Tip: Teams lets any outside Microsoft 365 tenant chat and call your staff by default. Switch external access to an allowlist and tell users IT will never cold-message them there

guidance (Arctic Wolf Labs, Oct 26; Microsoft Teams admin settings)2026-10-26

Tip: Teams lets any outside Microsoft 365 tenant chat and call your staff by default. Switch external access to an allowlist and tell users IT will never cold-message them there

Fake help-desk chats from throwaway tenants are behind hundreds of intrusions (see the Arctic Wolf hunt), and they need no vulnerability, just the default setting.

In the Teams admin center, under external access, change from "allow all external domains" to allow only specific domains and list your real partners. If you need open federation, at least block unmanaged Teams accounts.
Tell staff plainly: IT will never start a Teams chat or call from an outside account, and a sender marked External with "(Internal)" in its name is lying.
Pair it with an app-control rule for unsanctioned remote tools (Quick Assist, AnyDesk, ScreenConnect, etc.) and an alert when someone gets a sudden flood of sign-up emails.

Sources: Arctic Wolf Labs: Beyond the Inbox, how threat actors abuse Microsoft Teams external chat for initial access (Oct 26)