Teams, SharePoint and OneDrive
Teams external access and guest access, explained
Teams external access vs guest access: how Microsoft describes each, the controls for external domains, and phishing through external Teams chats.
Where to start: Teams external access settings
External access is on by default, with all external domains allowed, according to Microsoft. These are the settings and checks Microsoft's documentation describes. Microsoft doesn't list a separate licence for them.
- Check which external domains can contact staffIn the Teams admin center (admin.teams.microsoft.com), go to Users > External access. The options are allow all (the default), allow only specific domains, block specific domains, or block all.Full steps for external access
- Review whether to allow only trusted domainsMicrosoft's September 2026 security blog lists restricting Teams external access to trusted domains among its mitigations for attackers posing as IT support. With an allow list, Microsoft says all other domains are blocked.What Microsoft has described
- Decide how unmanaged Teams accounts are handledOn the same page, chats with unmanaged accounts, such as Teams (free), can be turned on or off. Microsoft says that if they can't start conversations, staff have to start all communication with them.Unmanaged accounts
- Check malicious link warnings are onMicrosoft says new tenants have them by default. Older tenants that show the setting: Messaging settings > Messaging safety > Scan messages for unsafe URLs. No extra licence, according to Microsoft.Malicious link warnings
- Show staff the external chat warningMicrosoft's support article describes the warning Teams shows for suspected phishing from outside, with Accept and Block. Its blog describes verifying unsolicited 'IT support' contact through a known internal channel.The warning and the attack pattern
- Check guest access separatelyGuest access is a different feature. Microsoft states guests are added to Entra ID as B2B collaboration users, and the files they can reach depend on SharePoint and OneDrive sharing settings.Guest access in Microsoft 365
Based on Microsoft Learn's Teams external access and malicious URL protection pages, Microsoft Support's external chat article and Microsoft's September 2026 security blog, checked October 2026. Menus can change.
Key points
- Microsoft describes external access as letting users find, call and chat with people who have Microsoft identities in other organisations, and guest access as inviting outside people into a team, with access to its files.
- Microsoft's security research has described attackers using external Teams chats to pose as IT or helpdesk staff and persuade users to grant remote access, and says this doesn't stem from a weakness in Teams itself.
- Microsoft notes that blocking a domain doesn't block its subdomains by default.
Microsoft Teams has two quite different ways to work with people outside an organisation. In Microsoft’s terms, external access lets staff find, call and chat with people who stay in their own organisation’s Teams, while guest access invites an outside person into a team and its files. Their names sound alike, which makes it easy to change one while meaning the other. This page explains the difference between Teams external access and guest access as Microsoft describes it, the controls Microsoft documents for each, and what Microsoft has published about phishing through external Teams chats.
External access and guest access
Microsoft’s Teams documentation defines the two this way:
- External access is “a feature that allows users to find, call, and chat with people who have Microsoft identities, including those from other organizations”. It is sometimes called federation. The outside person stays in their own organisation’s Teams.
- Guest access is “a feature that allows you to invite people from outside your organization to join a team. Guests can also call, chat, and meet with people in your organization and you can share files and folders with them.” Microsoft states that guests are added to the organisation’s Microsoft Entra ID as B2B collaboration users; the guide to Microsoft 365 guest access explains how those guest accounts work.
Microsoft’s comparison table shows some of the practical differences:
| External access users | Guests | |
|---|---|---|
| Chat and call | Yes | Yes |
| Your users can search for them | Only by email or SIP address | No |
| Share files | No | Yes |
| Access Teams resources | No | Yes |
In short, external access is like a phone line between organisations, while guest access brings an outside person into a team and its files. Guest file sharing relies on the SharePoint and OneDrive external sharing settings.
External access controls Microsoft describes
Microsoft states that external access has both an organisation setting and user policies, and that “both the organization settings and user policies are turned on by default”. It adds that “by default, all external domains are allowed”, and that for a user to use external access, both the organisation setting and a user policy must allow it.
Microsoft describes four domain options:
- Allow all external domains, which Microsoft describes as the default.
- Allow only specific external domains. Once an allow list is set up, “all other domains are blocked”.
- Block specific domains, allowing all others.
- Block all external domains.
Microsoft also describes a separate control for unmanaged Teams accounts, meaning people “not managed by an organization, such as Microsoft Teams (free)”. Chats with them can be enabled or disabled. A further setting decides whether those people can start conversations. Microsoft states that if it’s off, unmanaged users “can’t search by email address to find users in your organization” and people in the organisation have to start all communications with them.
Microsoft’s external access page also describes blocking specific users (up to 200 addresses, with the feature off by default), and a feature that lets security administrators manage blocked Teams domains from Microsoft Defender. As checked on 21 October 2026, Microsoft labels that Defender feature “Public Preview” (message center post MC1133508), lists Defender for Office 365 Plan 1 or Plan 2 as the requirement, and says it works only when external access is set to block specific domains or allow all domains.
How to find the external access settings
Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s external access page has the latest steps.
- Sign in to the Teams admin center (admin.teams.microsoft.com).
- In the left navigation, select Users > External access.
- The organisation settings show the domain option in use (allow all, allow only specific, block specific, or block all), the unmanaged Teams accounts settings and, where available, Block specific users from communicating with people in my organization.
- To let the security team manage blocked domains from Defender, Microsoft describes turning on Allow my security team to manage blocked domains on the same page; the domains are then added in the Microsoft Defender portal under Email & collaboration > Policies & rules > Threat Policies > Tenant Allow/Block Lists, on the Teams domains tab.
Microsoft notes that subdomains aren’t blocked by default when a domain is blocked.
Phishing through external Teams chats
Because external access is on by default, someone in another tenant can often start a chat with staff. Microsoft has written about this from two angles. The guide to phishing, smishing and vishing covers phishing more broadly.
What users see. Microsoft’s support article explains that “when Teams detects potential spam or phishing activity (also known as impersonation) from someone requesting to chat with you from outside your organization, you’ll see a notification”. Microsoft defines impersonation as a sender adopting “the identity of a specific person or entity with the intention of deceiving the recipient”. The steps Microsoft lists for that screen are:
- Double-check the sender’s identity, including their name and email address.
- Preview the message and check for anything unusual or suspicious.
- Only accept the conversation if sure the sender is trustworthy (Accept); choose Block to stop all Teams communications from them.
What attackers have done. In a September 2026 security blog post, Microsoft described attackers who “impersonate IT or helpdesk personnel and socially engineer users into granting an interactive remote session”. Microsoft explained that contact begins through Teams “in a way that appears consistent with routine IT support”, and that the attack relies on “convincing the user to bypass those warnings and voluntarily grant remote access through legitimate support tools”. Microsoft stated that “this activity does not stem from a weakness in Microsoft Teams or its built-in protections”.
The mitigations Microsoft listed in that post include restricting Teams external access to trusted domains, revisiting external collaboration policies, making sure users see clear external-sender notices, verifying unsolicited “IT support” contacts through a known internal channel, and controlling which remote-support tools are allowed. The guide to how remote access scams work covers the wider scam pattern.
A fictional example: Sam at yourbusiness.example gets a Teams chat from “Helpdesk Support” at a tenant called it-support.example. Teams marks it as external. The message says Sam’s mailbox is about to be locked and asks him to accept a remote session. Microsoft’s support article describes the external warning shown in this situation, and its blog describes this pattern of an outside account posing as internal IT.
Malicious link warnings
Microsoft describes a Teams feature that “helps to safeguard users from malicious URLs shared in chats, channels, and meeting messages” by showing warnings on potentially harmful links. Microsoft states that for new tenants it is part of Teams’ baseline security and needs no configuration, that it “doesn’t require additional licenses”, and that it “doesn’t block links on click”. For existing tenants that still show the setting, Microsoft’s steps are: in the Teams admin center, select Messaging settings, scroll to Messaging safety, turn on Scan messages for unsafe URLs and select Save. Defender for Office 365 Safe Links adds time-of-click checks in Teams, as explained in the guide to Defender for Office 365 Plan 1 vs Plan 2.
Things that change
Microsoft’s Teams documentation notes that from 5 May 2025, Skype (consumer) interoperability with Teams is no longer supported and the related policies are deprecated. Microsoft’s blocked-domains feature in Defender was still in public preview when this page was reviewed on 21 October 2026. Microsoft’s Teams admin release notes also list, for 23 September 2026, that administrators “can now automatically block identified external bots from joining meetings through Teams meeting policies”. The October 2026 Microsoft 365 security changes summary lists this and other recent changes. Microsoft’s external access page is the place to check current options.
Common questions
What’s the difference between external access and guest access in Teams?
External access lets staff find, call and chat with people who have Microsoft identities and stay in their own organisation’s Teams. Guest access invites an outside person to join a team; Microsoft states guests are added to the organisation’s Entra ID as B2B collaboration users and can be shared files. Microsoft’s table shows external access users can’t share files or access Teams resources. See external access and guest access.
Is Teams external access turned on by default?
Yes, according to Microsoft. It states that “both the organization settings and user policies are turned on by default” and that “by default, all external domains are allowed”. For a user to use external access, both the organisation setting and a user policy have to allow it. Because of this default, someone in another tenant can often start a chat with staff. External access controls Microsoft describes covers the options.
How do I block external users in Teams?
Microsoft describes four domain options under Users > External access in the Teams admin center: allow all external domains, allow only specific domains, block specific domains, or block all. There’s a separate setting for unmanaged Teams accounts and a list of up to 200 blocked addresses. Microsoft notes subdomains aren’t blocked by default when a domain is blocked. How to find the external access settings has the steps.
Can I stop people with free Teams accounts messaging my staff?
Microsoft describes a control for unmanaged Teams accounts, meaning people “not managed by an organization, such as Microsoft Teams (free)”. Chats with them can be enabled or disabled, and a further setting decides whether they can start conversations. If that’s off, Microsoft says they can’t search by email address to find users, and staff have to start all communications. See external access controls Microsoft describes.
What do I do if an outsider messages me on Teams claiming to be IT support?
Microsoft’s support article lists steps for the external chat warning screen: double-check the sender’s name and email address, preview the message for anything unusual, and only accept if sure the sender is trustworthy, or choose Block. Microsoft’s September 2026 blog describes verifying unsolicited “IT support” contacts through a known internal channel. Phishing through external Teams chats covers what Microsoft has published.
Does Teams warn about malicious links in chats?
Microsoft describes a Teams feature that shows warnings on potentially harmful links in chats, channels and meeting messages. Microsoft states that for new tenants it’s part of baseline security, “doesn’t require additional licenses” and “doesn’t block links on click”. Existing tenants that still show the setting turn on Scan messages for unsafe URLs under Messaging settings. Malicious link warnings has Microsoft’s steps.
Related guides
Sources
- Use guest access and external access to collaborate with people outside your organization
- Manage external meetings and chat with people and organizations using Microsoft identities
- Prevent spam or phishing attempts from external chats in Microsoft Teams
- Malicious URL protection in Microsoft Teams
- Release notes for Microsoft Teams admin features
- Safe Links in Microsoft Defender for Office 365
- Impersonating IT support: how threat actors turn a remote session into enterprise-wide access