---
title: Tip: Teams lets any outside Microsoft 365 tenant chat and call your staff by default. Switch external access to an allowlist and tell users IT will never cold-message them there | ctxsec
url: https://ctxsec.com/items/tip-teams-external-access-allowlist
description: ""
status: "guidance (Arctic Wolf Labs, Oct 26; Microsoft Teams admin settings)"
published: 2026-10-26
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-teams-external-access-allowlist.md)

guidance (Arctic Wolf Labs, Oct 26; Microsoft Teams admin settings)

2026-10-26

### Tip: Teams lets any outside Microsoft 365 tenant chat and call your staff by default. Switch external access to an allowlist and tell users IT will never cold-message them there

Fake help-desk chats from throwaway tenants are behind hundreds of intrusions (see the [Arctic Wolf hunt](/items/hunt-teams-external-chat-it-support-arctic-wolf-400-incidents)), and they need no vulnerability, just the default setting.

1. In the Teams admin center, under external access, change from "allow all external domains" to **allow only specific domains** and list your real partners. If you need open federation, at least block unmanaged Teams accounts.
2. Tell staff plainly: IT will never start a Teams chat or call from an outside account, and a sender marked **External** with "(Internal)" in its name is lying.
3. Pair it with an app-control rule for unsanctioned remote tools (Quick Assist, AnyDesk, ScreenConnect, etc.) and an alert when someone gets a sudden flood of sign-up emails.

Sources: [Arctic Wolf Labs: Beyond the Inbox, how threat actors abuse Microsoft Teams external chat for initial access (Oct 26)](https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/)