weaponizable file detection in Teams

Question

We have weaponizable file detection in Teams enabled.
Files are only block files based on extension and not on mime type.
Simple test shows that when a exe file is send, the file is blocked. But when we rename the file to *.txt the file is not blocked.

What can we do to block or remove files based on mime type?

Answer 1

Hi Daniel,

Thanks for your answer.
We have setup Defender for Sharepoint/OneDrive in Defender for Office 365.
We wil create a ticket.

Thanks for your time.

Answer 2

Hello @LF,  

Thank you for reaching out to the Q&A forum! 

After researching the available documentation, I can see that Weaponizable File Protection in Microsoft Teams currently blocks files only based on their file extension, not based on the MIME type or the actual content of the file. 

Additionally, the list of blocked file types is fixed and cannot be customized, and Microsoft Teams does not perform MIME-type or content inspection at the message‑delivery layer. 

For reference: Weaponizable file protection in Microsoft Teams - Microsoft Teams | Microsoft Learn 

---

So, if your goal is to catch files that are disguised by simply renaming their extension, you should consider using Microsoft Defender for Office 365 malware scanning in SharePoint, OneDrive, and Teams. 

This scanning engine analyzes the actual content of a file rather than relying on the extension, and it can detect and flag infected files even when the extension has been changed. 

You can find more details in this Microsoft article: Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams - Micro… 

I hope you understand that as a forum moderator, I can only provide information based on my research and practical experience, rather than direct access to or testing within your specific tenant. I also hope the information shared above has helped clarify how this setting works and has given you better visibility into its expected behavior.

If you receive any updates or insights, please feel free to reply here.               

Looking forward to hearing from you! 

---

 If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.