What this check looks at
Checks whether Teams external access is limited to a list of allowed domains, rather than open to every organisation.
Teams external access (federation) is what lets your people chat, call and meet with people in other Microsoft 365 organisations without inviting them as guests. Microsoft’s default is open: every external domain is allowed, people outside can search for your staff by email address and see their presence, and they can start a chat.
The check reads the tenant federation configuration. It passes when external access is off (AllowFederatedUsers is false) or limited to an allow list of domains, even an empty one. It fails when external access is on and the allowed domains are AllowAllKnownDomains, that is open to every organisation, whether or not some domains are blocked.
With external access open, an attacker needs only a Microsoft 365 tenant, which anyone can create in minutes with any name, to message anyone whose address they know. Microsoft’s threat intelligence team has published several campaigns that did exactly this, including Midnight Blizzard in 2023 and Storm-1811 in 2024, posing as "IT Support" or "Help Desk" from look-alike tenants to get people to approve MFA prompts or open remote-access tools.
Why it matters
With external access open to every domain, anyone with a Microsoft 365 tenant can message your staff in Teams, looking like a colleague or IT support. Attackers use exactly this to deliver malware and take over accounts; an allow list limits chat and calls to organisations you work with.
A typical case: a member of the finance team in a 60-person firm finds their mailbox flooded with spam, and minutes later gets a Teams chat from "IT Helpdesk" in a tenant named something like helpdesk-support.onmicrosoft.com, offering to fix it. They are talked into opening Quick Assist, the "helpdesk" installs a remote-access tool, and the attacker has a foothold on the network. In the published cases this has led to ransomware across the whole business within days.
The UK government’s Cyber Security Breaches Survey finds year after year that phishing is the most common way attacks on businesses begin. Teams chat from outside feels more trusted than email, and most staff have never been told that anyone in the world can message them there.
CIS Microsoft 365 Foundations Benchmark 8.2.1 and CISA SCuBA MS.TEAMS.2.1v2 ask that external access is allowed only on a per-domain basis. An allow list keeps chat and calls with the organisations you work with, and guests already in your tenant are unaffected.
How to fix it
Where: Teams admin centre → Users → External access
Before you start
- List the organisations people chat with in Teams: the Teams user activity report, or ask each department.
- Add their domains to the allow list before switching, so working conversations carry on.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Build the list of partner domains. Start with the domains of guests already in the directory: in Graph PowerShell, Connect-MgGraph -Scopes User.Read.All, then Get-MgUser -Filter "userType eq 'Guest'" -All -Property Mail | ForEach-Object { ($_.Mail -split '@')[-1] } | Group-Object | Sort-Object Count -Descending. Add your MSP’s domain, your main customers and suppliers, and anything department heads name. External chat does not create guest accounts, so asking each department is the only complete source.
- Tell people what is changing. Let staff know the date, that chat and calls will work only with the listed organisations, and how to ask for a domain to be added. Guests in your own teams are not affected.
- Switch to an allow list in the Teams admin centre. In the Teams admin centre, go to Users > External access (the Organisation settings tab, where the page has tabs). Under "Teams and Skype for Business users in external organisations", choose "Allow only specific external domains", select Allow domains, add each domain from your list, select Done, then Save.
- Or set the allow list in Teams PowerShell. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Create one pattern per domain and apply them together: $a = New-CsEdgeDomainPattern -Domain "partner.co.uk"; $b = New-CsEdgeDomainPattern -Domain "supplier.com"; Set-CsTenantFederationConfiguration -AllowedDomains (New-CsEdgeAllowList -AllowedDomain $a,$b).
- Handle requests for new domains. When someone needs a new organisation, add its domain in the same place (Users > External access > Allow domains). Review the list once a year and remove partners the business no longer works with.
- Confirm the change. Run Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowedDomains: AllowedDomains should list your domains rather than AllowAllKnownDomains. Ask a user to message someone at an allowed domain (it works) and at another organisation (the person shows as not reachable).
With PowerShell
Connect-MicrosoftTeams $list = New-CsEdgeAllowList -AllowedDomain "partner.example" Set-CsTenantFederationConfiguration -AllowedDomains $list
What users will notice
People can chat, call and meet with people at the allowed domains only. Others see your users as unavailable; guests in your tenant are unaffected.
How to confirm it worked
In Teams PowerShell, Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowedDomains shows the new value.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM)B4.b Secure configuration |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | IdentitiesApplications |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architecturesCC6.6 Protection against threats from outside the system boundaries |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CISA SCuBA | MS.TEAMS.2.1v2 External access only on a per-domain basis |
| CIS M365 | 8.2.1 Ensure external domains are restricted in the Teams admin center |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage external access in Microsoft Teams (Microsoft Learn)