Someone from outside your company sends your office manager a message in Microsoft Teams. This week there’s a paperclip icon in that chat window that wasn’t there last month.
\n\n
That’s not a glitch. It’s a default setting that Microsoft is changing, and it’s rolling out to most businesses between late October and late November 2026.
\n\n
It’s a small change that makes a real annoyance go away. It also deserves about ten minutes of your attention before it lands.
\n\n
What’s Actually Changing
\n\n
Microsoft Teams lets your staff chat directly with people at other companies that also use Teams. Microsoft calls this “external access” or “federation.” It’s the thing that lets your project manager message a contractor at a different firm without either of you setting up a guest account.
\n\n
Until now, sharing a file in one of those chats was clumsy. You couldn’t just attach it. You had to upload the file to OneDrive or SharePoint first, set the sharing permissions yourself, copy the link, and paste it into the chat. Miss the permissions step and the other person clicked your link and got an access-denied screen.
\n\n
After this change, your team gets the paperclip button and drag-and-drop in those external chats. Attach a file and Teams handles the permissions automatically so the people in that chat can actually open it.
\n\n
A few details worth knowing. Files you upload from your computer land in the sender’s OneDrive. Files already stored in the cloud stay where they are. The file gets shared as a link after you send it, and the sender can review, change, or remove access both before sending and afterward.
\n\n
Microsoft is rolling this out starting late October 2026, with completion expected by late November.
\n\n
The Part Most Coverage Got Wrong
\n\n
When Microsoft first announced this in late September, the notice said the change would apply even to organizations that had already turned this feature off. That understandably annoyed a lot of IT professionals. If a business deliberately disabled external file sharing, it usually had a reason.
\n\n
Microsoft listened and reversed that decision in a revision to the announcement.
\n\n
Here’s where it actually landed: the change only affects organizations that never configured the setting one way or the other. If your IT provider explicitly turned this off at some point, it stays off. Nothing changes for you.
\n\n
If nobody ever touched it, you’re in the default state, and the default is what’s flipping.
\n\n
That’s a meaningfully smaller change than the one described in a lot of the coverage still floating around, and it’s worth knowing which story is current.
\n\n
One other thing that will confuse anyone who goes looking: Microsoft’s own documentation currently still says this feature is off by default and that admins have to turn it on. That page is accurate about how things work today. It simply hasn’t been updated for the rollout yet. Both statements are true about different moments in time.
\n\n
Why “On By Default” Still Deserves a Look
\n\n
This isn’t a security crisis, and anyone telling you it is wants your attention more than they want to help you. But there’s a real consideration underneath it.
\n\n
Your company’s sharing restrictions govern your files. When someone at another company shares a file to your staff, that file is governed by their company’s policies and security controls. Those may be considerably looser than yours. You don’t get a vote.
\n\n
Worth knowing too: by default, anyone using Teams at any other organization can start a chat with someone at your company. There’s no approved-companies list unless somebody set one up.
\n\n
Put those together and the scenario is straightforward. An attacker starts a friendly conversation with one of your employees, builds a little trust over a few messages, and sends a file. Making that file one click easier to send and open is a convenience improvement for legitimate work and for the other kind.
\n\n
Email has spent decades building up attachment scanning and filtering. This path is newer and the protections are less mature. That’s not a reason to panic. It’s a reason to make a deliberate decision instead of inheriting one.
\n\n
How to Decide Whether You Want It
\n\n
Most businesses fall into one of three groups.
\n\n
Your team works with outside companies constantly
\n\n
If your staff trade files with clients, vendors, contractors, or partners as a normal part of the workday, leave this on. It removes a genuine source of friction and a common support call. The people who were going to share those files are sharing them anyway, usually through something far less controlled than OneDrive, like a personal Dropbox or a Gmail attachment.
\n\n
You handle sensitive or regulated data
\n\n
Medical practices, law firms, financial services, anyone under HIPAA or similar obligations: review this before it lands. You may still decide to leave it on, but that should be a decision somebody made on purpose and can explain during an audit.
\n\n
Your staff have no business swapping files with outside Teams users
\n\n
Plenty of businesses have no legitimate workflow that requires it. If that’s you, turn it off. An unused capability that’s switched on is just unnecessary exposure.
\n\n
How to Turn It Off, or Narrow It Down
\n\n
This isn’t a checkbox in the admin center. It’s controlled through Teams PowerShell, which means it’s a job for whoever manages your Microsoft 365 environment.
\n\n
The relevant command is Set-CsTeamsFilesPolicy, run after connecting with Connect-MicrosoftTeams. Two things are worth asking your IT provider about specifically:
\n\n
The attachment experience and the automatic permission assignment are controlled separately. You can allow people to attach files while still requiring permissions to be set deliberately. For some businesses that middle ground is exactly right.
\n\n
It doesn’t have to be all-or-nothing. The policy can be scoped to specific groups rather than applied across the whole company. Your sales and project teams can have it while your finance department doesn’t.
\n\n
Two practical notes: changes can take several hours to propagate before anyone sees a difference, and the setting can be configured before the rollout reaches you. Your preference will be respected when it arrives. There’s no need to wait and react.
\n\n
Exact timing varies between tenants, so the date your business sees this may differ from a neighbor’s. Your IT provider can look up where your organization sits in the schedule.
\n\n
What to Do This Month
\n\n
The useful version of this is one question to whoever handles your IT: “Has anyone ever configured external file sharing in Teams, and which way will we land when this changes?”
\n\n
If the answer is “nobody’s touched it,” you’re getting the new behavior. Decide whether that’s what you want while you still have a choice.
\n\n
While you’re in there, it’s a good moment to look at what your company has already shared outward over the years. Most businesses have sharing links still active from files that stopped being relevant a long time ago. We wrote about how to audit those old sharing links recently, and it pairs naturally with this one.
\n\n
If you’d rather not chase this down yourself, that’s fair. Castle Rock Sky works with businesses across Castle Rock and the Denver metro to keep Microsoft 365 configured the way the business actually needs it, instead of the way it shipped. We’re happy to check your tenant’s current setting and tell you exactly which way you’ll land before late November.
\n\n
Get in touch and we’ll take a look.
