Prevent unmanaged Teams accounts from starting conversations with users

Description

People using Teams accounts not managed by an organization cannot discover users or start conversations with them: External users with Teams accounts not managed by an organization can contact users in my organization is cleared (AllowTeamsConsumerInbound = False, and EnableTeamsConsumerInbound = False in external access policies). When communication with unmanaged accounts is off entirely (CB-M365-COLLAB-019), this control is met.

Rationale

Inbound contact from unmanaged accounts is the entry point of many Teams phishing campaigns: the attacker looks up the victim's address, sends a chat request with a support-themed display name and pushes a link, a file or a remote-assistance session. Blocking inbound discovery removes this channel while still allowing users to initiate contact if the organization needs it.

Impact

Unmanaged Teams users cannot look up users by email address or start chats; users in the organization can still start them if CB-M365-COLLAB-019 is relaxed. None known otherwise.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Users > External access (External collaboration > External access in the newer navigation) > Organization settings. Either People in my organization can communicate with unmanaged Teams accounts is Off, or External users with Teams accounts not managed by an organization can contact users in my organization is cleared.
3. With Microsoft Teams PowerShell: Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer, AllowTeamsConsumerInbound and Get-CsExternalAccessPolicy | Select-Object Identity, EnableTeamsConsumerAccess, EnableTeamsConsumerInbound.
4. Fail if AllowTeamsConsumer and AllowTeamsConsumerInbound are both True.

Remediation

1. In the Teams admin center, browse to Users > External access (External collaboration

   External access in the newer navigation) > Organization settings, clear External users with Teams accounts not managed by an organization can contact users in my organization (or turn communication with unmanaged accounts off) and Save. Role: Teams Administrator.

2. PowerShell equivalent: Set-CsTenantFederationConfiguration -AllowTeamsConsumerInbound $false, and Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerInbound $false.

References

• Manage external meetings and chat with people and organizations using Microsoft identities Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTenantFederationConfiguration Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-018 Limit Teams external access to approved domains
• related CB-M365-COLLAB-019 Block Teams communication with unmanaged Teams accounts

People and lifecycle