Teams has quietly become the second inbox. Clients, vendors and, increasingly, attackers use it to reach your staff. Yet in many tenants the Microsoft Teams security settings are exactly as they were on the day Teams was switched on, which means anyone in any organization can message your people and anyone with a link can join your meetings.
None of this needs a big project. Below are the settings I review every quarter in the Teams admin center, what I recommend for a 20 to 500 person business, and why each one matters.
External access: who can chat with your staff
External access controls chat, calls and meetings with people in other Microsoft 365 organizations, unmanaged Teams accounts and Skype users. By default, Teams allows all external domains. That convenience is also how attackers posing as “IT support” or “Microsoft security” start Teams chats with your users.
Go to Users > External access in the Teams admin center and review these options:
Teams and Skype for Business users in external organizations: decide between allowing all external domains, allowing only specific domains, or blocking specific domains. Allowing only the partners you actually work with is the strongest option. If that list would be too long, at least block domains you have seen used in attacks.
People in my organization can communicate with unmanaged Teams accounts: unmanaged accounts are personal Teams accounts not owned by any organization. Most businesses can turn this off. If you need it, untick the option that lets unmanaged users start conversations, so only your staff can initiate contact.
Skype users: turn off unless you have a real need.
Block specific users: lets you block individual external addresses that have harassed or phished your staff.
Microsoft blocks communication with trial-only Teams tenants by default. Leave that in place. Attackers often use throwaway trial tenants for exactly this reason.
If you have Defender for Office 365, Teams admins can also let security admins manage blocked Teams domains from the Tenant Allow/Block List in the Microsoft Defender portal. That puts blocking in the same place your security team already works.
Guest access: who can join your teams
Guest access is different from external access. A guest is added to a team and can see its channels and files. Settings are under Users > Guest access.
Keep guest access on only if teams genuinely collaborate with outsiders. If they do, it is usually better than sharing through email.
Review what guests can do: make private calls, edit or delete sent messages, use screen sharing. Restrict what you do not need.
Remember that SharePoint sharing settings and Microsoft Entra external collaboration settings also apply to guests. Set guest access expiration in SharePoint so forgotten guests drop off automatically.
Review guest membership of each team at least quarterly. An access review in Entra ID Governance can automate this if you have P2.
Meeting settings: lobby, anonymous join and presenting
Meeting settings are split between organization-wide Meeting settings and per-user Meeting policies under Meetings. These are the ones to check.
Setting
Default
What I usually recommend
Anonymous users can join a meeting
On
Off for most staff. Turn it on only in a separate policy for people who run webinars or client calls with external attendees who have no Microsoft account.
Who can bypass the lobby
People in my org and guests
Keep this or tighten to people in my org. Never set to Everyone for the default policy.
People dialing in can bypass the lobby
Off
Keep off.
Anonymous users and dial-in callers can start a meeting
Off
Keep off.
Who can present
Varies by policy
Organizers and co-organizers, or people in my org. Avoid Everyone.
External participants can give or request control
Off
Keep off.
Allow numeric-only meeting passcodes
Off
Keep off.
Meeting organizers can change several lobby options in their own meeting options. If you need certain meetings locked down regardless, such as board meetings, Teams Premium meeting templates and sensitivity labels can enforce them.
Apps in Teams: what can be installed
Third-party Teams apps can read messages and files once approved. Under Teams apps > Manage apps, review which apps are allowed and who can install them.
Open the org-wide app settings and decide whether third-party apps are allowed at all.
If they are, block apps by default and allow the ones your business actually uses.
Review the permissions of each allowed app. Anything requesting broad access to chats or files should have a clear business owner.
Check that users cannot upload custom apps unless they are developers who need to.
App permissions in Teams tie back to Microsoft Entra app consent, so restricting user consent in Entra ID helps here too.
Protecting files and links shared in Teams
Files shared in Teams live in SharePoint and OneDrive, and links in chat can be just as malicious as links in email. If you have Defender for Office 365 Plan 1 or higher, which comes with Business Premium:
Turn on Safe Links for Microsoft Teams so URLs in chats and channels are checked at click time.
Turn on Safe Attachments for SharePoint, OneDrive and Microsoft Teams so malicious files are detected and blocked.
Make sure users can report suspicious Teams messages, so reports reach your security team rather than disappearing.
Also check the email integration setting under Teams > Teams settings. Channel email addresses accept mail from outside unless you restrict them to specific domains.
A quarterly Teams review checklist
External domains are allowed or blocked deliberately, not left on the default.
Unmanaged Teams accounts cannot start chats with staff.
Guests are reviewed and guest access expiration is set in SharePoint.
The default meeting policy does not let anonymous users bypass the lobby.
Only approved third-party apps are available.
Safe Links and Safe Attachments are on for Teams.
Staff have been reminded that IT will never start a Teams chat asking for codes or remote access.
Usually not. Most businesses need to talk to clients and vendors in Teams. Allowing only the domains you work with gives you the benefit without opening the door to everyone. If that is impractical, block unmanaged accounts and known bad domains.
What is the difference between external access and guest access in Teams?
External access lets people in other organizations chat, call and meet with your users while staying in their own tenant. Guest access adds an outside person to your tenant as a guest so they can join teams and see channel content and files.
Can anonymous users join my Teams meetings?
By default, yes. Anonymous join is on unless you turn it off in the organization-wide meeting settings or the meeting policy. I recommend turning it off for most users and enabling it only for those who host external webinars.
Want a second pair of eyes on your Teams configuration? Book a free Microsoft 365 security assessment and we will review Teams, SharePoint and identity settings together.
Teams has quietly become the second inbox. Clients, vendors and, increasingly, attackers use it to reach your staff. Yet in many tenants the Microsoft Teams security settings are exactly as they were on the day Teams was switched on, which means anyone in any organization can message your people and anyone with a link can join your meetings.
None of this needs a big project. Below are the settings I review every quarter in the Teams admin center, what I recommend for a 20 to 500 person business, and why each one matters.
External access: who can chat with your staff
External access controls chat, calls and meetings with people in other Microsoft 365 organizations, unmanaged Teams accounts and Skype users. By default, Teams allows all external domains. That convenience is also how attackers posing as “IT support” or “Microsoft security” start Teams chats with your users.
Go to
Users > External accessin the Teams admin center and review these options:Microsoft blocks communication with trial-only Teams tenants by default. Leave that in place. Attackers often use throwaway trial tenants for exactly this reason.
If you have Defender for Office 365, Teams admins can also let security admins manage blocked Teams domains from the Tenant Allow/Block List in the Microsoft Defender portal. That puts blocking in the same place your security team already works.
Guest access: who can join your teams
Guest access is different from external access. A guest is added to a team and can see its channels and files. Settings are under
Users > Guest access.Meeting settings: lobby, anonymous join and presenting
Meeting settings are split between organization-wide Meeting settings and per-user Meeting policies under
Meetings. These are the ones to check.Meeting organizers can change several lobby options in their own meeting options. If you need certain meetings locked down regardless, such as board meetings, Teams Premium meeting templates and sensitivity labels can enforce them.
Apps in Teams: what can be installed
Third-party Teams apps can read messages and files once approved. Under
Teams apps > Manage apps, review which apps are allowed and who can install them.App permissions in Teams tie back to Microsoft Entra app consent, so restricting user consent in Entra ID helps here too.
Protecting files and links shared in Teams
Files shared in Teams live in SharePoint and OneDrive, and links in chat can be just as malicious as links in email. If you have Defender for Office 365 Plan 1 or higher, which comes with Business Premium:
Also check the email integration setting under
Teams > Teams settings. Channel email addresses accept mail from outside unless you restrict them to specific domains.A quarterly Teams review checklist
Microsoft documents the external access options in Manage external meetings and chat with people and organizations using Microsoft identities.
Teams settings are part of every Microsoft 365 security assessment we run. If you want Safe Links and Safe Attachments set up properly, see our Defender for Office 365 service. To prepare staff for Teams-based social engineering, our security awareness training covers it directly.
Frequently asked questions
Should I block all external access in Teams?
Usually not. Most businesses need to talk to clients and vendors in Teams. Allowing only the domains you work with gives you the benefit without opening the door to everyone. If that is impractical, block unmanaged accounts and known bad domains.
What is the difference between external access and guest access in Teams?
External access lets people in other organizations chat, call and meet with your users while staying in their own tenant. Guest access adds an outside person to your tenant as a guest so they can join teams and see channel content and files.
Can anonymous users join my Teams meetings?
By default, yes. Anonymous join is on unless you turn it off in the organization-wide meeting settings or the meeting policy. I recommend turning it off for most users and enabling it only for those who host external webinars.
Want a second pair of eyes on your Teams configuration? Book a free Microsoft 365 security assessment and we will review Teams, SharePoint and identity settings together.