M365TEAMS-001: External access settings
- Platform
- Entra ID / M365
- Category
- Microsoft Teams Security
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
External access (federation) in Microsoft Teams controls whether users can communicate with people in other Microsoft 365 organizations or Skype users. Unrestricted external access allows any external organization to initiate chats and calls with your users, creating vectors for social engineering and phishing through the Teams client. Limiting federation to specific trusted domains reduces the attack surface while maintaining necessary business communication.
Recommended value
External access limited to specific allowed domains rather than open federation; Skype consumer access disabled
Remediation
Configure Teams external access to use a domain allow list containing only trusted partner organization domains rather than allowing open federation with all external tenants. Disable communication with Skype consumer users unless there is a specific business requirement. Review and update the allowed domain list quarterly to remove organizations that no longer require federation access.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.TEAMS.2.1v2
- NIST SP 800-53
- AC-20
- CIS M365 Benchmark
- 8.1.1