Detections
Analytics

8.2.1 Ensure external domains are restricted in the Teams admin center

Information

This policy controls whether external domains are allowed, blocked or permitted based on an allowlist or denylist. When external domains are allowed, users in your organization can chat, add users to meetings, and use audio video conferencing with users in external organizations.

The recommended state is Off on the Global (Org-wide default) policy.

Unrestricted external federation allows any Teams user from any organization to initiate contact with your users, making them susceptible to social engineering, phishing, and malware delivery via Teams chat. Restricting external domains to an allowlist or blocking them entirely eliminates this unsolicited contact vector.

Real-world attacks and exploits delivered via Teams over external access channels include:

 - DarkGate malware
 - Social engineering / phishing attacks by "Midnight Blizzard"
 - GIFShell
 - Username enumeration

Solution

Note: Configuring this setting at the organization level in Organization settings to either Off, Block all external domains or Allow only specific external domains is also a compliant remediation for this control.

To remediate using the UI:

 - Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/.
 - Expand External collaboration and select External access.
 - Open the Policies tab.
 - Click on the Global (Org-wide default) settings policy.
 - Set Manage external domains for this policy to Off.
 - Click Save.

To remediate using PowerShell:

 - Connect to Teams PowerShell using Connect-MicrosoftTeams
 - Run the following command to configure the Global (Org-wide default) policy.

Set-CsExternalAccessPolicy -Identity Global -EnableFederationAccess $false

Impact:

Restricting external domains will limit users' ability to collaborate with individuals outside the organization unless their domain is explicitly allowlisted or they are invited as a guest in Microsoft Entra ID. Administrators choosing an allowlist approach will incur ongoing overhead to manage approved domains as external collaboration needs evolve.

Note: Organizations may create custom external access policies with federation enabled and assign them to specific users or groups requiring external access, while keeping the Global (Org-wide default) policy restrictive.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6, 800-53|CM-7, 800-53|MP-2

Plugin: microsoft_azure

Control ID: 898f85cbccb5e989c515aef00c885355948890a71c1dc88c3e203f75acff36ec