Detections
Analytics

8.2.4 Ensure the organization cannot communicate with accounts in trial Teams tenants

Information

This setting controls the organization's external access with Teams "trial-only" tenants. These are tenants that don't have any purchased seats.

When set to Blocked, users from these trial-only tenants aren't able to search and contact your users via chats, Teams calls, and meetings (using the users' authenticated identities) and your users aren't able to reach users in these trial-only tenants. Users from the trial-only tenant are also removed from existing chats.

The recommended state for People in my organization can communicate with accounts in trial Teams tenant is Off.

Microsoft introduced this setting as Off by default on July 29, 2024 in order to block attack vectors being exploited by threat actors who have abused trial tenants. Enforcing the default ensures the setting is not reenabled for any reason.

Allowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account.

Real-world attacks and exploits delivered via Teams over external access channels include:

 - DarkGate malware
 - Social engineering / Phishing attacks by "Midnight Blizzard"
 - GIFShell
 - Username enumeration

Solution

To remediate using the UI:

 - Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/.
 - Expand External collaboration and select External access.
 - Select the Organization settings tab.
 - Set People in my organization can communicate with accounts in trial Teams tenant to Off.

To remediate using PowerShell:

 - Connect to Teams PowerShell using Connect-MicrosoftTeams
 - Run the following command:

Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked"

Impact:

Users currently in chat conversations with accounts from trial tenants will be removed from those existing chats when this setting is disabled. Organizations that have established communication with external contacts who are using trial tenants will need to use alternative channels (such as email) until those contacts migrate to a licensed tenant.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: microsoft_azure

Control ID: ece8702b364e1b4ab170d316abbad8f977ca6f7ca63afd0135c3298498785878