Teams external access: when open federation becomes a phishing channel
By default, a Teams user can chat with any external organisation. That convenience has a downside: attackers use this channel to contact your staff directly while posing as IT support. A few settings are enough to reduce this exposure significantly.
External access and guest access are different
The two are often confused, yet they differ in scope and settings.
| External access (federation) | Guest access | |
|---|---|---|
| Principle | Chat and calls with users in other tenants | Guest (B2B) account added to your directory |
| Access to teams and files | No | Yes, depending on permissions |
| Where to configure | Teams admin center, "External access" | Entra ID and Teams guest settings |
External access grants no access to data, but it opens a direct conversation without filtering comparable to email.
The risk of open federation
In its default configuration, external access allows every domain. An attacker only needs to create a Microsoft 365 tenant, give it a plausible name ("IT Support", "Security Helpdesk") and send a Teams message to your users. Publicly documented campaigns have used this scenario to harvest credentials, get MFA prompts approved or convince victims to install a remote-control tool. The message arrives in a tool perceived as internal, which lowers users' guard.
Moving to an allow-list of domains
The most effective measure is to allow only the domains you actually collaborate with. To build the list:
- Identify the partners, customers and suppliers who use Teams with you.
- Review activity logs to find existing external conversations.
- Switch to allow-list mode, and set up a simple process to add a domain on request.
If a closed list is not realistic, at least block domains known to be malicious and train users to notice the banner that flags an external contact.
Blocking unmanaged Teams accounts
A separate setting controls communication with unmanaged Teams accounts, meaning personal Microsoft accounts that do not belong to any organisation. Unless there is an explicit business need, turn it off. If it must stay on, at least prevent these accounts from starting conversations with your users.
Meetings and anonymous join
Anonymous meeting join is another vector to control. Depending on your needs, you can disable it globally or through targeted meeting policies, and configure the lobby so that only people in your organisation bypass it. Public meetings (webinars, events) can use a dedicated policy assigned only to the organisers who need it.
Caution. Restricting external access does not replace user awareness: an allowed partner domain can itself be compromised. IT support should never ask for an MFA code or a tool installation through a Teams message.
What an audit checks
- The federation mode: open, allow-list or block-list.
- Communication with unmanaged Teams accounts.
- Anonymous join and lobby settings.
- Consistency between external access and guest access settings.