CIS.M365.8.2.2: Ensure communication with unmanaged Teams users is disabled

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.8.2.2
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Teams
Feature	External access
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 8.2.2 (L1, E3 Level 1)
Framework controls	cis-m365:8.2.2 nist-800-53-r5:AC-20 Use of External Systems
MITRE ATT&CK	T1566, T1204.001, T1204.002
Reads from	Microsoft Teams

What this checks and how to fix it

8.2.2 (L1) Ensure communication with unmanaged Teams users is disabled

This policy setting controls chats and meetings with external unmanaged Teams users (those not managed by an organization, such as Microsoft Teams (free)).

The recommended state is: People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts set to Off.

Rationale

Allowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account. Some real-world attacks and exploits delivered via Teams over external access channels include:

• DarkGate malware
• Social engineering / Phishing attacks by “Midnight Blizzard”
• GIFShell
• Username enumeration

Impact

Users will be unable to communicate with Teams users who are not managed by an organization. Organizations may choose to create additional policies for specific groups needing to communicate with unmanaged external users.

Note: The settings that govern chats and meetings with external unmanaged Teams users aren’t available in GCC, GCC High, or DOD deployments, or in private cloud environments

Remediation action

To remediate using the UI:

1. Navigate to Microsoft 365 Teams Admin Center.
2. Click to expand External collaboration and select External access.
3. Select the Policies tab
4. Click on the Global (Org-wide default) policy.
5. Set People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts to Off.
6. Click Save.

Note: Configuring this setting at the organization level, in the Organization settings tab, to Off is also a compliant remediation.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerAccess $false

Note: Configuring the organization settings to block communication is also in compliance with this control.

Related links

• Microsoft 365 Teams Admin Center
• IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities
• Midnight Blizzard conducts targeted social engineering over Microsoft Teams
• GIFShell Attack Lets Hackers Create Reverse Shell through Microsoft Teams GIFs
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 512

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: HenrikPiecha; contributors: merill, Mynster9361. Open-source licences.