(L2) Ensure external domains are restricted in the Teams admin center

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · External access · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.2.1

Overview

Federation lets users in other Microsoft 365 and Teams organizations find and message people in your tenant. If every known external domain is allowed, anyone with a tenant in those domains can start chats with your users. That is a common route for phishing and social engineering, because the sender looks like a normal business contact.

Restricting external domains means only the partner domains you choose can communicate with your users. Turning federation off removes the path completely.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Users > External access.
3. Next to Teams and Skype for Business users in external organizations, choose Allow only specific external domains, select Add external domains and add the approved domains. To turn external access off instead, choose Block all external domains.
4. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following commands to allow only specific domains, replacing the example domain with your approved domains. The list replaces the domains that are allowed now:

$domains = [System.Collections.Generic.List[string]]::new()
$domains.Add('partner.example.com')
Set-CsTenantFederationConfiguration -AllowFederatedUsers $true -AllowedDomainsAsAList $domains

Note: Setting AllowFederatedUsers to $false also meets the recommended state.

Related links

• Microsoft Teams admin center
• Manage external meetings and chat with people and organizations
• Set-CsTenantFederationConfiguration
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.2.1

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.2.1
Severity	Medium
Suite	CIS
Product	Teams
Feature	External access
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.2.1
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:8.2.1, nist-800-53-r5:AC-20
PowerShell test	Test-MtCisTeamsExternalDomainsRestricted
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.2.1.ps1
• Documentation: tests/cis/Test.CIS.M365.8.2.1.md