{
  "id": "CB-M365-COLLAB-019",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-019",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-019.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-019.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-019",
    "title": "Block Teams communication with unmanaged Teams accounts",
    "finding": {
      "title": "Users can chat with personal Teams accounts not managed by any organization",
      "description": "Anyone with a free Microsoft account can exchange messages and files with users, outside any tenant accountability."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "external-access",
      "unmanaged-accounts",
      "phishing"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "Users cannot communicate with Teams accounts that no organization manages (Teams free, personal\nMicrosoft accounts): **People in my organization can communicate with unmanaged Teams accounts** is\noff at organization level (`AllowTeamsConsumer` = `False`) and in the global external access policy\n(`EnableTeamsConsumerAccess` = `False`).\n",
    "rationale": "Unmanaged accounts are free, anonymous and disposable, and no tenant administrator can be asked to\nact on abuse. They are a direct channel for phishing, malware delivery and exfiltration through\nchat, and they let insiders move data to a personal identity. Business partners have managed\naccounts and use federation instead.\n",
    "impact": "Existing chats with personal Teams accounts stop working. Organizations that work with individuals\n(freelancers, citizens) must invite them as guests or use meetings with the lobby. Skype consumer\ninteroperability (`AllowPublicUsers`) has no effect since Skype was retired in May 2025.\n",
    "setting": {
      "location": "Teams admin center > Users > External access > Organization settings > People in my organization can communicate with unmanaged Teams accounts",
      "default_value": "On",
      "recommended_value": "Off (AllowTeamsConsumer = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Users** > **External access** (**External collaboration** > **External access** in\n   the newer navigation) > **Organization settings** and check that **People in my organization can\n   communicate with unmanaged Teams accounts** is **Off**.\n3. On the **Policies** tab, open each policy and check that communication with unmanaged Teams\n   accounts is off.\n4. With Microsoft Teams PowerShell:\n   `Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer` must return `False`, and\n   `Get-CsExternalAccessPolicy | Select-Object Identity, EnableTeamsConsumerAccess` must show\n   `False` for every policy assigned to users.\n5. Fail if the organization setting is on.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Users** > **External access** (**External collaboration**\n   > **External access** in the newer navigation) > **Organization settings**, turn off **People in\n   my organization can communicate with unmanaged Teams accounts** and **Save**. Role: Teams\n   Administrator.\n2. PowerShell equivalent: `Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false`, and\n   `Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerAccess $false`.\n",
      "rollback": "Run\n`Set-CsTenantFederationConfiguration -AllowTeamsConsumer $true -AllowTeamsConsumerInbound $false` to\nallow outbound contact only (CB-M365-COLLAB-020 still met).\n"
    },
    "references": [
      {
        "title": "Manage external meetings and chat with people and organizations using Microsoft identities",
        "url": "https://learn.microsoft.com/microsoftteams/trusted-organizations-external-meetings-chat",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTenantFederationConfiguration",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-cstenantfederationconfiguration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.2.3v2",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.3.1v1",
        "relation": "related",
        "note": "Removed from ScubaGear 2.0.0. It targeted Skype consumer users; Skype was retired in May 2025."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-018",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-020",
        "type": "related",
        "note": "Blocking unmanaged accounts entirely also meets the inbound restriction."
      },
      {
        "id": "CB-M365-COLLAB-021",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}