In this guide · 7 sections
Short answer
External access lets staff chat with people in other Teams organisations; guest access adds an outsider into your team with access to its files. Switch external access to allow only specific domains, turn off chat with unmanaged Teams accounts, and review guests every quarter.
Guest access vs external access in Teams
The two features sound similar but give outsiders very different reach.
| External access (federation) | Guest access | |
|---|---|---|
| Who it is for | People in other Microsoft 365 or Teams organisations | Anyone with a business or personal email address |
| What they can do | One-to-one and group chat, calls, meetings | Join your team's channels, chats, meetings and files |
| Account in your tenant? | No | Yes, a guest account in Microsoft Entra ID |
| Default setting | Allowed with all external domains | Organisation-wide setting, controlled by admins |
| Main risk | Unsolicited messages from impersonators | Old guests keeping access to files |
Microsoft's external access documentation states that allowing all external domains is the default. Its guest access page explains that a guest gets an account in Microsoft Entra ID, is labelled (Guest) in Teams, and that leaving a team does not remove the guest account from your directory.
Shared channels are a third option: you share one channel with another organisation without creating guest accounts. They are useful for long-running client projects.
How attackers use Teams chats to phish staff
In May 2024 Microsoft Threat Intelligence reported that a ransomware-linked group, Storm-1811, used Microsoft Teams to message and call employees. The attackers created their own tenants with display names such as Help Desk, Help Desk IT and IT Support, then persuaded people to open Quick Assist and give them remote access. Microsoft advised training users to check the External tag on messages and never share account details or approve sign-in requests over chat.
This works against small firms too. A message that appears inside Teams feels more trustworthy than an email, and many SMEs have no internal IT team, so staff cannot easily check whether IT support really is contacting them.
If someone has already let a fake helper in, follow our Microsoft tech support scam guide straight away.
Safe Teams external access settings for a small business
All of these settings are in the Teams admin centre under Users, External access. You need the Teams Administrator or Global Administrator role.
List the domains staff really talk to
Ask each team which clients, suppliers and partners they chat with in Teams. Most small businesses end up with a short list.
Switch to Allow only specific external domains
Next to Teams and Skype for Business users in external organisations, choose Allow only specific external domains and add the list. Every other domain is then blocked.
Turn off chat with unmanaged Teams accounts
Turn off People in my organisation can communicate with unmanaged Teams accounts, which covers personal Teams accounts. If you need it, at least untick the option that lets them start conversations.
Turn off Skype users if you do not need them
Turn off Allow users in my organisation to communicate with Skype users unless there is a clear business need.
Use the blocked users list for repeat offenders
Microsoft lets admins block specific external users; blocked users are removed from existing chats.
Tell staff what changed
Explain that new partners need to be added to the allow list, and who to ask.
Microsoft notes that both sides must allow each other for external chat to work, so a new client may need to add your domain too. Trial-only Teams tenants are blocked from external communication by default.
Guest access: who can invite, what guests can reach
Guest access is managed across three places: Microsoft Entra ID (who can invite), the Teams admin centre (what guests can do), and SharePoint (file sharing). For a small business the sensible defaults are below.
Guest access settings checklist
Conditional Access policies for guests need Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Our guide to Conditional Access for small businesses covers the starter policies.
Review and remove guests every quarter
Guests pile up. A designer from a project two years ago may still be able to open your channel files. Microsoft's automated access reviews for guests need Microsoft Entra ID P2 or Entra ID Governance, which most small businesses do not have. A manual review works fine.
- In the Microsoft Entra admin centre, open Users and filter by user type Guest.
- Export the list with the date each guest was created and last signed in.
- Ask each team owner to confirm which guests still need access.
- Delete guest accounts no longer needed; removing them from a team is not enough.
- Record the review date and the next one in your security notes.
Do it yourself or get help?
An admin comfortable in the Teams admin centre can change the external access settings in under an hour. The time goes into agreeing the domain list, cleaning up guests and making sure SharePoint sharing matches what Teams allows.
Our Microsoft 365 / Google Security Lockdown (S$590) sets Teams external and guest access to allow-list mode, tightens SharePoint sharing, enforces MFA and documents the quarterly guest review. For the rest of the tenant, see our Microsoft 365 security checklist. If you are still choosing a chat platform, compare the costs in Google Chat vs Teams vs Slack.
Frequently asked questions
An external user stays in their own organisation and can chat, call and meet with your staff through external access. A guest is invited into your organisation, gets a guest account in Microsoft Entra ID, and can join your team's channels and open its files. Guests have more reach, so they need more careful management.
Usually not. Most businesses need to chat with some clients and suppliers. Allow only specific external domains instead, so known partners can reach your staff and everyone else is blocked. If nobody in the business uses Teams with outsiders, blocking all external domains is reasonable and can be reversed later.
Teams marks messages and people from other organisations with an External label, and the first message from an unknown external person arrives as a request you can accept or block. Microsoft advises users to check this label. Be suspicious of any External account calling itself IT support, Help Desk or Microsoft.
They lose access to that team, but Microsoft notes that leaving a team does not remove the guest account from your organisation's directory. The account can still hold access to other teams, SharePoint files or shared links. An admin must delete guest accounts that are no longer needed, ideally as part of a quarterly review.