External access vs guest access in Microsoft Teams: configuring federation safely

Microsoft Teams gives you two ways to work with people outside your organization, and they are easy to mix up. External access (federation) lets your users chat, call and meet with people who stay in their own tenant; guest access adds people to your directory so they can join your teams, channels and files. In this deep dive I'll compare the two and walk through the settings that control each, ending with a safe baseline.

How it works: two models, two sets of controls#

A third option, shared channels, uses Microsoft Entra B2B direct connect: people stay in their own tenant but get access to one channel, if both organizations allow it in cross-tenant access settings. Rule of thumb: to chat and meet, use external access; to work in your files over time, use guest access.

Step-by-step: external access#

1. Choose a domain model#

In the Teams admin center, open Users › External access. On the Organization settings tab, Teams and Skype for Business users in external organizations offers four choices: allow all external domains (the default), allow only specific external domains, block only specific external domains, or block all external domains. Federation is mutual: if the other organization doesn't allow you too, its users can't chat with yours and join your meetings as anonymous participants.

An allow list is the tightest model (external chat is a well-known phishing route), but every new partner then needs an admin change. Otherwise, keep federation open with a block list and apply step 3.

2. Decide on unmanaged Teams accounts#

People in my organization can communicate with unmanaged Teams accounts covers people using Microsoft Teams (free) with a personal Microsoft account. If you need it, clear External users with Teams accounts not managed by an organization can contact users in my organization: your users can still start those chats, but unmanaged accounts can't look up or message your users first.

Consumer Skype is no longer a separate case. Microsoft ended Skype consumer interoperability with Teams on 5 May 2025 and deprecated the related policies, and the AllowPublicUsers parameter of Set-CsTenantFederationConfiguration can no longer be used. Drop it from scripts and baselines, even where older guidance still describes a setting for Skype users. People who moved from Skype to Teams (free) are unmanaged Teams accounts, so the two settings above decide whether they can reach you.

3. Harden the tenant settings with PowerShell#

Some protections are PowerShell-only (MicrosoftTeams module 6.4.0 or later for the trial-tenant setting):

Connect-MicrosoftTeams

Get-CsTenantFederationConfiguration |
    Format-List AllowFederatedUsers, AllowedDomains, BlockedDomains, BlockAllSubdomains,
                AllowTeamsConsumer, AllowTeamsConsumerInbound, ExternalAccessWithTrialTenants

# Keep trial-only tenants blocked and extend domain blocks to subdomains
Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked" -BlockAllSubdomains $true

# Add a domain to the block list
$d = New-CsEdgeDomainPattern -Domain "fabrikam.com"
Set-CsTenantFederationConfiguration -BlockedDomains @{Add=$d}

Trial-only tenants (no purchased licences) are cheap for attackers to create, so ExternalAccessWithTrialTenants defaults to Blocked; safelist a genuine partner with -AllowedTrialTenantDomains instead of allowing all trials. Without BlockAllSubdomains, blocking fabrikam.com leaves sales.fabrikam.com open.

4. Scope federation with external access policies#

Organization settings define what's possible; external access policies decide who can use it, and both must allow it. On the Policies tab, edit the Global (Org-wide default) policy or add custom policies for users or groups. A custom policy can carry its own domain list (up to 100 domains) that replaces the organization list for the people assigned to it; this needs AllowFederatedUsers set to True.

New-CsExternalAccessPolicy -Identity "Finance-PartnersOnly" -EnableFederationAccess $true `
    -CommunicationWithExternalOrgs "AllowSpecificExternalDomains" `
    -AllowedExternalDomains @("contoso.com","fabrikam.com")

Grant-CsExternalAccessPolicy -Identity "anna@yourtenant.com" -PolicyName "Finance-PartnersOnly"

Step-by-step: guest access across four layers#

Guest access works only when all four layers allow it, and the most restrictive one wins.

If Entra ID lets only admins invite guests, team owners can add only existing guests. For the SharePoint layer, see SharePoint and OneDrive external sharing explained.

Verify#

• Rerun Get-CsTenantFederationConfiguration. Good looks like ExternalAccessWithTrialTenants : Blocked, AllowTeamsConsumerInbound : False, BlockAllSubdomains : True and domain lists that match your design.
• See which policy a user gets: Get-CsUserPolicyAssignment -Identity anna@yourtenant.com -PolicyType ExternalAccessPolicy.
• Chat from a pilot account with an allowed partner; a test account in a blocked domain shouldn't be able to message your users.
• If a partner can't reach you, run the Teams Trusted Organizations diagnostic in the Microsoft 365 admin center with the user's SIP address and the partner's domain.
• Add a test guest to a test team: after redeeming the invitation they should switch to your organization, post and open files. Access denied on files points to the SharePoint layer.

Tips & gotchas#

• A blocked domain can still attend meetings anonymously if anonymous join is allowed, so pair domain blocks with lobby settings.
• Block one sender, not the whole domain. Block specific users from communicating with people in my organization on the same page takes up to 200 addresses.
• Let security block domains. Allow my security team to manage blocked domains lets security admins block Teams domains in the Tenant Allow/Block Lists in the Microsoft Defender portal (Defender for Office 365 Plan 1 or 2; documented as a preview).
• Review guests regularly. Guest accounts outlive projects; see access reviews and entitlement management basics. Sensitivity labels for groups and sites can also keep guests out of specific confidential teams.

References#

• Manage external meetings and chat with people and organizations using Microsoft identities
• Set-CsTenantFederationConfiguration
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365