In early November 2026, several Teams changes arrive at the same time: file sharing in external chats opens up to tenants that had not blocked it, guest reporting lands in the admin center, and voicemail prepares a custom sending domain. You will learn which settings to record before the switch, with which scripts, and which neighbouring announcements (Entra, Copilot, Defender) also call for a decision.
File sharing in federated chat: what MC1479514 changes
Until now, a user could not drop a file into a chat with someone from another tenant, either with the paperclip or by drag and drop; you had to go through PowerShell. The general availability date was "to be determined". Advisory MC1479514, published on 25 September 2026 and updated on 29 September, sets it: Teams is to automatically allow file sharing in federated chat from late October 2026 and to set external participants' permissions itself, as detailed in the Office 365 for IT Pros analysis.
Since the update of 1 October 2026, following criticism, Microsoft limits the change to tenants that had not already blocked this sharing. If you had disabled the setting, your configuration should not move. Conversely, a tenant that never explicitly decided is probably within scope: that is our own inference, to be confirmed by recording the value actually applied.
Strengths
- Less friction: paperclip and drag and drop work with external contacts
- External participants' permissions set automatically by Teams
- No more need to work around the limit with PowerShell
Limitations
- Tom Carter finds the approach hard to reconcile with Zero Trust
- Without an allow list, any Teams tenant can open a federated chat
- External recipients may not have access to the file by default
The setting to record and the safeguards that remain active
The setting to check is FileSharingInChatsWithExternalUsers, in the Teams Files policy (Get-CsTeamsFilesPolicy). The Microsoft Learn documentation on external chats specifies that files and Loop components are disabled there by default and that an administrator must enable them. It adds that OneDrive and SharePoint settings continue to apply: sensitivity labels, domain restrictions, protection against malicious links. Automatic permission sharing is described there as a public preview, enabled by default.
This page therefore describes a starting state, whereas the MC advisory describes the switch. Do not rely on the theoretical default: measure.
An assigned policy can take precedence over Global
According to a Microsoft Q&A thread, a policy assigned directly to a user or via a group can take precedence over the Global policy. To limit the change, create a custom policy rather than modifying Global.
Guest reporting and phishing detection: three settings to enable
Reporting of guest invitations addresses a specific scenario: an attacker creates a real Microsoft tenant, then sends a guest invitation to start a conversation as part of a social engineering chain. Rollout is announced for early November, with completion expected in mid-November. Submissions will arrive in the Teams admin center.
The Microsoft Learn documentation on reporting in Teams lists three prerequisites, easy to forget on an existing tenant:
Allow reporting in the messaging policy
In the Teams admin center, enable "Report a security concern" in the relevant messaging policy.
Enable feedback on incorrect detections
In Messaging settings > Messaging safety, enable "Report incorrect security detections".
Feed reports into Defender
In the Defender portal, enable "Monitor reported items in Microsoft Teams" to populate the "User reported" tab of the Submissions page. This setting is enabled by default for new tenants, but existing tenants must enable it themselves.
On the reading side, the "User reported security submissions" report is found in Analytics & reports > Protection reports, according to the dedicated Microsoft page. The categories are Calling, Chats and channels, and User. The report provides the MRI identifier of the reported user, which you can enter on the External Access page to block them.
On top of this comes AI-based, context-aware phishing detection, rolling out in early December with completion expected in mid-December. It complements the native warning shown when an external user contacts you: if the other party impersonates an administrator and asks for credentials, the user sees a warning with an information link.
Voicemail: a custom sending domain announced, documented pitfalls
Teams Phone is to offer more granularity on how voicemail messages are sent by email: caller information moved from the "From" field to the subject, and the ability to use your own domain. The benefit is real for deliverability and security, since your domain carries SPF, DMARC and DKIM, and these emails often serve as bait for phishing campaigns. The announced schedule runs from early March to late June.
Announced, not yet documented
The Cloud Voicemail documentation still describes sending from noreply@skype.voicemail.microsoft.com. We found no Microsoft page that documents the custom domain or the move of the caller to the subject. Treat this change as announced and check its schedule in the message center.
In the meantime, two pitfalls already affect the current configuration:
- The current sender must not be blocked by your rules, otherwise users no longer receive their voicemail messages.
- The Microsoft troubleshooting page states that SPF failures do not block delivery to Exchange, but that mail flow rules that analyse these failures can prevent delivery. Third-party mail systems are not supported, because the FROM field is formatted in a non-RFC-compliant way for PSTN calls.
Before migrating to a custom sending domain, take stock of your mail flow rules: the script below handles that.
Teams calendar from late October 2026 to January 2027
The dates below are those announced; confirm them in your tenant's message center, as they have already moved for other features. For the context of previous months, see our roundup of Microsoft Teams news from March 2026.
Late October 2026
File sharing in federated chat
Rollout announced by MC1479514, limited to tenants that had not blocked sharing.
Early November 2026
Guest reporting, blocked extensions, Teams Phone agent
Rollout of these three features begins, with completion expected in mid-November 2026.
Late November 2026
Simultaneous screen sharing
Two presenters share their screen at the same time; completion expected in mid-December 2026.
Early December 2026
AI phishing detection in messaging
Contextual warning in chat; completion expected in mid-December 2026.
Early January 2027
Side conversation in meeting chat
Completion expected in late January 2027.
Four features deserve a decision rather than just monitoring:
- Blocked extensions: protection against dangerous files is enabled by default, with a fixed list. Administrators will be able to add or remove extensions; document every removal.
- Side conversation in meetings: useful with external participants or guests, with whom a private exchange is not simple and whom you do not want to mix into the main chat.
- Simultaneous screen sharing: relevant for troubleshooting or side-by-side comparison. Test it with visually impaired users, as display size can be an issue.
- Teams Phone agent: reserved for Copilot licences, it answers frequently asked questions, handles bookings via Microsoft Bookings, and intelligent transfer to the right department becomes generally available. Our recommendation: a pilot on a non-critical line, measuring the callers' experience before any broad rollout.
Beyond Teams: announcements to weigh up for Entra, Outlook and Defender
The same announcement cycle contains items that affect your tenant's security. For previous months, see our Microsoft 365 news from August 2026.
| Announcement | Status or schedule | Recommended action |
|---|---|---|
| Agent creation in Microsoft Entra | Default for users from 4 November | Disable the button in user settings to avoid proliferation |
| Inactive agent lifecycle policy | Public preview, open to all | Enable if you use agents, to limit dormant identities |
| End of SMS for MFA | Planned for February | Migrate to passkeys; the telephony provider option remains a last resort |
| Targeted release channel for Microsoft 365 apps | Retirement, transition from January | Switch to Frontier, Standard or Deferred |
| Discovery of local AI agents in Defender for Endpoint | Generally available | Plan 2 required: included with E5 or with the Defender Suite add-on for Business Premium |
| Send from an alias in Outlook | Generally available, not enabled by default | Enable in the Exchange admin center or via PowerShell |
The inbox rule that automatically replies with a template (early December, completion late December) also deserves a review: inbox rules are a classic abuse vector.
Implementation
These scripts are read-only: they record the value of FileSharingInChatsWithExternalUsers and spot mail flow rules likely to interfere with voicemail. They produce a table on screen and a CSV file. Apply least privilege: use the most restricted role that allows reading Teams policies, and a read-only Exchange role on the configuration.
Required modules:
1Install-Module -Name MicrosoftTeams -Scope CurrentUser2Install-Module -Name ExchangeOnlineManagement -Scope CurrentUserAudit of Teams Files policies:
1# Connexion à Teams avec le compte d'administration2Import-Module -Name MicrosoftTeams3Connect-MicrosoftTeams4 5# Lecture de toutes les stratégies Teams Files6$policies = Get-CsTeamsFilesPolicy7 8# Extraction du paramÚtre qui pilote le partage avec les externes9$report = foreach ($policy in $policies) {10 [pscustomobject]@{11 Identity = $policy.Identity12 FileSharingInChatsWithExternalUsers = $policy.FileSharingInChatsWithExternalUsers13 }14}15 16# Affichage et export pour documenter l'état avant la bascule17$report | Format-Table -AutoSize18$report | Export-Csv -Path .\teams-files-policies.csv -NoTypeInformation -Encoding UTF819 20Disconnect-MicrosoftTeamsTo create and assign a custom policy without guessing cmdlet names, list those that your module version exposes:
1Get-Command -Module MicrosoftTeams -Name *TeamsFilesPolicy* | Select-Object -Property CommandType, Name, VersionSearch for mail flow rules that touch voicemail or SPF:
1# Connexion à Exchange Online2Connect-ExchangeOnline -ShowBanner:$false3 4# Motif : expéditeur des messages vocaux, mot voicemail ou analyse SPF5$motif = 'skype\.voicemail|voicemail|SPF'6 7# La propriété Description résume les conditions et actions de chaque rÚgle8Get-TransportRule |9 Where-Object { $_.Description -match $motif } |10 Sort-Object -Property Priority |11 Select-Object -Property Name, State, Priority, Mode |12 Format-Table -AutoSize13 14Disconnect-ExchangeOnline -Confirm:$falseAn empty result means that no rule matches the pattern. For each rule listed, open it in the Exchange admin center and check that it does not discard noreply@skype.voicemail.microsoft.com.
Do not modify the Global policy on the fly
Modifying Global affects all users without a direct assignment, and therefore potentially the whole tenant. Prefer a custom policy assigned to a pilot group, then test in real conditions: open a federated chat, attach a file and check that the external recipient can access it. No page consulted sets a propagation delay: plan a deferred verification test rather than concluding failure immediately.
Troubleshooting: five symptoms and their resolution
| Symptom | Likely cause | Resolution |
|---|---|---|
| The external recipient cannot open the file | OneDrive or SharePoint restrictions (labels, domains) or permissions not granted | Review the OneDrive and SharePoint sharing settings; external access is not guaranteed by default |
| Sharing remains blocked for a user despite an up-to-date Global policy | Policy assigned directly or via a group takes precedence | Identify the assignment and fix the policy concerned |
| Reports do not appear in the User reported tab | Monitor reported items in Microsoft Teams not enabled on an existing tenant | Enable the setting in the Defender portal and check both settings on the Teams side |
| Users no longer receive their voicemail messages | Mail flow rule blocking the voicemail sender or analysing SPF failures | Audit the rules with the script and exclude the sender |
| Voicemail messages not delivered to a third-party system | Unsupported system: FROM field not RFC-compliant for PSTN calls | Deliver the messages to Exchange |
Where to start: six checks before mid-November
Checks to carry out
- Record
FileSharingInChatsWithExternalUserson all Teams Files policies and note direct or group assignments - Decide whether federated chat sharing should stay open, and create a custom policy if not
- Check sensitivity labels, domain restrictions and protection against malicious links on the OneDrive and SharePoint side
- Enable the three reporting settings (Teams and Defender) and locate the User reported security submissions report
- Audit mail flow rules before any move to a custom voicemail sending domain
- Decide before 4 November whether users can create agents in Microsoft Entra
If your organisation applies Zero Trust and has no allow list of federated domains, define your federation policy first, and only then file sharing: opening files without a filter to external tenants would otherwise be the weak link. If you had already blocked sharing, MC1479514 should not affect you: a check of the value is enough.
Further reading
- Share files and Loop components in external (federated) chats: OneDrive and SharePoint prerequisites, and automatic permission sharing.
- Teams Enables Easier File Sharing in Federated Chat: critical analysis of MC1479514 and Microsoft's retreat on scope.
- User reported settings in Teams: enablement steps on the Teams and Defender side.
- User reported security submissions report in Microsoft Teams: reading the report and blocking the reported sender.
- Set up Cloud Voicemail: current sending address and delivery in Exchange.
