Check ID:
Provider: Microsoft 365
Service:
Severity: CRITICAL
Categories:
Resource type:
teams_external_users_cannot_start_conversationsProvider: Microsoft 365
Service:
teamsSeverity: CRITICAL
Categories:
trust-boundaries, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Teams external access blocks conversation initiation from unmanaged Teams accounts whenAllowTeamsConsumerInbound=false.
Risk
Permitting unmanaged externals to start chats enables phishing, malware delivery, and social engineering, leading to credential theft and data exfiltration. It also allows user enumeration and presence probing, aiding account takeover and lateral movement, impacting confidentiality and integrity.Recommendation
Disable inbound initiation from unmanaged accounts (AllowTeamsConsumerInbound=false). If external collaboration is required, prefer allowlists for trusted domains and use guest access with least privilege. Apply defense in depth: conditional access, link/file scanning, user education, and monitor for anomalous external chats.
Remediation
- CLI
- Dashboard steps
Set-CsTenantFederationConfiguration -AllowTeamsConsumerInbound $false
References
- https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps
- https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat
- https://learn.microsoft.com/en-us/entra/architecture/9-secure-access-teams-sharepoint
- https://learn.microsoft.com/en-us/microsoftteams/communicate-with-users-from-other-organizations
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_external_users_cannot_start_conversations. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks