Back to Checks
m365

Users cannot start conversations with unmanaged accounts

teams_external_users_cannot_start_conversations
Service: teamsSeverity: critical
OfficialBuilt-inVerified
Categories:trust-boundariese3
Resource Type:NotDefined

Microsoft 365 Teams external access blocks conversation initiation from unmanaged Teams accounts when AllowTeamsConsumerInbound=false.

Prowler logoProwlerprowler-provider-m365

Risk

Permitting unmanaged externals to start chats enables phishing, malware delivery, and social engineering, leading to credential theft and data exfiltration. It also allows user enumeration and presence probing, aiding account takeover and lateral movement, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_external_users_cannot_start_conversations

Recommendation

Disable inbound initiation from unmanaged accounts (AllowTeamsConsumerInbound=false). If external collaboration is required, prefer allowlists for trusted domains and use guest access with least privilege. Apply defense in depth: conditional access, link/file scanning, user education, and monitor for anomalous external chats.

Remediation

CLI

Set-CsTenantFederationConfiguration -AllowTeamsConsumerInbound $false

Other

1Sign in to the Teams admin center: https://admin.teams.microsoft.com/
2Go to Users > External access
3Under "Teams accounts not managed by an organization", clear the checkbox "External users with Teams accounts not managed by an organization can contact users in my organization"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_external_users_cannot_start_conversations(Check):
    """Check if external users cannot start conversations.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for external users cannot start conversations.

        This method checks if external users cannot start conversations.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        user_settings = teams_client.user_settings
        if user_settings:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=user_settings if user_settings else {},
                resource_name="Teams User Settings",
                resource_id="userSettings",
            )
            report.status = "FAIL"
            report.status_extended = "External Teams users can initiate conversations."

            if user_settings and not user_settings.allow_teams_consumer_inbound:
                report.status = "PASS"
                report.status_extended = (
                    "External Teams users cannot initiate conversations."
                )

            findings.append(report)

        return findings

References