. The change is currently described as being in development, with general availability scheduled for November 2026.

The feature is expected to apply across the Teams desktop, web, macOS, Android and iOS clients. Microsoft lists it for worldwide standard multi-tenant cloud environments, although deployment dates on the Microsoft 365 roadmap remain estimates and can change.

Microsoft expands Teams’ file security controls

Microsoft’s Weaponizable File Protection feature is designed to interrupt one of the most familiar routes used to deliver malware: persuading a user to open a dangerous attachment.

When the protection is enabled, Teams examines the extension of a file attached to a message. If that extension appears on the blocked list, the service prevents the entire message from being delivered. The recipient cannot view the message content or download the associated file.

The sender instead sees an indication that the message has been blocked and can edit it to remove the prohibited attachment before attempting to send it again. Microsoft’s technical documentation says the control applies to both chats and channels.

The November update will give security teams the option to move beyond Microsoft’s centrally defined list. An organisation could, for example, add file formats associated with software used only internally, prohibit legacy formats that are no longer needed or restrict scripting languages that present an unacceptable risk in its environment.

This flexibility could be particularly valuable in highly regulated organisations and sectors operating critical infrastructure, where a file format that appears benign in a typical office environment may carry considerably greater risk.

Administrators will also be able to retain Microsoft’s recommended list. This should provide a simpler option for businesses that lack the personnel or threat intelligence needed to maintain a reliable extension policy of their own.

External Teams conversations are also covered

The protection is not limited to messages exchanged between employees in the same organisation.

Microsoft says that when users from different organisations participate in a Teams conversation, the protection applies to everyone if at least one of the participating organisations has enabled it. An attachment using a prohibited extension can therefore be blocked across the conversation even if the sender’s organisation has not activated the feature.

That behaviour is significant because external collaboration has become routine across Microsoft 365 environments. Employees frequently use Teams to communicate with contractors, suppliers, professional advisers and customers, expanding the number of identities and devices capable of introducing content into corporate communication channels.

An attacker who compromises the account of a trusted external partner could exploit that relationship by sending a malicious file through an existing Teams conversation. The message may appear more credible than an unsolicited email because it originates from a recognised contact inside a platform used for normal business activity.

Blocking dangerous extensions at the messaging layer introduces an additional barrier before the attachment can reach the intended recipient.

Teams is increasingly treated as an attack surface

Collaboration platforms were once viewed primarily as productivity tools, but their security significance has increased as more business communication has moved away from email.

Teams messages can carry files, URLs, meeting invitations, application cards and communications from external tenants. Attackers have consequently looked for ways to exploit compromised Microsoft 365 accounts, weak external-access policies and users’ trust in familiar collaboration interfaces.

Traditional email security controls do not necessarily inspect every communication exchanged through Teams in the same way that they examine inbound email. An organisation with mature email filtering can therefore still face exposure if comparable controls have not been configured across its collaboration services.

The risk is not limited to executable programs ending in .exe. Script files, command files, installers, archives and other formats can be used to execute code, retrieve additional payloads or conceal malicious content. Some attacks depend on a user opening a file directly, while others combine an attachment with social engineering instructions intended to bypass warnings.

Earlier versions of Teams’ protection have reportedly included formats such as Windows batch and command files, Android packages, application installers and compressed archives. The exact policy, however, should be reviewed against Microsoft’s current documentation rather than treated as a permanent list, because threat assessments and product behaviour can change.

Giving administrators control over the extensions makes the protection more adaptable, but it also shifts some responsibility to individual organisations. An overly permissive list could leave dangerous formats available, while an excessively restrictive one could disrupt legitimate work and encourage users to move files through unsanctioned services.

Part of a broader messaging-security push

The planned update follows Microsoft’s broader effort to strengthen default safety controls in Teams.

In January 2026, Microsoft began enabling several messaging protections by default for tenants that had not already established customised settings. Those measures included weaponizable-file protection, malicious URL detection and a mechanism for reporting incorrect security detections.

Malicious URL protection is intended to identify suspicious or harmful links shared in chats and channels and present users with warnings. File protection addresses the attachment side of the same problem by stopping selected formats from being distributed through Teams messages.

Administrators can manage the existing file control through the Teams Admin Center. Microsoft’s documentation directs administrators to open Messaging settings, locate Messaging safety settings, and configure the option labelled Scan messages for file types that are not allowed.

The custom-extension capability should allow that policy to reflect an organisation’s own security requirements instead of operating solely from the Microsoft-selected list. Microsoft has not yet published complete public implementation instructions for the new controls, including any limits on the number of extensions, policy-scoping options or PowerShell support.

Those details are likely to become clearer closer to the scheduled November rollout.

Extension blocking has important limitations

Despite its value, extension-based blocking is not equivalent to malware analysis.

The existing Teams control identifies a file by its filename extension rather than conducting full content inspection at the message-delivery layer. This distinction creates an important limitation: an attacker may attempt to disguise a prohibited file by changing its extension.

A February 2026 question posted on Microsoft’s support forum described a test in which an executable was blocked when it used an .exe extension but was not stopped after being renamed with a .txt suffix. A Microsoft External Staff moderator said the Teams control was based on extensions rather than MIME type or the file’s underlying content.

Microsoft’s new customisation option changes which extensions an organisation can restrict; it does not, based on the currently available description, transform the feature into a full content-analysis or malware-detection engine.

Extension filtering should consequently be regarded as one part of a layered defence. It can block common and accidental transmission paths, but it cannot independently determine whether every permitted file is safe.

Microsoft recommends using additional protection for files stored in SharePoint, OneDrive and Teams. These services underpin much of the file-sharing activity in Microsoft 365, while Microsoft Defender products can provide further malware inspection and response capabilities.

Defender for Office 365 also provides a Tenant Allow/Block List through which security teams can block known files using their SHA-256 hashes. Hash-based blocking identifies a specific file rather than every file sharing a particular extension, making it useful when defenders have confirmed that a particular payload is malicious.

However, hash controls have their own limitations. Even a small modification to a malicious file generally produces a different hash, meaning adversaries can generate new variants. Extension policies, hash blocking, malware scanning, endpoint detection and response, and behavioural monitoring therefore address different parts of the threat.

Organisations should prepare before the rollout

Security teams should avoid waiting until November to decide how the new setting will be used.

A useful preparation exercise would involve documenting the file types legitimately exchanged through Teams, identifying executable and script formats that employees do not need, and reviewing whether sensitive departments require stricter policies than the rest of the organisation.

Teams administrators should coordinate with security operations, endpoint-management personnel and business application owners. A file type that seems unnecessary from a security perspective may support a specialised engineering, development or operational workflow. Blocking it without consultation could interrupt work or encourage users to share the same content through personal email, consumer cloud-storage platforms or other unmonitored channels.

Policies should be tested with a representative group before wider deployment. Administrators should also prepare help-desk guidance explaining why a message may be blocked and what approved transfer method employees should use when a legitimate file cannot be sent through Teams.

Where an organisation must permit a potentially dangerous format, it should consider compensating controls. These could include restricting who can receive it, requiring transfer through a managed repository, applying malware scanning, isolating execution environments and monitoring endpoints for suspicious child processes or script activity.

Security teams should also examine external-access and guest-collaboration policies. Blocking selected file extensions is helpful, but it does not replace controls governing which external organisations and identities can communicate with employees.

A useful control, but not a complete defence

Microsoft’s decision to make the blocked-extension list configurable closes a notable administration gap in Teams. The existing protection gave organisations a straightforward way to stop recognised high-risk formats, but its fixed configuration could not account for sector-specific threats, internal technology choices or differing levels of risk tolerance.

The November update should make the control more practical for larger and more mature security programmes while preserving Microsoft’s standard list for organisations that prefer a managed default.

Its effectiveness will nevertheless depend on how carefully administrators configure it. Blocking too little may preserve unnecessary exposure, while blocking too much can interfere with business processes and push file sharing outside managed systems.

Most importantly, organisations should not mistake filename filtering for comprehensive malware detection. Custom extension policies can reduce common attack opportunities, but determined adversaries may rename files, use permitted container formats, deliver malicious URLs or compromise trusted cloud content.

Used alongside content inspection, Defender controls, endpoint protection, identity security and appropriately restricted external collaboration, the expanded Teams policy can become a valuable additional layer in an organisation’s Microsoft 365 defence strategy.