How to Configure Teams External Access and Federation Domains Using PowerShell CsTenantFederationConfiguration

Enterprise collaboration within Microsoft 365 frequently requires communicating with external stakeholders, partner vendors, consultants, and clients. However, allowing unrestricted external communication introduces substantial risks, including corporate data exfiltration, spear phishing, and compliance violations under regulatory standards such as HIPAA, GDPR, or ISO 27001. In Microsoft Teams administration, external communication (federation) is strictly decoupled from Guest Access: external access allows users in foreign Microsoft 365 tenants to find, call, and chat with internal employees without being added as guests to internal Teams channels. Through the Microsoft Teams PowerShell module, administrators can govern tenant-wide external communication policies, manage domain allowlists and blocklists, and restrict consumer Skype connectivity using the CsTenantFederationConfiguration cmdlet suite.

Understanding External Access (Federation) vs Guest Access

It is vital to distinguish between two distinct external communication mechanisms in Microsoft Teams:

• External Access (Federation): Governed by CsTenantFederationConfiguration. Users communicate in direct 1:1 or group chats across tenant boundaries using their native organizational accounts. External users cannot view company files, browse team channels, or access internal SharePoint resources.
• Guest Access: Governed by Entra ID B2B collaboration and CsTeamsGuestCallingConfiguration. External users are invited into the tenant directory, receiving access to specific Teams channels, SharePoint document libraries, and planner boards.

Connecting to Microsoft Teams PowerShell

To configure tenant federation settings, launch an elevated PowerShell session and connect to your tenant using the MicrosoftTeams administrative module:

# Connect with Teams Administrator or Global Administrator privileges
Connect-MicrosoftTeams

Verify that your session is authenticated by querying your active tenant identifier:

(Get-CsTenant).TenantId

Auditing Existing Tenant Federation Settings

To inspect your tenant’s current federation posture and domain restrictions, run:

Get-CsTenantFederationConfiguration | Format-List

Key properties to review include:

• AllowFederatedUsers: Global master toggle enabling or disabling communication with external Microsoft 365 organizations ($true or $false).
• AllowPublicUsers: Governs communication with legacy consumer Skype accounts ($true or $false).
• AllowTeamsConsumer: Governs communication with unmanaged personal Microsoft Teams accounts (Teams for Personal Life).
• AllowedDomains: A list of specific foreign domain names explicitly permitted when operating in allowlist mode.
• BlockedDomains: A list of specific foreign domain names forbidden when operating in blocklist mode.

Configuring an Allowlist-Only Federation Architecture

In highly regulated industries (such as banking, healthcare, or government contracting), tenants should operate in an explicit allowlist posture where external communication is blocked by default, permitting contact only with verified vendor partners.

To establish an allowlist-only federation model:

# Enable federation while disabling unrestricted open discovery
Set-CsTenantFederationConfiguration `
    -AllowFederatedUsers $true `
    -AllowPublicUsers $false `
    -AllowTeamsConsumer $false

# Define the explicit list of trusted partner domains
$Domain1 = New-CsEdgeAllowList -AllowedDomain "partnerconsulting.com"
$Domain2 = New-CsEdgeAllowList -AllowedDomain "legal-advisors.co.uk"

# Apply the allowed domains configuration
Set-CsTenantFederationConfiguration -AllowedDomains @{Add=$Domain1, $Domain2}

Once applied, internal employees can only send chat messages and initiate video calls with users belonging to partnerconsulting.com and legal-advisors.co.uk. All communication attempts with other external domains are rejected automatically.

Adding and Removing Domains from the Allowlist

As corporate partnerships evolve, you can add or remove individual domains dynamically without disrupting existing configurations:

# Add a new vendor domain to the allowlist
$NewDomain = New-CsEdgeAllowList -AllowedDomain "auditfirm.com"
Set-CsTenantFederationConfiguration -AllowedDomains @{Add=$NewDomain}

# Remove a decommissioned partner domain from the allowlist
$OldDomain = New-CsEdgeAllowList -AllowedDomain "legal-advisors.co.uk"
Set-CsTenantFederationConfiguration -AllowedDomains @{Remove=$OldDomain}

To inspect the updated allowlist:

(Get-CsTenantFederationConfiguration).AllowedDomains.AllowedDomain

Configuring an Open Federation with Blocked Domains

If your organization prefers an open communication model allowing collaboration with all global tenants, but needs to blacklist known competitors or malicious domains, switch to a blocklist posture.

# Clear any existing allowed domains to return to open mode
Set-CsTenantFederationConfiguration -AllowedDomains $null

# Add hostile or competitor domains to the BlockedDomains list
$BlockedDomain = New-CsEdgeDomainPattern -Domain "suspicious-entity.com"
Set-CsTenantFederationConfiguration -BlockedDomains @{Add=$BlockedDomain}

Note: A tenant can operate using an AllowedDomains list or a BlockedDomains list, but cannot enforce both simultaneously. Populating AllowedDomains automatically restricts communication strictly to that list.

Completely Disabling External Federation for Sovereign Environments

For sovereign or air-gapped corporate environments requiring zero external communication:

Set-CsTenantFederationConfiguration `
    -AllowFederatedUsers $false `
    -AllowPublicUsers $false `
    -AllowTeamsConsumer $false

To verify the final security posture across all federation toggles:

Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowPublicUsers, AllowTeamsConsumer

Enforcing disciplined external access through CsTenantFederationConfiguration protects organizational assets, shuts down external attack surfaces, and guarantees compliance across Microsoft Teams enterprise environments.