Teams External Access & Federation

The question it answers: Can users in other organisations, or personal Teams accounts, chat with and call users in this tenant?

Can anyone in any Microsoft 365 organisation - or any personal Teams account - start a chat with your users? That open door is how Teams phishing and fake help-desk calls reach people. This checks external access, personal accounts, trial tenants and who walks straight into meetings.

Note

Only the Global policies are read - users assigned a different external access or meeting policy can be more or less restricted. The MicrosoftTeams module runs in the same PowerShell runspace as PnP and Microsoft Graph PowerShell.

At a glance

Where in the app	Tenant › Teams External Access
Workload	Teams and collaboration
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	The MicrosoftTeams PowerShell module must be installed on the web server (Install-Module MicrosoftTeams).
Report id (API and MCP)	tenant.teams.external-access

Columns

Column	Key	Type
Severity	Severity	Status
Area	Category	Text
Subject	Subject	Link
Setting	Setting	Text
Current value	Value	Text
Assessment	Finding	Text
Detail	Detail	Text
Date	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: The MicrosoftTeams PowerShell module must be installed on the web server (Install-Module MicrosoftTeams).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Organization.Read.All	Microsoft Graph	Read organization information

Roles and other setup:

• Directory role for the app: Teams Administrator (Global Reader may be enough for the Get-Cs cmdlets)

Data sources it reads

• Connect-MicrosoftTeams (certificate)
• Get-CsTenantFederationConfiguration
• Get-CsTeamsMeetingConfiguration
• Get-CsTeamsMeetingPolicy -Identity Global
• Get-CsTeamsClientConfiguration

Through the API and MCP

GET /ir-api/v1/reports/tenant.teams.external-access?size=100

An AI assistant reads it with the MCP tool get_report and the id tenant.teams.external-access. The client needs the Read grant for Teams and collaboration. See Using the API.