How to check external access settings in Microsoft Teams

Before you start

Run the script as a Teams Administrator, in Windows PowerShell 5.1 or PowerShell 7.2 or later. Teams Reader and Global Reader can read the same settings in the Teams admin centre without changing them. Guest access needs no extra Microsoft 365 licence.

An external access policy can narrow these organisation settings for the people it is assigned to. Guest access also depends on settings in Microsoft Entra ID, Microsoft 365 Groups and SharePoint. The examples read the settings and export them; they change nothing.

Option 1

Check external access settings with PowerShell

Install the module once, then connect and export the external access and guest access switches, 1 row for each.

# Install once, if the module is not already installed.
Install-Module -Name MicrosoftTeams -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$external = 'AllowFederatedUsers', 'AllowTeamsConsumer', 'AllowTeamsConsumerInbound',
    'ExternalAccessWithTrialTenants'
$guest = 'AllowGuestUser', 'AllowEmailIntoChannel', 'AllowDropBox', 'AllowBox',
    'AllowGoogleDrive', 'AllowShareFile', 'AllowEgnyte'
Connect-MicrosoftTeams | Out-Null
try {
    $federation = Get-CsTenantFederationConfiguration
    $client = Get-CsTeamsClientConfiguration -Identity Global
    if ($null -eq $federation -or $null -eq $client) {
        Write-Output 'Teams returned no configuration. Check the role of the account you used.'
    } else {
        $report = @(
            foreach ($name in $external) {
                $value = $federation.$name
                [pscustomobject]@{ Area = 'External access'; Setting = $name; Value = "$value" }
            }
            foreach ($name in $guest) {
                $value = $client.$name
                [pscustomobject]@{ Area = 'Guest access'; Setting = $name; Value = "$value" }
            }
        )
        $report | Export-Csv -Path './teams-external-access.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) Teams access settings exported."
    }
} finally {
    Disconnect-MicrosoftTeams
}

AllowFederatedUsers is the master switch: when it is False, no external domain is allowed, whatever the domain lists hold. AllowTeamsConsumer covers Teams accounts no organisation manages, and ExternalAccessWithTrialTenants reads Blocked unless tenants with only trial licences were allowed. Add or remove property names in either list to widen or narrow the export.

List the allowed and blocked domains

Reconnect with Connect-MicrosoftTeams, since the export disconnects, then read the 2 domain lists.

# Run while connected to Microsoft Teams.
$federation = Get-CsTenantFederationConfiguration
$federation | Select-Object -ExpandProperty AllowedDomains
$federation | Select-Object -ExpandProperty BlockedDomains

AllowAllKnownDomains means every domain not on the blocked list is allowed. A list of allowed domains means only those, and the blocked list is then ignored.

Option 2

Review external access in the Teams admin centre

1. Sign in to the Microsoft Teams admin centre for the correct tenant.
2. Go to Users > External access.
3. Read the choice next to Teams and Skype for Business users in external organizations, such as Allow only specific external domains, and the domains it lists.
4. Read People in my organization can communicate with unmanaged Teams accounts, and whether those accounts can contact your people first.
5. Select the Policies tab to see the external access policies that narrow these settings.
6. Go to Users > Guest access and read whether Guest access is on. Leave both pages without selecting Save.

This suits a look at a tenant you already have open. For the trial tenant choice, or a record to keep and compare, use PowerShell or a report.

Common questions

Why can a person still not chat with an allowed organisation?

External access needs both sides. The other organisation must allow yours and turn on external access for its people, and your own person needs an external access policy that allows it. Until then, its people join your meetings as anonymous people.

Does blocking a domain stop its people joining meetings?

Not on its own. People from a blocked domain can still join anonymously when anonymous join is allowed. Each meeting policy sets that with AllowAnonymousUsersToJoinMeeting, so read it in the Global policy and any custom ones.

What is the difference between external access and guest access?

External access lets your people chat and meet with people in other organisations, who get no access to your teams or files. Guest access adds a person to your directory as a guest, so they can join teams and channels. To find your guests, see how to list guest users.