Teams external access vs guest access: what each one allows

External access in Microsoft Teams lets your users chat and meet with people from other organizations who keep their own identity. Those people get no access to your teams, sites or files. Guest access is the separate feature that adds an outsider to a team as a guest account. Treat them as two decisions.

What external access does

With external access, your users can chat and meet with people outside the organization who use Microsoft as an identity provider. That covers other Microsoft 365 organizations (chat and meetings), unmanaged Teams accounts (chat only) and Skype users (chat only).

Microsoft is explicit that these outside people do not get access to your teams, sites or other Microsoft 365 resources. If you want that, you need guest access or a shared channel.

The default is open

By default all external domains are allowed, and both the organization setting and the user policies are turned on. A user can use external access only if the organization setting and the user policy both allow it.

You have four domain choices: allow all, allow only listed domains, block listed domains, or block all external domains. If you list blocked domains, everything else is allowed. If you list allowed domains, everything else is blocked. Blocking a domain does not block its subdomains unless you set the block all subdomains option in PowerShell.

The other side has to agree too. The external organization must also trust your domain, and its users must be enabled for external access.

Unmanaged accounts and trial tenants

Chat with unmanaged Teams accounts, the free consumer kind, is its own switch. You can allow your users to chat with them while stopping them from starting conversations with you, which keeps your users from being found by email address.

Federation with trial only tenants is blocked by default. You can change that in PowerShell, but ask whether you need to.

Meetings are a third setting

Even if you block a domain, people from that domain can still join a meeting anonymously if anonymous access is allowed. Blocking external access is not the same as controlling who joins a meeting. The meeting lobby and the anonymous participant settings do that work.

A reasonable small company setup

1. Decide whether you need open federation. If you work with a handful of partners, an allow list is simple to keep.
2. Leave unmanaged Teams account chat off unless there is a reason.
3. Use user policies to limit external access to the people who need it, by turning off the org wide default and assigning a custom policy.
4. Review the blocked user list option if you ever need to cut off one address.
5. Set guest access separately, through your Entra guest invite settings.

Safeguard's asset discovery can help you see which SaaS tenants and apps your people use, which is a useful input when deciding which partner domains deserve an allow list entry.

Quick check

Sources

• Manage external meetings and chat with people and organizations using Microsoft identities

Last reviewed: 19 October 2026.