Block Teams external access with trial-only tenants

Description

Teams external access with tenants that hold only trial licenses is blocked (ExternalAccessWithTrialTenants = Blocked). Users in such tenants cannot find, chat with, call or meet (with their authenticated identity) users in the organization, and vice versa. The setting is only available in PowerShell.

Rationale

Trial tenants cost nothing, take minutes to create and are discarded after a campaign. Attackers use them to send Teams chats with brand-like names. Legitimate partners have paid subscriptions, so blocking trial-only tenants removes an attacker convenience with almost no business cost.

Impact

A partner evaluating Microsoft 365 on a trial-only tenant cannot use federation until it buys a license; it can still join meetings as an anonymous participant. Users from trial-only tenants are removed from existing chats. Blocked is the current default; the control guards against it being changed to Allowed.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Connect to Microsoft Teams PowerShell (module 6.4.0 or later) as at least a Global Reader.
2. Run Get-CsTenantFederationConfiguration | Select-Object ExternalAccessWithTrialTenants.
3. Fail if the value is Allowed.

Remediation

1. As a Teams Administrator, run Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked.

References

• Manage external meetings and chat with people and organizations using Microsoft identities Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTenantFederationConfiguration Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-018 Limit Teams external access to approved domains
• related CB-M365-COLLAB-019 Block Teams communication with unmanaged Teams accounts

People and lifecycle