Microsoft Teams External Access

Microsoft Teams External Access can be configured in different places that include Azure AD, Microsoft 365 (Office 365), Teams, and SharePoint admin centers.

Microsoft Teams external access not working

There may be a number of reasons why Microsoft Teams external access not working. This article gives you details on how to configure various elements such as Azure Active Directory, Microsoft 365 (Office 365) Sharing controls, Microsoft Teams External and Guest Access settings and of course the repository of all files, folders and lists that make up teams’ content; SharePoint and OneDrive.

The best way to resolve external access not working is to check the configuration of the following admin centers in the order they appear below, in order to see if they’re configured for external access to work:

• Azure Active Directory (AAD).
• Microsoft 365 (Office 365)
• Microsoft Teams
• SharePoint

If you find that the settings are correctly set, then it’s possible your external access not working might be caused by not having enough licenses. Bear in mind that Microsoft Teams free licenses do not support external access.

The details of configuring these for your desired Sharing options are given below.

Microsoft Teams External access vs Guest access

Microsoft Teams has two options that allow you to communicate and collaborate with people outside your organization. The options are External Access and Guest Access.

1. External access – A type of federation that allows users to find, call, and chat with people in other organizations. These people cannot be added to teams unless they are invited as guests.
2. Guest access – Guest access allows you to invite people from outside your organization to join a team. Invited people get a guest account in Azure Active Directory.

Note that Teams allows you to invite people outside your organization to meetings. This does not require external or guest access to be configured.

External Access (Federation)

Set up external access if you need to find, call, chat, and set up meetings with people outside your organization who use Teams, Skype for Business (online or on premises) or Skype.

By default, external access is enabled for all domains. You can restrict external access by allowing or blocking specific domains or by turning it off.

Please Note: Microsoft Teams free licenses do not support external access.

To configure external access, see Manage external access.

Guest Access

Use guest access to add a person from outside your organization to a team, where they can chat, call, meet, and collaborate on files. A guest can be given nearly all the same Teams capabilities as a native team member. For more information, see Guest experience in Teams.

Guests are added to your organization’s Azure Active Directory as B2B users and must sign in to Teams using their guest account. This means that they may have to sign out of their own organization to sign in to your organization.

To configure guest access for Teams, see Collaborate with guests in a team.

For more information Compare external and guest access

How to enable external access in Teams

Manage external collaboration in Azure Active Directory (AAD)

Azure Active Directory (AAD) is the directory service used by Microsoft 365. AAD organizational relationships settings directly affect sharing in Teams, Microsoft 365 Groups, SharePoint, and OneDrive.

In Azure AD, the settings for guest invitations, control the guest experience at the directory, tenant, and application levels.

Configure external collaboration in Azure AD admin center

1. Sign in to the Azure portal as a tenant administrator.
2. Select Azure Active Directory.
3. Select User settings > Manage external collaboration settings.
4. Under Guest user access restrictions, choose the level of access you want guest users to have:
   1. Guest users have the same access as members (most inclusive): This option gives guests the same access to Azure AD resources and directory data as member users.
   2. Guest users have limited access to properties and memberships of directory objects: (Default) This setting blocks guests from certain directory tasks, like enumerating users, groups, or other directory resources. Guests can see membership of all non-hidden groups.
   3. Guest user access is restricted to properties and memberships of their own directory objects (most restrictive): With this setting, guests can access only their own profiles. Guests are not allowed to see other users’ profiles, groups, or group memberships.
5. Under Guest invite settings, choose the appropriate settings:
   1. Anyone in the organization can invite guest users including guests and non-admins (most inclusive): To allow guests in the organization to invite other guests including those guests who are not members of an organization, select this radio button.
   2. Member users and users assigned to specific admin roles can invite guest users including guests with member permissions: To allow member users and users who have specific administrator roles to invite guests, select this radio button.
   3. Only users assigned to specific admin roles can invite guest users: To allow only those users with administrator roles to invite guests, select this radio button. The administrator roles include Global Administrator, User Administrator, and Guest Inviter.
   4. No one in the organization can invite guest users including admins (most restrictive): To deny everyone in the organization from inviting guests, select this radio button.
6. Under Enable guest self-service sign up via user flows, select Yes if you want to be able to create user flows that let users sign up for apps.
7. Under Collaboration restrictions, you can choose whether to allow or deny invitations to the domains you specify and enter specific domain names in the text boxes. For multiple domains, enter each domain on a new line.

Azure portal > Azure Active Directory > User settings > Manage external collaboration setting > Guest user access restrictions > Guest invite settings > Enable guest self-service sign up via user flows > Collaboration restrictions.

Manage external collaboration in Microsoft 365

Microsoft 365 Admin Center (Office 365 Admin Center) has tenant-level settings for Sharing and for Microsoft 365 Groups.

Configure external sharing settings in Microsoft 365

Navigation:

Microsoft 365 admin center > Settings > Org settings > Security & Privacy tab > Sharing

Setting	Default	Description
Let users add new guests to the organization	On	When set to Yes, Azure AD members can invite guests via Azure AD; when set to No, they cannot. When set to Yes, Microsoft 365 Group members can invite guests with owner approval; when set to No, Microsoft 365 Group members can invite guests with owner approval but owners must be global administrators to approve. Note that Members can invite refers to members in Azure AD (as opposed to guests) and not to site or group members in Microsoft 365. This is identical to the Members can invite setting in Azure Active Directory Organizational relationships settings.

Microsoft 365 Groups settings

Navigation: 

Microsoft 365 admin center > Settings > Org settings > Microsoft 365 Groups

These settings are at the organization level.

Setting	Default	Description
Let group members outside your organization access group content	On	When set to On, guests can access groups content; when set to Off, they can’t. This setting should be On for any scenario where guests are interacting with Microsoft 365 Groups or Teams.
Let group owners add people outside your organization to groups	On	When On, Owners of Microsoft 365 Groups or Teams can invite new guests to the group. When Off, owners can only invite guests who are already in the directory.

For information about how to change these settings at the group level by using PowerShell, See Create settings for a specific group 

Manage external access in Microsoft Teams

This section shows how to configure Microsoft Teams chat with external users.

Configure External Access

1. Log in with your Teams Admin credentials at Microsoft Teams Admin Center https://admin.teams.microsoft.com
2. In the left navigation pane, go to Users > External access.
3. Under Choose which domains your users have access to section, configure the setting based on business need.
   1. To allow specific domains:
      1. Select Allow only specific external domains.
      2. Select Allow domains.
      3. In the Domain box, type the domain that you want to allow and then select Done.
      4. If you want to allow another domain, select Add a domain.
   2. To block specific domains:
      1. Select Block only specific external domains.
      2. Select Block domains.
      3. In the Domain box, type the domain that you want to allow and then select Done.
      4. If you want to block another domain, select Add a domain.
4. Turn on the Allow users in my organization to communicate with Skype users setting if you want to allow Teams users in your organization chat with and call Skype users. .
5. Select Save.

Make sure the administrator in the other Microsoft Teams organization completes these same steps. For example, in their allowed domains list, their administrator needs to enter the domain for your business if they limit the organizations that can communicate with their users.

After the configuration, you can chat with external users using their email address and adding them as a contact. You can verify if federation is working by sending a chat message to an external user via Teams chat and getting a response.

Manage Guest Access in Microsoft Teams

Guest access allows you to provide access to teams, documents in channels, resources, chats, and applications to people outside your organization, while still maintaining control over your corporate data.

Please Note:
If you just want to find, call, chat, and set up meetings with people in other organizations, use external access. External access is a way for Teams users from an entire external domain to find, call, chat, and set up meetings with you in Teams.
You can also use external access to communicate with people from other organizations who are still using Skype for Business (online and on-premises) and Skype (in preview).

A guest is someone who isn’t an employee, student, or member of your organization. They don’t have a school or work account with your organization. For example, guests may include partners, vendors, suppliers, or consultants. Anyone who isn’t part of your organization can be added as guest in Teams.

This means that anyone with a business account (that is, an Azure Active Directory account) or consumer email account (with Outlook.com, Gmail.com or others) can participate as a guest in Teams, with access to teams and channel experiences.

Guests in Teams are covered by the same compliance and auditing protection as the rest of Microsoft 365. Guest access is subject to Azure AD and Microsoft 365 service limits. As a Teams administrator, you have full control over which features and services a guest can or can’t have access to.

Important!
Even if you activate Guest access in Teams, you must also ensure that Guest access is enabled in Azure AD.

Configure Microsoft Teams external guest access

Use Teams admin center

1. Sign in to the Microsoft Teams admin center.
2. Select Users > Guest access.
3. Set Allow guest access in Teams to On.
4. Under Calling, Meeting, and Messaging, select On or Off for each capability, depending on what you want to allow for guest users.
5. Select Save.

Use PowerShell

You can also use PowerShell to toggle guest access with Set-CsTeamsClientConfiguration cmdlet. For example, to allow guest users globally, run the following cmdlet:

Set-CsTeamsClientConfiguration -AllowGuestUser $True -Identity Global

Then you can use the following cmdlets to customize the guest access settings:

Set-CsTeamsGuestCallingConfiguration
Set-CsTeamsGuestMeetingConfiguration
Set-CsTeamsGuestMessagingConfiguration

Manage file sharing in SharePoint

Teams content like files, folders, and lists are all stored in SharePoint. In order for guests to have access to these items in Teams, the SharePoint Tenant-level sharing settings must allow for sharing with guests.

The organization-level settings determine what settings are available for individual sites, including sites associated with teams. Site settings can’t be more permissive than the organization-level settings.

If you want to allow file and folder sharing with unauthenticated people, choose Anyone. If you want to ensure that all guests have to authenticate, choose New and existing guests. Choose the most permissive setting that will be needed by any site in your organization.

Configure File Sharing in SharePoint

To configure the file sharing settings, go to:

 SharePoint Admin Center > Policies > Sharing.

External sharing settings

Because OneDrive is a hierarchy of sites within SharePoint, the organization-level sharing settings directly affect OneDrive just as they do other SharePoint sites.

Setting	Default	Description
SharePoint	Anyone	Specifies the most permissive sharing permissions allowed for SharePoint sites.
OneDrive	Anyone	Specifies the most permissive sharing permissions allowed for OneDrive sites. This setting cannot be more permissive than the SharePoint setting.

The options for sharing permissions include:

• Anyone: Allows users to share files and folders by using links that let anyone who has the link, access the files or folders without authenticating. This setting also allows users to share sites with new and existing guests who authenticate. If you select this setting, you can restrict the Anyone links so that they must expire within a specific number of days, or so that they can give only View permission.
• New and existing guests: Requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization’s directory, and they can send invitations to people who will be added to the directory if they sign in.
• Existing guests: Allows sharing only with guests who are already in your directory. These guests may exist in your directory because they previously accepted sharing invitations or because they were manually added, such as through Azure B2B collaboration.
• Only people in your organization: Turns off external sharing.

Advanced sharing settings

Setting	Default	Description
Limit external sharing by domain	Off	This setting allows you to specify a list of allowed or blocked domains for sharing. When allowed domains are specified, then sharing invitations can only be sent to those domains. When denied domains are specified, then sharing invitations cannot be sent to those domains. This setting affects all SharePoint and OneDrive sites in the organization.
Allow only users in specific security groups to share externally	Off	If you want to limit who can share with guests in SharePoint and OneDrive, you can do so by limiting sharing to people in specified security groups. These settings do not affect sharing via Microsoft 365 Groups or Teams. Guests invited via a group or team would also have access to the associated site, though document and folder sharing could only be done by people in the specified security groups. For each specified group, you can choose if those users can share with Anyone links.
Guests must sign in using the same account to which sharing invitations are sent	Off	Prevents guests from redeeming site sharing invitations using a different email address than the invitation was sent to. SharePoint and OneDrive integration with Azure AD B2B does not use this setting because all guests are added to the directory based on the email address that the invitation was sent to. Alternate email addresses cannot be used to access the site.
Allow guests to share items they don’t own	On	When On, guests can share items that they don’t own with other users or guests; when Off they cannot. Guests can always share items for which they have full control.
Guest access to a site or OneDrive will expire automatically after this many days	off	This setting allows you to create a policy that revokes guest access to documents and files after a set number of days.
People who use a verification code must reauthenticate after this many days	Off	This setting allows you to require that users authenticating with a one-time passcode need to reauthenticate after a certain number of days.

Related Posts: Microsoft Admin Portals