Back to Checks
m365

Users cannot communicate with unmanaged users

teams_unmanaged_communication_disabled
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:e3trust-boundaries
Resource Type:NotDefined

Microsoft 365 Teams external access configuration for unmanaged Teams accounts is reviewed, expecting the "Teams accounts not managed by an organization" option to be Off, preventing chats with personal Microsoft accounts.

Prowler logoProwlerprowler-provider-m365

Risk

Allowing unmanaged accounts enables unsolicited contact that undermines confidentiality and integrity: attackers can enumerate users, deliver phishing or malware links, and run social-engineering leading to data exfiltration and unauthorized changes. It also fuels spam and alert fatigue.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_unmanaged_communication_disabled

Recommendation

Disable communication with unmanaged Teams accounts to enforce least privilege and reduce attack surface.

If collaboration is needed, allow only outbound initiation, prefer guest access or trusted domains, apply defense in depth with DLP/link protection, and monitor external interactions.

Remediation

CLI

Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false

Other

1Sign in to the Microsoft Teams admin center
2Go to Users > External access
3Under "Teams accounts not managed by an organization", turn OFF "People in my organization can communicate with Teams users whose accounts aren't managed by an organization"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_unmanaged_communication_disabled(Check):
    """Check if unmanaged communication is disabled in Teams admin center.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for unmanaged communication disabled.

        This method checks if unmanaged communication is disabled in Teams admin center.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        user_settings = teams_client.user_settings
        if user_settings:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=user_settings if user_settings else {},
                resource_name="Teams User Settings",
                resource_id="userSettings",
            )
            report.status = "FAIL"
            report.status_extended = "Teams users can communicate with unmanaged users."

            if user_settings and not user_settings.allow_teams_consumer:
                report.status = "PASS"
                report.status_extended = (
                    "Teams users cannot communicate with unmanaged users."
                )

            findings.append(report)

        return findings

References