“Turn off file sharing in Teams” sounds like one setting. It isn’t, and that’s the first thing to understand before you change anything. Teams is a front end — when someone shares a file, the file goes into SharePoint or OneDrive, and the rules about who can reach it live there, not in Teams.
So restricting file sharing means working in two places. The Teams messaging policy decides whether people can upload files into chats at all. The SharePoint and OneDrive sharing settings decide where those files are stored and, crucially, whether anyone outside your organization can open them. Change one and not the other and you’ll get a result that doesn’t match what you intended.
This guide separates the two clearly: what the messaging policy controls, what SharePoint and OneDrive control, how to combine them for common goals, and the gotchas — like breaking existing links — that catch people who flip a single setting and assume they’re done.
Where Teams files actually live
You can’t control sharing sensibly until you know where the files sit. There are two storage paths:
- Channel files go into the SharePoint document library belonging to that team. Every team has a connected SharePoint site, and the Files tab in a channel is a window into a folder in that library.
- Chat files go into the sender’s OneDrive, in a folder for Microsoft Teams chat files, and are shared with the chat participants.
This split explains a lot. It’s why external sharing of Teams files is governed by SharePoint and OneDrive settings, and why a permissions problem on a file often traces back to the underlying site, not to Teams. If you understand this layout, the rest of the controls make sense. For a fuller comparison of how these stores relate, see OneDrive vs SharePoint vs Teams files.
Control 1: the messaging policy (chat file uploads)
The Teams messaging policy is where you control the chat experience, including whether users can upload and share files in chats and channel conversations. If your goal is to stop people dropping files into chats, this is the lever.
In the Teams admin center, go to Messaging policies, edit the policy assigned to your users (or create a new one), and turn off the file-sharing setting. Then assign that policy to the right users or groups.
You can do the same in PowerShell, which is faster when you’re managing this at scale:
Connect-MicrosoftTeams
# Edit the global (org-wide default) policy, or target a named policy with -Identity
Set-CsTeamsMessagingPolicy -Identity Global -AllowUserDeleteMessage $true `
-AllowGiphy $false
# The setting that governs uploading/sharing files in chat:
Set-CsTeamsMessagingPolicy -Identity Global -AllowFileSharingToExternalUsers $falseNew-CsTeamsMessagingPolicy -Identity "No-File-Upload"
# Assign to a specific user
Grant-CsTeamsMessagingPolicy -Identity "[email protected]" -PolicyName "No-File-Upload"The important limitation: disabling chat uploads stops users dragging files into conversations. It does not, on its own, stop people sharing links to files that already exist in SharePoint or OneDrive, and it doesn’t govern external access. That’s the next control’s job.
Control 2: SharePoint and OneDrive sharing (external access)
This is the control that actually stops files leaving your organization. Because Teams files live in SharePoint and OneDrive, the external sharing settings in the SharePoint admin center are what decide whether an outside person can open a Teams file.
In the SharePoint admin center, go to Policies > Sharing. The organization-level external sharing slider has levels, from most open to most restrictive:
SharePoint/OneDrive external sharing levels (most open to most restrictive)
| Anyone | Allows anonymous links anyone can open without signing in — the most permissive |
|---|---|
| New and existing guests | External people can access after authenticating as guests |
| Existing guests | Only guests already in your directory can access |
| Only people in your organization | External sharing is off — no outside access to files |
Set both SharePoint and OneDrive to Only people in your organization to switch off external sharing of Teams files entirely. SharePoint and OneDrive have separate sliders, so set both — turning off SharePoint but leaving OneDrive open still lets chat files (which live in OneDrive) be shared out.
The organization-level setting is the maximum; individual sites can be set more restrictive than the org but never more permissive. So you can leave the org at “New and existing guests” for teams that need it and lock specific sensitive sites down to internal-only.
Combining the two for common goals
Most real requests map to a combination of the two controls. Here’s how the common ones break down.
What to set for each goal
| Stop all external file access | SharePoint + OneDrive external sharing = Only people in your organization |
|---|---|
| Stop file uploads in chats | Messaging policy: turn off file sharing/upload, assign to users |
| Allow internal sharing, block outside guests | External sharing = Existing guests or Only people in your org; leave chat uploads on |
| Lock down one sensitive team only | Set that team's SharePoint site to a more restrictive level than the org default |
A point that surprises people: “disable file sharing in Teams” almost never means only the messaging policy. If the real concern is data leaving the organization, the SharePoint and OneDrive settings do the heavy lifting, and the messaging policy is secondary. If the concern is purely the chat experience — no files cluttering conversations — then the messaging policy is enough and you can leave external sharing as is.
Before you restrict file sharing
- You've decided whether the goal is blocking external access, blocking chat uploads, or both
- You're a Teams Administrator and a SharePoint Administrator (you'll likely need both)
- You've checked for existing external shares that a tightening would break
- You have a test user/group to validate the change before a wide rollout
- You've allowed time for policy changes to propagate before judging the result
A note on the default file service
There’s a third, narrower control worth knowing about: the Teams files policy (Set-CsTeamsFilesPolicy) governs which file service is used by default when users upload files by dragging and dropping them into a chat or channel. By default that’s OneDrive and SharePoint, but it can be pointed at a third-party storage app where one is configured.
This isn’t a restriction control in the usual sense — it’s about which store handles uploads, not whether sharing is allowed. Mention it here only so you don’t confuse it with the messaging policy. If files are unexpectedly landing in (or routing through) a different service, this policy is where to look.
Get-CsTeamsFilesPolicy -Identity Global | Format-ListTest, then roll out
Two things make file-sharing changes go wrong: assuming a single setting covers everything, and rolling out before testing.
- Test with one account or a pilot group. Create a messaging policy and assign it to a test user; set a single site more restrictively before changing the org default. Confirm the behavior matches the intent.
- Allow for propagation. Teams policy changes can take time to reach users — sometimes up to a day. A setting that “didn’t work” five minutes after you saved it may simply not have applied yet.
- Verify external access from the outside. The most reliable check for external sharing is to actually try to open a shared file as an outside user (or a guest test account) and confirm you get the access result you expect.
This sits inside broader Teams governance — who can create teams, naming, and lifecycle all shape how files sprawl in the first place. If you’re tackling file sharing as part of a wider tidy-up, Microsoft Teams governance best practices puts it in context.
Wrapping up
There’s no single “disable file sharing” switch in Teams because file sharing spans two systems. The messaging policy controls whether users can upload files into chats. The SharePoint and OneDrive sharing settings control where files live and who outside the organization can open them. Decide which problem you’re actually solving, then set the matching control — or both, which is what most real restrictions require.
The setting that does the most to keep data inside the organization is SharePoint and OneDrive external sharing, set to “Only people in your organization.” Just go in with eyes open: tightening it can break links people are already relying on, so check first, communicate, and test with a pilot before the wide rollout. For more on how these stores fit together, see OneDrive vs SharePoint vs Teams files, and browse the Microsoft Teams guides.
