Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/09-administration-and-governance/feature-admin-external-access-vs-guest-access.md
feature-admin-external-access-vs-guest-access.mdv1 · history
CurrentApplies to AllUpdated 3 weeks agoSource Microsoft Learn ↗

What it does

Two different ways of working with people outside the tenant. External access is federation: your users chat, call and meet with users in other Microsoft 365 organisations (and unmanaged Teams accounts) who stay in their own tenant. Guest access adds the outsider to your directory as an Entra B2B guest so they can join teams, channels and files.

Key facts

  • External access is on by default for all external domains. You can switch to allow-list only, block-list only, or block everything. Both the org-wide setting and the user's external access policy have to allow it.
  • Blocking contoso.com doesn't block marketing.contoso.com. Use Set-CsTenantFederationConfiguration -BlockAllSubdomains $true if that matters.
  • Federation with trial-only tenants is blocked by default (-ExternalAccessWithTrialTenants Blocked). When blocked, trial tenant users are removed from existing chats and can't find your users.
  • Unmanaged Teams accounts (personal Microsoft accounts) are controlled separately with -AllowTeamsConsumer and -AllowTeamsConsumerInbound. If inbound is off, your users have to start the conversation. Not available in GCC, GCC High, DoD.
  • Set-CsTeamsExternalAccessConfiguration holds a blocked users list, capped at 200 entries.
  • Security admins can manage blocked Teams domains from the Tenant Allow/Block List in the Microsoft Defender portal (public preview at time of writing, needs Defender for Office 365 Plan 1 or 2, and external access set to allow all or block specific domains).
  • Federated users get chat, calling and meetings only — no access to teams, channels, SharePoint or other Microsoft 365 resources.
  • Guest access needs settings aligned across Entra ID (B2B invitation and collaboration settings), Microsoft 365 Groups, SharePoint sharing and Teams guest settings. Guests show with "(Guest)" in their name.
  • Guests don't need a Microsoft 365 licence from you; Microsoft Entra External ID billing (MAU-based) applies. New guests can take up to 12 hours before everything works.
  • Shared channels (B2B direct connect) sit between the two: channel access without a guest account, governed by cross-tenant access settings in Entra.

When to use / skip

Leave external access on. Turning it off or going allow-list-only is the quickest way to make Teams feel broken to users who just want to chat with a supplier, and the risk on federated chat is far lower than on guests. If the client is worried, block specific domains, keep trial tenants blocked, and look at the Defender tenant block list so security owns the blocking without needing Teams admin rights. An allow-list makes sense in regulated sectors where every external communication partner has to be approved anyway.

Guest access is the right answer when the outsider needs to work in a team — files, channels, Planner — over a long period. It brings the identity into your directory, so pair it with access reviews and conditional access or you'll accumulate guests indefinitely. For a single channel's worth of collaboration with another Microsoft 365 organisation, shared channels are often cleaner than inviting guests.

Configuration decisions

  • External access stance: open, block specific domains, or allow-list only — and who approves changes.
  • Unmanaged Teams accounts: allow outbound only, allow both directions, or block. Most enterprises allow outbound and block inbound.
  • Trial tenants: keep blocked unless the client works with a lot of start-ups.
  • Whether to split external access by user via policy (for example, blocking federation for a regulated function while leaving it on for everyone else).
  • Guest access on or off, and which layer controls who can invite (Entra invitation settings versus Teams owner rights).
  • Guest lifecycle: access reviews, expiry of inactive guests, and who sponsors each guest.
  • Shared channels versus guests for partner collaboration, which depends on the partner's cross-tenant access settings as much as yours.

Gotchas

  • External access needs both sides. If the other tenant has you blocked or is on allow-list only, nothing you do on your side fixes it — the most common "federation is broken" ticket.
  • Blocked domains can still join your meetings anonymously if anonymous join is on. External access controls chat and calling, not meeting join.
  • Guest access has four layers. Teams guest access can be on while SharePoint external sharing is off, and guests then join the team but can't open the files.
  • Users confuse the two constantly. A federated user can't be "added to the team"; asking a guest to "just chat from your own Teams" means they're in the wrong tenant context.
  • The 200-entry blocked users list fills up quickly if security uses it for individual addresses; domain blocking or the Defender block list scales better.
  • Skype consumer interop settings are still in the cmdlets but Skype itself is retired — don't spend design time on it.

Consultant notes

  • Document the external collaboration model as one picture: federation, guests, shared channels, and anonymous meeting join. Clients treat them as one thing; the settings are spread across four admin portals.
  • Before a tenant-to-tenant migration, plan the federation between source and target. Open federation (and often guest or shared channel access) between the two tenants is what keeps people talking during the coexistence period, and you'll need to unpick it afterwards.
  • After a tenant-to-tenant migration or domain move, partners that allow-listed the old domain need telling — their allow-list now blocks your users.
  • When guest invitations or shared channels misbehave, check Entra cross-tenant access settings on both sides. Federated chat is controlled in Teams; B2B collaboration and B2B direct connect are controlled in Entra.
  • Hand security a short note on who owns blocking: Teams admins in the admin center, or security teams through Defender.

Worth revisiting once the Defender tenant block list for Teams domains reaches general availability

Was this accurate?
Related
Shared channels and B2B direct connect — working with other organisations without guest accounts01-chat-and-collaborationInformation barriers in Teams10-security-and-compliancePrivate channel vs shared channel vs a separate team13-decision-guidesMeeting Policies, Lobby Bypass and Meeting Options02-meetings-webinars-and-eventsData loss prevention for Teams chat and channel messages10-security-and-complianceTeams Rooms resource accounts: creation and calendar processing06-teams-rooms-and-devices