What this check looks at
Checks whether accounts no organisation manages can find your people in Teams and start a conversation with them.
Under the setting for unmanaged Teams accounts there is a second switch, AllowTeamsConsumerInbound: whether those personal accounts can find your people by email address and start a conversation with them, rather than only reply when your people start one. When communication with unmanaged accounts is on, Microsoft’s default also lets them start conversations.
The check passes when communication with unmanaged accounts is off altogether (AllowTeamsConsumer is false), because they then cannot start anything. Otherwise it fails when AllowTeamsConsumerInbound is true, and reports not checked when either value was not returned.
Inbound contact is the part attackers use. Anyone with a free Teams account and your staff’s addresses, which are easy to guess from one known address, can send every one of them a message request. The recipient sees an accept or block prompt with the sender’s chosen display name, and a convincing name is often enough for them to accept and click.
Why it matters
Unsolicited Teams messages from personal accounts are a common start to phishing and help-desk impersonation. If chat with personal accounts is needed at all, your people should be the ones who start it.
A typical case: a managing director’s assistant gets a message request from "DocuSign Notifications" saying a contract is waiting, with a link to sign in and review it. They accept, enter their password on the fake page, and the attacker reads the director’s calendar and mail through the assistant’s delegate access, then sends a convincing payment request to the finance team.
A single diverted payment in a small business is often tens of thousands of pounds and is rarely recovered, and the follow-on costs (incident response, telling clients whose data was in the mailbox, possibly reporting to the ICO) come on top.
CIS Microsoft 365 Foundations Benchmark 8.2.3 and CISA SCuBA MS.TEAMS.2.2v2 ask that unmanaged users cannot start contact. If chat with personal accounts is needed at all, this keeps it while letting only your people start it; if it is not needed, turning communication with unmanaged accounts off altogether (NL-TMS-104) is simpler and passes this check too.
How to fix it
Where: Teams admin centre → Users → External access
Before you start
- Decide whether chat with personal accounts is needed at all; if not, turning it off entirely (the related check) is simpler.
Step by step
- Decide whether chat with personal accounts is needed. If nobody needs to chat with personal Teams accounts, turn the whole feature off instead (the related check, NL-TMS-104): it removes inbound contact as well and passes both checks. Carry on here only if your people do need to start chats with personal accounts.
- Stop unmanaged accounts starting conversations. In the Teams admin centre, go to Users > External access (the Organisation settings tab, where the page has tabs). Under "Teams accounts not managed by an organisation", leave "People in my organisation can communicate with unmanaged Teams accounts" on and clear "External users with Teams accounts not managed by an organisation can contact users in my organisation". Select Save.
- Or make the change in Teams PowerShell. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Set-CsTenantFederationConfiguration -AllowTeamsConsumerInbound $false.
- Tell people what has changed. Let staff know that personal Teams accounts can no longer start conversations with them, and that any unexpected message request claiming to be from IT, payroll or a supplier should be reported rather than accepted.
- Confirm the change. Run Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer, AllowTeamsConsumerInbound: AllowTeamsConsumerInbound should be False (or AllowTeamsConsumer False). A message request from a personal Teams account to a work address should no longer arrive.
With PowerShell
Connect-MicrosoftTeams Set-CsTenantFederationConfiguration -AllowTeamsConsumerInbound $false
What users will notice
People with personal Teams accounts can no longer start a conversation with your users; your users can still start one with them if that remains allowed.
How to confirm it worked
In Teams PowerShell, Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer, AllowTeamsConsumerInbound shows the new value.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.6 Protection against threats from outside the system boundaries |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CISA SCuBA | MS.TEAMS.2.2v2 Unmanaged users cannot initiate contact |
| CIS M365 | 8.2.3 Ensure external Teams users cannot initiate conversations |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage external access in Microsoft Teams (Microsoft Learn)