# (L1) Ensure the organization cannot communicate with accounts in trial Teams tenants

Trial Teams tenants are tenants that have only trial licenses and no purchased licenses.

Source: https://maester.dev/docs/tests/CIS.M365.8.2.4

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Teams · External access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.8.2.4
```

## Overview

Trial Teams tenants are tenants that have only trial licenses and no purchased licenses. They are short-lived, easy to create and often used for spam and phishing. If your organization can communicate with accounts in trial tenants, users can receive messages and meeting invitations from senders that have little accountability.

Blocking trial tenants keeps external communication limited to organizations that have purchased licenses. Users in your organization can still communicate with all other allowed external organizations.

#### Remediation action

Microsoft documents this setting for PowerShell only. Blocked is the default value, so a tenant fails this test only when the setting has been changed to Allowed.

1. Connect to Teams PowerShell using `Connect-MicrosoftTeams`.
2. Run the following command:

```powershell
Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked
```

#### Related links

* [Manage external meetings and chat with people and organizations](https://learn.microsoft.com/microsoftteams/manage-external-access)
* [Set-CsTenantFederationConfiguration](https://learn.microsoft.com/powershell/module/teams/set-cstenantfederationconfiguration)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.2.4](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.8.2.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Teams |
| Feature | External access |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.2.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:8.2.4, nist-800-53-r5:AC-20 |
| PowerShell test | [Test-MtCisTeamsTrialTenantsBlocked](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.2.4.ps1) |
| Services | Teams |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.8.2.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.2.4.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.8.2.4.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.2.4.md)