Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
teams_external_domains_restrictedProvider: Microsoft 365
Service:
teamsSeverity: HIGH
Categories:
trust-boundaries, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Teams tenant external access configuration is assessed. The expected posture is federation with external domains disabled, so users cannot chat, call, or meet with accounts in other domains.Risk
Unrestricted external federation enables delivery of phishing links and malware via chats/calls, user enumeration, and data leakage through messages or file shares. This directly threatens confidentiality and integrity, and can aid social engineering-driven lateral movement.Recommendation
Adopt a default-deny stance: disable external access. If collaboration is required, allowlist only trusted domains and apply least privilege with cross-tenant policies. Prefer B2B guest/shared channels, require MFA and compliant devices, and review logs and domain lists regularly.Remediation
- CLI
- Dashboard steps
Set-CsTenantFederationConfiguration -AllowFederatedUsers $false
References
- https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps
- https://learn.microsoft.com/ar-sa/entra/architecture/5-secure-access-b2b
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_external_domains_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks