Can anyone with Teams just message my employees?

By default, yes: external access in Teams is open to every organisation that uses Teams, and often to personal Teams accounts too. A list of allowed domains or blocking personal accounts restricts that.

What is the difference between external access and guest access in Teams?

A guest is invited into your own environment so they can work in your teams and files. With external access everyone stays in their own environment and people can only chat, call and meet.

Can external parties still join our meetings if we restrict external chat?

Yes. Anyone who receives an invitation link can join a Teams meeting, possibly through the lobby. Restricting external access is about chat and direct calls.

What should an employee do after receiving a suspicious Teams message?

Not reply, not install anything and not let anyone take a look, but block the sender and report it to your own helpdesk through the usual channel. Floor ICT can then block the domain and check whether colleagues received the same message.

External chat in Teams: when an SME should restrict messages from unknown organisations

An employee gets a Teams message from ‘IT Support’: there is a problem with their mailbox, can someone take a quick look? The message does not come from your own helpdesk but from some random organisation with a Teams account. That is possible because Teams is open to chats with other organisations by default.

Why external chat in Teams has become a way in

Email now comes with filters, warning banners and quarantine. A Teams chat message feels more familiar to most employees: it arrives in the same app they use to talk to colleagues. Attackers take advantage of that. Microsoft and security researchers have described attacks in which someone poses as the helpdesk through a Teams chat from another organisation, often after first flooding the victim’s mailbox with hundreds of spam messages. The ‘fix’ is then a remote support tool, and with that the attacker has access to the laptop.

Teams does show an External label on such messages and often asks on a first message whether you want to accept or block it. Under time pressure, an employee clicks through anyway, especially when the sender’s name looks official.

External access or guest access: the difference

Teams has two ways to work with people outside your organisation. With guest access you invite someone into your own environment; that person can then join your teams and channels and open files. Read more in our article on guest accounts in Microsoft 365. With external access everyone stays in their own environment, but people can find each other, chat, call and meet. That is switched on by default for every organisation that uses Teams.

The settings to choose from

allow all external domains: the default; any organisation with Teams can reach your employees, except domains you explicitly block;
allow only specific domains: you put the domains of regular customers, suppliers and partners on a list; all other organisations can no longer reach your employees through Teams;
block specific domains: everything stays open except organisations on a block list; that only helps after a domain has already been abused;
personal Teams accounts: separately, you decide whether employees may communicate with personal Teams accounts that no organisation manages, and whether those accounts may start a conversation themselves.

These settings live in the Teams admin centre under external access. You can set them for the whole organisation or with separate policies per group, for example more open for the sales team than for finance.

Which choice fits your organisation

If you mainly use Teams with a manageable group of customers and suppliers, a list of allowed domains is the safest choice. An unknown ‘helpdesk’ simply cannot get in. The downside is that a new partner can only chat once someone has added their domain, so agree who may do that and how quickly it happens.

If you work with many changing external contacts, for example as a consultancy or in sales, keep external access open but switch off contact with personal Teams accounts. Combine that with clear agreements and security awareness training, so employees take the External label seriously. Meetings with external attendees remain possible in both cases through an invitation link.

How to approach it

take stock: check which external organisations your employees have actually chatted with in Teams over the past months;
choose the setting: a list of allowed domains, or open with personal accounts blocked;
assign ownership: decide who may add new domains and how an employee requests one;
agree a helpdesk rule: your own helpdesk or IT partner never asks through an external chat to take a look or install a tool;
round it off: also switch on the external email warning banner, so email and chat give the same signal.

A common mistake

Switching external access off entirely looks like the quickest fix, but then regular partners can no longer chat or call either, and employees move to WhatsApp or personal email. You have even less visibility there. A short list of allowed domains protects better and keeps work workable.

What Floor ICT sets up

Floor ICT, as a managed service provider, maps which organisations your employees work with through Teams, configures external access and contact with personal accounts accordingly and sets up separate policies per department where needed. We record who adds new domains, make sure your employees know how our helpdesk does and does not contact them, and review the settings periodically. You decide which partners are on the list.