Back to Checks
m365

External access with Teams trial-only tenants is blocked

teams_external_access_trial_tenants_blocked
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariese3
Resource Type:NotDefined

The Teams external access configuration should block communication with trial-only tenants (tenants that don't have any purchased seats). When blocked, users from these trial-only tenants cannot search for, contact, call, or meet with the organization's users via Teams external access.

Prowler logoProwlerprowler-provider-m365

Risk

Trial-only tenants can be created quickly and anonymously, making them a common vector for social engineering and phishing. Allowing external access with them lets untrusted actors reach employees through Teams chats, calls, and meetings.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_external_access_trial_tenants_blocked

Recommendation

Block external access with Teams trial-only tenants so that users from tenants without purchased seats cannot contact your organization through Teams.

Remediation

CLI

Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants Blocked

Other

1Navigate to the Microsoft Teams admin center at https://admin.teams.microsoft.com/
2Go to **External collaboration** > **External access** > **Organization settings**
3Set **People in my organization can communicate with accounts in trial Teams tenants** to **Off**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_external_access_trial_tenants_blocked(Check):
    """Check if external access with Teams trial-only tenants is blocked.

    This setting controls external access with Teams "trial-only" tenants (tenants
    that don't have any purchased seats). When blocked, users from those tenants
    cannot search for, chat, call, or meet with the organization's users.

    - PASS: External access with trial-only tenants is blocked.
    - FAIL: External access with trial-only tenants is allowed.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for external access with trial-only Teams tenants.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        user_settings = teams_client.user_settings
        if user_settings:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=user_settings,
                resource_name="Teams User Settings",
                resource_id="userSettings",
            )
            report.status = "FAIL"
            report.status_extended = (
                "External access with Teams trial-only tenants is allowed."
            )

            if user_settings.external_access_with_trial_tenants == "Blocked":
                report.status = "PASS"
                report.status_extended = (
                    "External access with Teams trial-only tenants is blocked."
                )

            findings.append(report)

        return findings

References