Cloud Security
Microsoft Teams to Introduce Configurable File Extension Blocking for Admins
Microsoft is updating the Weaponizable File Protection feature in Microsoft Teams to allow administrators to customize blocked file extensions. Slated to roll out globally in November 2026, the update enables SecOps teams to enforce bespoke file-sharing restrictions beyond default Microsoft safety lists.
What Happened
Microsoft has announced an upcoming update to Microsoft Teams that introduces granular administrative controls for Weaponizable File Protection. Currently, administrators are restricted to a rigid, Microsoft-defined list of blocked file extensions within chat and channel messages. The new capability allows organizations to modify this blocklist to match their internal risk profiles and compliance mandates.
Impact and Availability
The feature is currently in development and scheduled to begin global rollouts in November 2026. Once generally available, the configurable policy controls will apply across all major client environments, including desktop (Windows and macOS), mobile (Android and iOS), and the web client for standard multi-tenant cloud deployments.
- Applies to standard multi-tenant Microsoft 365 environments
- Supports desktop, mobile, and web deployment vectors
- Allows retention of Microsoft-recommended default baselines if desired
What Defendres Should Do
Sysadmins and SecOps personnel should prepare for the rollout by auditing current file-sharing telemetry and identifying high-risk file types utilized by threat actors within their specific industry verticals. Once the feature reaches general availability in November 2026, review current Teams collaboration policies and implement custom blocks for proprietary or emerging high-risk extensions that fall outside the standard baseline.
"Administrators will be able to customize which file types are blocked in Teams to align with their organization's security requirements or continue using the Microsoft-recommended default list." — Microsoft 365 Roadmap
Related articles
Mitigating Stale Sharing Risks in Microsoft 365 Through Access Governance
Microsoft 365 environments frequently accumulate stale file-sharing permissions and orphaned links, leaving sensitive enterprise data exposed. SecOps and sysadmins must implement centralized access governance and owner-driven reviews to audit permissions and revoke unnecessary access.
Read briefing
Proofpoint Expands AI Investigations to Microsoft 365 and Insider Risk Platforms
Proofpoint has rolled out updates to its security portfolio, adding AI-powered investigative capabilities for Microsoft 365 environments alongside enhanced tracking for enterprise AI usage. The updates aim to streamline incident triage and improve visibility into potential data exfiltration vectors involving generative AI tools.
Read briefing
Falcon Data Security for SaaS Enhances Microsoft 365 Data Protection
Falcon Data Security for SaaS now protects SharePoint, OneDrive, and Copilot, enabling automated discovery and classification of sensitive data across Microsoft 365. The update applies to all tenants with the service enabled and offers tighter compliance controls. Defenders should enable coverage, set classification policies, and integrate alerts into existing workflows.
Read briefing
AWS Deploys Managed Policy to Quarantine Exposed IAM Credentials
AWS introduced the AWSCompromisedKeyQuarantine policy to automatically revoke IAM access keys found in public code or via GitHub secret scanning. The policy disables the keys, logs the action in CloudTrail, and notifies owners, allowing defenders to react swiftly. Security teams should enable the policy, monitor CloudTrail for quarantine events, and enforce least‑privilege IAM roles.
Read briefing