Microsoft Teams: Tenant Federation setting to control external access with trial-only tenants

Coming soon to Microsoft Teams: We are introducing a new admin control to enable you to block external access (federation) with Teams trial-only tenants. Some malicious actors have used free Teams trials to launch phishing or abuse attacks against Teams users. With this setting you can add another layer of protection for users against some of these attacks.

By default, this new setting will block external access with trial-only tenants 30 days after the rollout is complete and will require explicit action from you if you wish to continue to federate with trial tenants.

When this will happen:

General Availability (Worldwide): Available now.

Blocking external access with trial-only tenants based on this setting will occur on July 29, 2024. If you take no action, the default value (Blocked) will be applied.

How this will affect your organization:

Teams PowerShell will support a new Tenant Federation setting -ExternalAccessWithTrialTenants with the values Allowed or Blocked. When set to Blocked, all external access with users from Teams subscriptions that contain only trial licenses will be blocked. This means users from these trial-only tenants will not be able to search or reach your users via chats, Teams calls, and meetings (using the users' authenticated identity) and your users will not be able to reach users in these trial-only tenants. If this setting is set to Blocked, users from the trial-only tenant will also be removed from any existing chats. The default setting will be to block external access with trial-only tenants.

Important Notes

• A "trial-only" tenant is defined as a tenant with a Teams service plan that has only Trial subscriptions (0 purchased licenses).
• Shared Channels, Guest access and Anonymous Meeting joins will not be affected by this setting.
• This new setting only controls external communication with trial-only tenants within the same Microsoft 365 cloud environment. When enforcement starts, users from trial-only tenants will be blocked by default from external communication with users in other Microsoft 365 cloud environments and with Microsoft Skype for Business server users. No admin control will exist to allow cross-cloud external communication with trial tenants.
• If your tenant has enabled Allow only specific domains and specified domains in the Allow list, and if -ExternalAccessWithTrialTenants is set to Blocked, trial-only tenants in the Allow list will be blocked. If this setting is set to Allowed, all domains in the Allow list will be allowed.
• If your tenant has enabled Block all external domains, the -ExternalAccessWithTrialTenants setting has no impact.
• If your tenant has enabled Block specific domains and specified domains in the Block list, and if the -ExternalAccessWithTrialTenants setting is set to Blocked, trial-only tenants not in the Block list will also be blocked. If set to Allowed, this setting has no impact.

What you need to do to prepare:

Review your settings for external access to determine if you need to change the default value for this new setting. To change this setting, install the latest PowerShell package (6.4.0) and use the Set-CsTenantFederationConfiguration command to set the desired value when the setting is available:

1. Download or upgrade to the latest PowerShell package: https://www.powershellgallery.com/packages/MicrosoftTeams/
2. To allow external communication with trial-only tenants, use this command: Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Allowed"
3. To block external communication with trial-only tenants, use this command: Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked"

Learn more

• PowerShell cmdlet configuration: Set-CsTenantFederationConfiguration | Microsoft Learn
• Manage external communication: IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities

You may want to notify your admins about this change and update any relevant documentation as appropriate.