Microsoft’s documentation states clearly that the Deep analysis feature in Defender for Endpoint supports only PE files (Portable Executable files) — specifically .exe and .dll binaries. In the “Take response actions on a file” article, Microsoft says:

“Only PE files are supported, including .exe and .dll files.” Microsoft Learn

That means only File2.exe and File3.dll among your three examples are eligible for deep analysis.

Further, a file’s “Deep analysis” is only enabled when the file exists in the Defender backend sample collection or is observed on a supported Windows device. The tool won’t support script files like .ps1 (PowerShell scripts) via that deep analysis mechanism.

To break it down:

File1.ps1 (PowerShell script) is not a PE file, so it cannot be submitted to the deep analysis sandbox that expects an executable or library format.

File2.exe is a standard executable (PE format) and is valid for deep analysis.

File3.dll is a dynamic-link library (also PE format) and is likewise valid for deep analysis.

Thus, the only files you can submit for deep analysis in Microsoft Defender XDR are those in the proper PE format — File2.exe and File3.dll.