This is MC1479514. Microsoft turns file sharing in external (federated) Teams chats on by default, even if it was already Disabled. There is no switch in the Teams admin center. You do it with the MicrosoftTeams module. Rollout: late October through late November 2026 (Targeted Release, worldwide, GCC, GCC High, DoD). A policy takes several hours to show up in the client.

Wait until rollout has hit your tenant. Setting Disabled in September is switched back to Enabled. Run the script again when the paperclip shows in an external chat, or when Get-CsTeamsFilesPolicy reads Enabled.

1. Current value

PowerShell 7, Teams Administrator role. Module: MicrosoftTeams. Install and connect: this guide.

PowerShell
# PowerShell 7 (pwsh), not ISE. Role: Teams Administrator.
Install-Module MicrosoftTeams -Scope CurrentUser -Force
Import-Module MicrosoftTeams
Connect-MicrosoftTeams

Get-CsTeamsFilesPolicy |
    Select-Object Identity, FileSharingInChatsWithExternalUsers |
    Format-Table -AutoSize

2. Turn it off

Global applies to everyone without another files policy. A custom CsTeamsFilesPolicy wins over Global. The script therefore sets Disabled on every policy, not only Global. The values are Enabled and Disabled, not True or False.

PowerShell
# Run again AFTER rollout reaches this tenant.
# A Disabled you set before rollout is turned back on.
Set-CsTeamsFilesPolicy -Identity Global -FileSharingInChatsWithExternalUsers Disabled

Get-CsTeamsFilesPolicy | Where-Object { $_.Identity -ne 'Global' } | ForEach-Object {
    Set-CsTeamsFilesPolicy -Identity $_.Identity -FileSharingInChatsWithExternalUsers Disabled
}

Get-CsTeamsFilesPolicy |
    Select-Object Identity, FileSharingInChatsWithExternalUsers |
    Format-Table -AutoSize

After that, the paperclip is gone in external 1:1 chats, group chats and meeting chats. Pasting an existing link still works. That link keeps the permission it already had.

3. One group may still do it

PowerShell
# Optional. One group may still attach files. Everyone else stays off.
# -Rank is required when you grant a policy to a group.
New-CsTeamsFilesPolicy -Identity "Allow-external-files" -FileSharingInChatsWithExternalUsers Enabled
Grant-CsTeamsFilesPolicy -Group "<Entra group object id>" -PolicyName "Allow-external-files" -Rank 1

4. Allow the attach, no automatic permission

Skip step 2 in that case. The paperclip stays. Teams does not grant the people in the chat permission by itself. The sender has to set it, or the other person cannot open the file. This sits on the messaging policy, not the files policy. If file sharing itself is off, this switch does nothing for files. Loop components are still shared automatically.

PowerShell
# Middle option: paperclip stays, Teams does not grant access by itself.
# Do this on every messaging policy you assign, same as the files policies.
Get-CsTeamsMessagingPolicy |
    Select-Object Identity, AutoShareFilesInExternalChats |
    Format-Table -AutoSize

Get-CsTeamsMessagingPolicy | ForEach-Object {
    Set-CsTeamsMessagingPolicy -Identity $_.Identity -AutoShareFilesInExternalChats Disabled
}

What PowerShell does not turn off

  • SharePoint and OneDrive sharing, sensitivity labels and domain restrictions still decide access. The file sits in the sender’s OneDrive, with an External label.
  • Pasted links do not change permission.

Source: MC1479514 and Share files and Loop in external chats on Microsoft Learn.

Frequent errors and how to fix them

These are the messages people type into search when the module will not start. The exact wording is here so this page can be found.

The term 'Connect-MicrosoftTeams' is not recognized
MicrosoftTeams module missing. Install-Module MicrosoftTeams; new window; Import-Module MicrosoftTeams.
AADSTS / consent / MFA
Teams cmdlets need a Teams admin role, or app-only with the right Graph/Skype permissions.
Assembly / version conflict
Multiple MicrosoftTeams versions. Uninstall-Module MicrosoftTeams -AllVersions, then install one current version.
A parameter cannot be found that matches parameter name 'ThreadedChannelCreation'
MicrosoftTeams module too old. 7.1 or later in PowerShell 7. Cmdlet is Set-CsTeamsChannelsPolicy (Channels, plural).
layoutType / Invalid request
Graph scope ChannelSettings.ReadWrite.All missing, or the client does not expose layoutType yet. PATCH with Invoke-MgGraphRequest.

Questions about this, or need help setting it up? We are happy to think along.

Message on LinkedIn →