Block Teams communication with unmanaged Teams accounts

Description

Users cannot communicate with Teams accounts that no organization manages (Teams free, personal Microsoft accounts): People in my organization can communicate with unmanaged Teams accounts is off at organization level (AllowTeamsConsumer = False) and in the global external access policy (EnableTeamsConsumerAccess = False).

Rationale

Unmanaged accounts are free, anonymous and disposable, and no tenant administrator can be asked to act on abuse. They are a direct channel for phishing, malware delivery and exfiltration through chat, and they let insiders move data to a personal identity. Business partners have managed accounts and use federation instead.

Impact

Existing chats with personal Teams accounts stop working. Organizations that work with individuals (freelancers, citizens) must invite them as guests or use meetings with the lobby. Skype consumer interoperability (AllowPublicUsers) has no effect since Skype was retired in May 2025.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Users > External access (External collaboration > External access in the newer navigation) > Organization settings and check that People in my organization can communicate with unmanaged Teams accounts is Off.
3. On the Policies tab, open each policy and check that communication with unmanaged Teams accounts is off.
4. With Microsoft Teams PowerShell: Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer must return False, and Get-CsExternalAccessPolicy | Select-Object Identity, EnableTeamsConsumerAccess must show False for every policy assigned to users.
5. Fail if the organization setting is on.

Remediation

1. In the Teams admin center, browse to Users > External access (External collaboration

   External access in the newer navigation) > Organization settings, turn off People in my organization can communicate with unmanaged Teams accounts and Save. Role: Teams Administrator.

2. PowerShell equivalent: Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false, and Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerAccess $false.

Rollback

Run Set-CsTenantFederationConfiguration -AllowTeamsConsumer $true -AllowTeamsConsumerInbound $false to allow outbound contact only (CB-M365-COLLAB-020 still met).

References

• Manage external meetings and chat with people and organizations using Microsoft identities Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTenantFederationConfiguration Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-018 Limit Teams external access to approved domains
• related CB-M365-COLLAB-020 Prevent unmanaged Teams accounts from starting conversations with users Blocking unmanaged accounts entirely also meets the inbound restriction.
• related CB-M365-COLLAB-021 Block Teams external access with trial-only tenants

People and lifecycle