Limit Teams external access to approved domains

Description

Teams external access (federation) is allowed only with the domains in {{ allowed_federation_domains }}: the organization setting Teams and Skype for Business users in external organizations is Allow only specific external domains (AllowFederatedUsers = True, AllowedDomains = the list). Blocking all external domains also meets the control.

The baseline keeps open federation but blocks unmanaged accounts and trial tenants (CB-M365-COLLAB-019 to CB-M365-COLLAB-021).

Rationale

Open federation lets any tenant start a chat with any user. Threat actors create or compromise tenants, name them after IT support or security teams, and use Teams chats and calls for phishing, malware delivery and help-desk social engineering. An allow list limits Teams contact to partners the organization chose.

Impact

Users can no longer chat, call or see presence of people in organizations outside the list; those people join meetings as anonymous participants (subject to the lobby). Every new partner needs an administrator change. The list holds up to 4,000 domains. Custom external access policies can grant different domain lists to specific users.

Applies when

Requires: Microsoft Teams

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Users > External access (External collaboration > External access in the newer navigation) > Organization settings.
3. Check that Teams and Skype for Business users in external organizations is Allow only specific external domains (or Block all external domains) and compare the list with {{ allowed_federation_domains }}.
4. With Microsoft Teams PowerShell: Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowedDomains, BlockedDomains. AllowedDomains must be a list of domains, not AllowAllKnownDomains.
5. Check custom external access policies (Get-CsExternalAccessPolicy) for CommunicationWithExternalOrgs values that open more domains.
6. Fail if federation is open to all domains or to a block list only, or if the list contains a domain that is not approved.

Remediation

1. Build the list from current federation use (Teams usage reports or the audit log) and have the business owners approve each partner domain.
2. In the Teams admin center, browse to Users > External access (External collaboration

   External access in the newer navigation) > Organization settings, select Allow only specific external domains, add each domain and Save. Role: Teams Administrator.

3. PowerShell equivalent: $list = New-Object 'System.Collections.Generic.List[string]'; $list.Add('partner.example'); Set-CsTenantFederationConfiguration -AllowFederatedUsers $true -AllowedDomainsAsAList $list.
4. Changes take time to propagate; announce the date to users.

Rollback

Select Allow all external domains (or add the missing domain). Propagation can take several hours.

References

• Manage external meetings and chat with people and organizations using Microsoft identities Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTenantFederationConfiguration Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-019 Block Teams communication with unmanaged Teams accounts
• related CB-M365-COLLAB-020 Prevent unmanaged Teams accounts from starting conversations with users
• related CB-M365-COLLAB-021 Block Teams external access with trial-only tenants
• related CB-M365-COLLAB-030 Block chat in external meetings hosted by untrusted organizations Trusted domains define which external meetings keep chat.
• related CB-M365-TENANT-014 Block cross-tenant B2B access by default and allow named partners

People and lifecycle