CIS.M365.8.2.4 - (L1) Ensure the organization cannot communicate with accounts in trial Teams tenants
Overview
Trial Teams tenants are tenants that have only trial licenses and no purchased licenses. They are short-lived, easy to create and often used for spam and phishing. If your organization can communicate with accounts in trial tenants, users can receive messages and meeting invitations from senders that have little accountability.
Blocking trial tenants keeps external communication limited to organizations that have purchased licenses. Users in your organization can still communicate with all other allowed external organizations.
Remediation action
Microsoft documents this setting for PowerShell only. Blocked is the default value, so a tenant fails this test only when the setting has been changed to Allowed.
- Connect to Teams PowerShell using
Connect-MicrosoftTeams. - Run the following command:
Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked
Related links
- Manage external meetings and chat with people and organizations
- Set-CsTenantFederationConfiguration
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.2.4
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.8.2.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Teams |
| Feature | External access |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.2.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:8.2.4, nist-800-53-r5:AC-20 |
| PowerShell test | Test-MtCisTeamsTrialTenantsBlocked |
| Services | Teams |
Source
- Test:
tests/cis/Test.CIS.M365.8.2.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.8.2.4.md