---
name: Teams External Access and Guest Audit
description: Audit Microsoft Teams external access, federation, and guest sharing settings that widen the collaboration and Copilot surface.
---

# Teams External Access and Guest Audit

> **TL;DR:** This skill audits Microsoft Teams external access (federation), guest access, and sharing settings, then ranks each finding by exposure risk so administrators can tighten the collaboration and Copilot surface.

## What does the Teams external access and guest audit cover?

This skill reviews how Microsoft Teams connects to people outside the organisation through external access (federation) and guest access. It reads the federation configuration, allowed and blocked domains, guest permissions, and the guest sharing posture surfaced through Microsoft Entra ID. Because Teams chats, channels, and files feed Microsoft 365 Copilot grounding, an over-permissive external posture can widen the effective answer surface, so this audit helps keep collaboration least-privilege and compliant.

## When should you run this skill?

- "Audit Teams external access and federation settings"
- "Check which external domains can chat with our staff"
- "Review guest access permissions in Microsoft Teams"
- "Find out if anyone can federate with our tenant"
- "Tighten the Teams collaboration surface before a Copilot rollout"
- "Produce evidence of our Teams guest sharing posture"

## How this skill works, step by step

1. Read the tenant external access (federation) policy to determine whether external access is open to all domains, restricted to an allow list, or blocked.
2. Enumerate allowed and blocked domains and flag any allow-all configuration.
3. Read the guest access policy to confirm whether guest access is enabled and which capabilities guests inherit.
4. Inspect guest permissions for calling, meeting, screen sharing, and chat features that broaden exposure.
5. Resolve the count and source domains of current guest accounts through Microsoft Entra ID.
6. Cross-reference allowed external domains against the approved partner list.
7. Compute risk: High (open federation or unapproved guest domains), Medium (allow list present but stale or broad guest permissions), Low (restricted federation with approved guests only).
8. Produce the table below with a recommended action per finding.

## Output format

| Setting | Current Value | Scope | Approved? | Risk | Action |
| --- | --- | --- | --- | --- | --- |
| External access (federation) | Open to all external domains | Tenant-wide | No | High | Restrict to approved partner domains |
| Guest access | Enabled, screen sharing allowed | Tenant-wide | Partial | Medium | Review guest meeting permissions |

Followed by a summary:

- External access mode: open, allow-list, or blocked
- Allowed external domains: N
- Active guest accounts: N
- Guest source domains outside the approved list: N
- High-risk findings: N

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Read Teams external access and guest policies | Microsoft 365 E3 or E5 |
| Resolve guest accounts and source domains via Microsoft Entra ID | Microsoft Entra ID P1 |

### Least-privilege roles

- Global Reader (read-only tenant-wide visibility)
- Teams Administrator (read) where Teams admin centre policies are reviewed

### Microsoft Graph permissions (read-only)

- `User.Read.All` - enumerate guest accounts and their source domains
- `Directory.Read.All` - resolve external (guest) principals and tenant directory settings
- (Teams external access and guest policies are administered through the Teams admin centre and Microsoft Teams PowerShell; read them with `Get-CsTenantFederationConfiguration` and `Get-CsTeamsClientConfiguration`)

## Scope and safety

This skill is read-only by default and takes no destructive actions. It does NOT:

- Change federation, external access, or guest policies (read-only)
- Remove or disable guest accounts
- Email or notify external users or guests
- Inspect chat, channel, or file contents

## Sources and compliance

- [Manage external access (federation) in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/manage-external-access)
- [Guest access in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/guest-access)
- Supports Essential Eight Maturity Level 2 evidence for Restrict administrative privileges and the user access governance trail
- Pair with External Sharing Deep Audit for a complete external-exposure picture
- Run quarterly as part of the collaboration governance cadence
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English