Back to Checks
m365

External domain access is disabled for Teams users

teams_external_domains_restricted
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariese3
Resource Type:NotDefined

Microsoft 365 Teams tenant external access configuration is assessed. The expected posture is federation with external domains disabled, so users cannot chat, call, or meet with accounts in other domains.

Prowler logoProwlerprowler-provider-m365

Risk

Unrestricted external federation enables delivery of phishing links and malware via chats/calls, user enumeration, and data leakage through messages or file shares. This directly threatens confidentiality and integrity, and can aid social engineering-driven lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_external_domains_restricted

Recommendation

Adopt a default-deny stance: disable external access. If collaboration is required, allowlist only trusted domains and apply least privilege with cross-tenant policies. Prefer B2B guest/shared channels, require MFA and compliant devices, and review logs and domain lists regularly.

Remediation

CLI

Set-CsTenantFederationConfiguration -AllowFederatedUsers $false

Other

1Sign in to the Teams admin center: https://admin.teams.microsoft.com/
2Go to Org-wide settings (or Users) > External access
3Turn off "Users can communicate with other Skype for Business and Teams users"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_external_domains_restricted(Check):
    """Check if external domains are restricted from being used in Teams admin center.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for

        This method checks if external domains are restricted from being used in Teams admin center.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        user_settings = teams_client.user_settings
        if user_settings:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=user_settings if user_settings else {},
                resource_name="Teams User Settings",
                resource_id="userSettings",
            )
            report.status = "FAIL"
            report.status_extended = "Users can access external domains."

            if user_settings and not user_settings.allow_external_access:
                report.status = "PASS"
                report.status_extended = "Users can not access external domains."

            findings.append(report)

        return findings

References