(L1) Ensure communication with unmanaged Teams users is disabled

Contributed by Henrik Piecha with 2 co-contributorsAll contributors →

Part of CIS · Teams · External access · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.2.2

Overview

8.2.2 (L1) Ensure communication with unmanaged Teams users is disabled

This policy setting controls chats and meetings with external unmanaged Teams users (those not managed by an organization, such as Microsoft Teams (free)).

The recommended state is: People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts set to Off.

Rationale

Allowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account. Some real-world attacks and exploits delivered via Teams over external access channels include:

• DarkGate malware
• Social engineering / Phishing attacks by “Midnight Blizzard”
• GIFShell
• Username enumeration

Impact

Users will be unable to communicate with Teams users who are not managed by an organization. Organizations may choose to create additional policies for specific groups needing to communicate with unmanaged external users.

Note: The settings that govern chats and meetings with external unmanaged Teams users aren’t available in GCC, GCC High, or DOD deployments, or in private cloud environments

Remediation action

To remediate using the UI:

1. Navigate to Microsoft 365 Teams Admin Center.
2. Click to expand External collaboration and select External access.
3. Select the Policies tab
4. Click on the Global (Org-wide default) policy.
5. Set People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts to Off.
6. Click Save.

Note: Configuring this setting at the organization level, in the Organization settings tab, to Off is also a compliant remediation.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerAccess $false

Note: Configuring the organization settings to block communication is also in compliance with this control.

Related links

• Microsoft 365 Teams Admin Center
• IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities
• Midnight Blizzard conducts targeted social engineering over Microsoft Teams
• GIFShell Attack Lets Hackers Create Reverse Shell through Microsoft Teams GIFs
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 512

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.2.2
Severity	Medium
Suite	CIS
Product	Teams
Feature	External access
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing, T1204.001 Malicious Link, T1204.002 Malicious File
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.2.2
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:8.2.2, nist-800-53-r5:AC-20
PowerShell test	Test-MtCisCommunicateWithUnmanagedTeamsUsers
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.2.2.ps1
• Documentation: tests/cis/Test.CIS.M365.8.2.2.md