(L1) Ensure the organization cannot communicate with accounts in trial Teams tenants

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · External access · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.2.4

Overview

Trial Teams tenants are tenants that have only trial licenses and no purchased licenses. They are short-lived, easy to create and often used for spam and phishing. If your organization can communicate with accounts in trial tenants, users can receive messages and meeting invitations from senders that have little accountability.

Blocking trial tenants keeps external communication limited to organizations that have purchased licenses. Users in your organization can still communicate with all other allowed external organizations.

Remediation action

Microsoft documents this setting for PowerShell only. Blocked is the default value, so a tenant fails this test only when the setting has been changed to Allowed.

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked

Related links

• Manage external meetings and chat with people and organizations
• Set-CsTenantFederationConfiguration
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.2.4

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.2.4
Severity	Medium
Suite	CIS
Product	Teams
Feature	External access
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.2.4
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:8.2.4, nist-800-53-r5:AC-20
PowerShell test	Test-MtCisTeamsTrialTenantsBlocked
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.2.4.ps1
• Documentation: tests/cis/Test.CIS.M365.8.2.4.md