> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/teams/external-access-policies.md). # External access policies An **External access policy** controls, per policy, whether the users it's assigned to can communicate with external Teams organizations, unmanaged (consumer) Teams accounts, Skype users, and Azure Communication Services. It's one of the five Teams policy types on the **Policies** tab; see Teams for the tab layout, assignment precedence, and template/baseline workflow shared by every policy type. {% hint style="info" %} Teams is a licensed feature. If a client isn't authorized for it, the page shows a notice asking you to contact **** instead of the usual controls. {% endhint %} ## Configuration surface ### Policy details * **Description** ### External Teams organizations * **Communicate with external Teams organizations** — the master toggle for federation on this policy. * **External domain access** — a dropdown of five states, in this exact order: *Use organization settings* / *Allow all external domains* / *Allow only specific external domains* / *Block only specific external domains* / *Block all external domains*. * **Allowed external domains** — populated only when the mode above is "Allow only specific." * **Blocked external domains** — populated only when the mode above is "Block only specific." * **Restrict external group chats to two organizations** (federated bilateral chats). ### Unmanaged Teams accounts * **Communicate with unmanaged Teams accounts** (consumer/personal Teams). * **Allow unmanaged Teams accounts to start conversations** (inbound). ### Skype users * **Audio and video with Skype users** (public cloud audio/video access). ### Azure Communication Services * **Azure Communication Services federation**. ### Other external access * **Access Skype for Business Server from the internet**. * **SMS text messaging in Teams**. {% hint style="warning" %} **"Use organization settings" is the fallback, not a no-op.** When a policy's External domain access is set to that first option, the users it's assigned to inherit the tenant-wide federation configuration instead — see Settings → External federation. A per-policy override at any of the other four states always wins for the users assigned to it; the tenant-wide setting only applies where no more specific policy overrides it. {% endhint %} ## How the domain lists actually work The **External domain access** dropdown isn't a free-standing field internally — Microsoft encodes it as a numeric mode (`CommunicationWithExternalOrgs`, `0`–`4`, matching the order above) plus two plain domain-string arrays (`AllowedExternalDomains`, `BlockedExternalDomains`). The mode and the populated list have to agree: a populated list is only valid with mode `2` (allow-specific) or `3` (block-specific); the other three modes require both lists empty. Augmentt validates this combination before sending the write — Microsoft's API accepts a mismatched combination and silently drops the list, so catching it client-side is the only way an admin learns the change didn't do what it looked like. This is a materially simpler encoding than the tenant-wide federation settings use — see Settings for why `TenantFederationSettings` needs a very different (and much trickier) domain representation. ## Built-in and default policies Microsoft ships three built-in external access policies — `NoFederationAndPIC`, `FederationOnly`, and `FederationAndPICDefault`. Augmentt recognizes all three as Microsoft-managed: **Edit** and **Delete** are disabled with an explanation rather than being sent to Microsoft and failing. `Global` is the tenant's baseline custom policy and also can't be deleted. Augmentt doesn't ship any preset external access policy content of its own — there's no seed/migration data defining an Augmentt-authored external access policy template. Every **Policy Template** in the Templates tab is created by an MSP from an existing tenant policy — see Templates and Baselines. ## Posture-check resolution This is the one Teams policy type with a real posture-check tie-in, though it's aimed at the tenant-wide default rather than individual policies. **Teams Default External/Guest Options** (`teamsdefaultexternaloptions`) appears in Secure Score, and is mapped into two compliance frameworks: * **CISA SCUBA** — "External access for users SHALL only be enabled on a per-domain basis": the check wants federation limited to an explicit allowlist rather than open to all domains. * **CMMC** — mapped to control **AC.L1-b.1.iii** (External Connections) at Level 1 and **AC.L2-3.1.20** (Control Teams External Access) at Level 2: controlling default external and guest options in Teams to verify and limit connections to external systems. The check reads the tenant-wide federation and guest configuration — the same source data behind Settings → External federation — not the per-policy `ExternalAccessPolicy` objects covered on this page. A client can have a wide-open custom External access policy assigned to a group while still passing this check if the tenant default (`TenantFederationSettings`) is locked down, because the check doesn't currently evaluate per-policy overrides. Flag that gap for clients who lean on custom External access policies rather than the tenant default. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/teams/external-access-policies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.