What this check looks at
Checks whether Teams blocks chat, calls and meetings with organisations whose Teams subscriptions are trials only.
A Microsoft 365 or Teams trial tenant costs nothing, can be created in minutes under any organisation name and lapses after about a month. ExternalAccessWithTrialTenants, in the tenant federation configuration, decides whether people in tenants that have only trial Teams subscriptions can chat, call and meet with your users through external access. It can be set only in Teams PowerShell.
The check fails when ExternalAccessWithTrialTenants is anything other than Blocked (for example Allowed), and reports not checked when the value was not returned.
Attackers favour trial tenants because they are disposable: when one is reported and closed, they create another. Blocking trial-only tenants means a Teams phishing message from a throwaway tenant never reaches your people, whatever display name or tenant name it uses. Real partners almost always have paid subscriptions, so legitimate work is rarely affected.
Why it matters
A trial tenant costs nothing and is gone in a month, which is why attackers use them to send Teams phishing. Blocking trial-only tenants removes that route without affecting real partners.
A typical case: staff at a 40-person firm receive Teams chats from "IT-Support-Desk" asking them to "re-verify" their accounts. IT reports the tenant to Microsoft and it is shut down, but the next morning the same message arrives from a new trial tenant with a slightly different name. Each wave catches someone, and each compromised account is used to phish the firm’s customers.
Every account compromise costs the business time to investigate and reset, and if the attacker reaches a mailbox with client data, a possible notification to the ICO and to the clients. Removing a whole class of throwaway senders is far cheaper than dealing with the results.
CIS Microsoft 365 Foundations Benchmark 8.2.4 asks that the organisation cannot communicate with accounts in trial Teams tenants. Blocking also removes people in trial-only tenants from existing chats with your users.
How to fix it
Before you start
- Nothing to prepare in most organisations; a partner on a trial is rare and can be asked to use a paid subscription or a guest account.
Step by step
- Connect with an up-to-date Teams module. Older versions of the module do not have this setting, so run Update-Module MicrosoftTeams (or Install-Module MicrosoftTeams if it is not installed), then Connect-MicrosoftTeams and sign in as a Teams Administrator.
- Check the current value. Run Get-CsTenantFederationConfiguration | Select-Object ExternalAccessWithTrialTenants, AllowFederatedUsers and note the value, so you can put it back if a partner turns out to rely on a trial.
- Check for partners on trials. In most organisations no partner is on a trial-only tenant. If one is, ask them to use a paid subscription, or invite their people as guests to the team they work in.
- Block trial-only tenants. Run Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked.
- Confirm the change. Run Get-CsTenantFederationConfiguration | Select-Object ExternalAccessWithTrialTenants again: it should show Blocked.
With PowerShell
Connect-MicrosoftTeams Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked
What users will notice
People in organisations with only trial Teams subscriptions can no longer chat, call or meet with your users, and are removed from existing chats.
How to confirm it worked
In Teams PowerShell, Get-CsTenantFederationConfiguration | Select-Object ExternalAccessWithTrialTenants shows the new value.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.6 Protection against threats from outside the system boundaries |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CIS M365 | 8.2.4 Ensure the organisation cannot communicate with accounts in trial Teams tenants |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set-CsTenantFederationConfiguration (Microsoft Learn)