{
  "id": "CB-M365-COLLAB-020",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-020",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-020.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-020.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-020",
    "title": "Prevent unmanaged Teams accounts from starting conversations with users",
    "finding": {
      "title": "Unmanaged Teams accounts can find users and start chats with them",
      "description": "An attacker with a free account can search users by email address and open a chat posing as support, which is a common Teams phishing technique."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "external-access",
      "unmanaged-accounts",
      "phishing"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "People using Teams accounts not managed by an organization cannot discover users or start\nconversations with them: **External users with Teams accounts not managed by an organization can\ncontact users in my organization** is cleared (`AllowTeamsConsumerInbound` = `False`, and\n`EnableTeamsConsumerInbound` = `False` in external access policies). When communication with\nunmanaged accounts is off entirely (CB-M365-COLLAB-019), this control is met.\n",
    "rationale": "Inbound contact from unmanaged accounts is the entry point of many Teams phishing campaigns: the\nattacker looks up the victim's address, sends a chat request with a support-themed display name and\npushes a link, a file or a remote-assistance session. Blocking inbound discovery removes this\nchannel while still allowing users to initiate contact if the organization needs it.\n",
    "impact": "Unmanaged Teams users cannot look up users by email address or start chats; users in the\norganization can still start them if CB-M365-COLLAB-019 is relaxed. None known otherwise.\n",
    "setting": {
      "location": "Teams admin center > Users > External access > Organization settings > External users with Teams accounts not managed by an organization can contact users in my organization",
      "default_value": "Selected (AllowTeamsConsumerInbound = True)",
      "recommended_value": "Cleared (AllowTeamsConsumerInbound = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Users** > **External access** (**External collaboration** > **External access** in\n   the newer navigation) > **Organization settings**. Either **People in my organization can\n   communicate with unmanaged Teams accounts** is **Off**, or **External users with Teams accounts\n   not managed by an organization can contact users in my organization** is cleared.\n3. With Microsoft Teams PowerShell:\n   `Get-CsTenantFederationConfiguration | Select-Object AllowTeamsConsumer, AllowTeamsConsumerInbound`\n   and\n   `Get-CsExternalAccessPolicy | Select-Object Identity, EnableTeamsConsumerAccess, EnableTeamsConsumerInbound`.\n4. Fail if `AllowTeamsConsumer` and `AllowTeamsConsumerInbound` are both `True`.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Users** > **External access** (**External collaboration**\n   > **External access** in the newer navigation) > **Organization settings**, clear **External\n   users with Teams accounts not managed by an organization can contact users in my organization**\n   (or turn communication with unmanaged accounts off) and **Save**. Role: Teams Administrator.\n2. PowerShell equivalent: `Set-CsTenantFederationConfiguration -AllowTeamsConsumerInbound $false`,\n   and `Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerInbound $false`.\n"
    },
    "references": [
      {
        "title": "Manage external meetings and chat with people and organizations using Microsoft identities",
        "url": "https://learn.microsoft.com/microsoftteams/trusted-organizations-external-meetings-chat",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTenantFederationConfiguration",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-cstenantfederationconfiguration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.2.2v2",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1204.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-018",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-019",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}