What this check looks at
Checks whether people can chat in Teams with accounts no organisation manages (personal Microsoft accounts).
Teams can talk to two kinds of outside account: people in other organisations (external access, the related check) and Teams accounts that no organisation manages, the free personal accounts tied to a Microsoft account such as an outlook.com or gmail.com address. Communication with these unmanaged accounts is a separate switch, AllowTeamsConsumer in the tenant federation configuration, and Microsoft turns it on by default.
The check fails when AllowTeamsConsumer is true, and reports not checked when the value was not returned.
A personal Teams account takes minutes to create and can carry any display name, such as "Microsoft Security" or your managing director’s name; no organisation stands behind it. With the switch on, those accounts can be in chats with your people, and your people can start chats with personal accounts, which also makes it easy to send files to a personal address outside any DLP policy.
Why it matters
Personal Teams accounts are free and anonymous to create. Allowing chat with them gives attackers a channel into the organisation that no company vouches for, and gives staff an easy way to move data to a personal account.
A typical case: a new starter receives a Teams message from "Sarah – Payroll" asking them to confirm their bank details for their first salary through a linked form. The account is a free personal one, the form harvests their password, and the next payroll change request comes from their own mailbox. Nothing in the chat shows Sarah is not a colleague except a small External label most people never notice.
The other direction matters as well: a leaver can chat to their own personal Teams account and send themselves client lists in their last weeks. There is no partner organisation to contact and no way to ask for the data back.
CIS Microsoft 365 Foundations Benchmark 8.2.2 and CISA SCuBA MS.TEAMS.2.3v2 ask for communication with unmanaged Teams users to be turned off. Freelancers and sole traders who need to work with you can be invited as guests, which are in your directory and under your Conditional Access policies.
How to fix it
Where: Teams admin centre → Users → External access
Before you start
- Check whether anyone needs to chat with people using personal Teams accounts (some sole traders and freelancers); invite them as guests instead.
Step by step
- Check whether anyone needs it. Ask department heads whether anyone chats with people on personal Teams accounts (some sole traders, freelancers or customers). Invite those people as guests to the relevant team instead, so they keep working with you through a managed route.
- Turn off communication with unmanaged accounts. In the Teams admin centre, go to Users > External access (the Organisation settings tab, where the page has tabs). Under "Teams accounts not managed by an organisation", turn off "People in my organisation can communicate with unmanaged Teams accounts" and select Save.
- Or make the change in Teams PowerShell. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false.
- Tell people what has changed. Let staff know that chats with personal Teams accounts will stop, that those accounts can no longer find them, and how to ask for an outside contact to be invited as a guest.
- Confirm the change. Run Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer, AllowTeamsConsumerInbound: AllowTeamsConsumer should be False. A test chat from a work account to a personal Teams account should no longer go through.
With PowerShell
Connect-MicrosoftTeams Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false
What users will notice
Chats with personal (Teams free or consumer) accounts stop working, and those accounts can no longer find your people.
How to confirm it worked
In Teams PowerShell, Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer shows the new value.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.6 Protection against threats from outside the system boundaries |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CISA SCuBA | MS.TEAMS.2.3v2 Internal users cannot initiate contact with unmanaged users |
| CIS M365 | 8.2.2 Ensure communication with unmanaged Teams users is disabled |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage external access in Microsoft Teams (Microsoft Learn)