> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/teams/settings.md). # Settings The **Settings** tab covers tenant-wide Microsoft Teams configuration that isn't a per-user policy — the equivalent of the Teams admin center's org-wide settings plus the guest-access side of Entra ID. See Teams for how this tab relates to Policies and Templates. {% hint style="info" %} Teams is a licensed feature. If a client isn't authorized for it, the page shows a notice asking you to contact **** instead of the usual controls. {% endhint %} ## Configuration surface Selecting **Modify** opens every section below in one editable form. Unlike Policies (which read/write through Teams PowerShell's records API), most Settings sections are Microsoft Graph objects — the data comes from wherever Microsoft actually exposes it, which isn't always a `Cs*` cmdlet. ### Guest access Backed by Entra ID's `AuthorizationPolicy`. * **Who can invite guests** (`allowInvitesFrom`) — *No one* / *Admins and Guest Inviters* / *Admins, Guest Inviters, and members* / *Everyone, including guests*. ### External federation Backed by `TenantFederationSettings`. * **Allow communication with external organizations** (`AllowFederatedUsers`) — the master toggle. * **External domain access** — *Allow all domains* / *Allow only specific domains* / *Block only specific domains* / *Block all domains*. * **Domains** — the allow- or block-list, one domain per line, populated only for the two "specific" modes. {% hint style="warning" %} This is tenant-wide. `Use organization settings` is the default an External access **policy** falls back to (see External access) — a per-policy override always wins for the users it's assigned to; the setting here only applies where no more specific policy overrides it. {% endhint %} {% hint style="danger" %} **Do not treat an empty domain list as "no restriction."** Internally, Microsoft encodes "allow all domains" and "block all domains" using the *same* empty list — the two states are distinguished only by whether the allow-list wrapper key is present at all, never by a value in it. Augmentt passes this shape through to Microsoft verbatim rather than normalizing it, specifically because any code that treats an empty list as "unset" would silently flip block-all into allow-all — the worst possible direction for a security control. This is invisible in the UI (Augmentt's edit form always shows the plain four-option dropdown above), but worth knowing if you ever see the raw values while troubleshooting with support. {% endhint %} ### Guest meeting permissions Backed by `TeamsGuestMeetingConfiguration`. * **IP video** (video calling for guests) * **Screen sharing mode** * **Multiple screen sharing** * **Meet now** * **Live captions** * **Transcription** * **Participants can give or request control** * **External participants can give or request control** ### Guest messaging permissions Backed by `TeamsGuestMessagingConfiguration`. * **Edit sent messages** * **Delete sent messages** * **Delete bot messages** * **Delete chats** * **Chat** * **Giphy** * **Giphy content rating** * **Memes** * **Immersive Reader** * **Stickers** ### Guest calling permissions Backed by `TeamsGuestCallingConfiguration`. * **Private calling** ### Org-wide app settings Backed by Microsoft Graph's `teamwork/teamsAppSettings` (delegated Graph, not a `Cs*` cmdlet). * **User requests for app access** (`allowUserRequestsForAppAccess`) * **User consent for personal apps** (`isUserPersonalScopeResourceSpecificConsentEnabled`) ### Team creation Backed by Entra ID's `Group.Unified` directory setting (Graph `groupSettings`), not a Teams-specific object. * **Group and team creation** (`EnableGroupCreation`) — whether users can create teams/Microsoft 365 groups themselves. * **Allowed security group** (`GroupCreationAllowedGroupId`) — which security group is allowed to, when creation isn't wide open. {% hint style="info" %} When a tenant has never explicitly configured this directory setting, Microsoft's platform default applies (`EnableGroupCreation = true`, effectively "everyone can create teams"). Augmentt detects that not-set state and shows you the value actually in effect rather than a blank field, so the Settings page never looks empty just because nobody has touched this control yet. {% endhint %} As with policies, you can start the edit form from a saved **Settings template** using the template picker at the top, instead of setting every field by hand — see Templates and Baselines. ## Built-in and default values Settings isn't a policy collection, so there's no Microsoft "built-in preset" concept here the way there is for the five policy types — every section above is a tenant-wide singleton object that already exists (or falls back to a documented Microsoft default) the moment the tenant exists; there's nothing to create or delete. The one confirmed platform default is **Team creation → Group and team creation = On**, from Microsoft's `Group.Unified` template, applied when the tenant has never set that directory object explicitly. Augmentt doesn't ship a preset **Settings template** of its own — there's no seed/migration data defining default Settings content. Any Settings template you see was created by an MSP from a client's existing configuration. ## Posture-check resolution **Teams Default External/Guest Options** (`teamsdefaultexternaloptions`) is the one Teams-related check in Augmentt's Secure Score / Compliance Audit catalog, and its target data lives largely in this tab: * **CISA SCUBA** — "External access for users SHALL only be enabled on a per-domain basis," targeting **External federation** above. * **CMMC AC.L1-b.1.iii** (Level 1) and **AC.L2-3.1.20** (Level 2) — "Control Teams External Access," covering both **External federation** and the **Guest access** / guest-permission sections. No check currently evaluates **Org-wide app settings** or **Team creation** on their own — a tenant that leaves group/team self-service creation wide open, or hasn't locked down third-party app consent at the org level, won't generate a posture finding today. Those remain visible only by reviewing the Settings tab directly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/teams/settings.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.