Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
teams_unmanaged_communication_disabledProvider: Microsoft 365
Service:
teamsSeverity: HIGH
Categories:
e3, trust-boundariesResource type:
NotDefinedWhat this check verifies
Microsoft 365 Teams external access configuration for unmanaged Teams accounts is reviewed, expecting the “Teams accounts not managed by an organization” option to beOff, preventing chats with personal Microsoft accounts.
Risk
Allowing unmanaged accounts enables unsolicited contact that undermines confidentiality and integrity: attackers can enumerate users, deliver phishing or malware links, and run social-engineering leading to data exfiltration and unauthorized changes. It also fuels spam and alert fatigue.Recommendation
Disable communication with unmanaged Teams accounts to enforce least privilege and reduce attack surface. If collaboration is needed, allow only outbound initiation, prefer guest access or trusted domains, apply defense in depth with DLP/link protection, and monitor external interactions.Remediation
- CLI
- Dashboard steps
Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false
References
- https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps
- https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_unmanaged_communication_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks