Microsoft Teams combines chat, meetings, files, and apps. Its security depends on settings for external access, guests, team creation, file sharing, and third-party apps.
Key takeaways
What to know before you act
- Teams security depends on external access, guest access, and governance settings—not just Microsoft 365 defaults.
- Attackers impersonate IT support through external Teams chats and calls.
- Every team should have owners, a purpose, and a lifecycle.
Why it matters
What business leaders should understand
Attackers increasingly use Teams messages and calls to impersonate IT support. Overly open external access and unmanaged teams also increase the risk of data exposure.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with microsoft 365 services, cloud services, and managed email security.
Related reading: SharePoint vs. OneDrive vs. Teams and What is social engineering?.
Key settings to review
Teams distinguishes between external access (chatting with users in other organizations) and guest access (adding outside users to your teams). Both are useful, and both should be configured deliberately.
- External access: allow only trusted domains where practical, and review whether chats with unmanaged accounts are needed.
- Guest access: decide who can invite guests and review guests periodically.
- Team creation: limit who can create teams or require naming conventions and owners.
- File sharing: align SharePoint sharing settings with data sensitivity.
- Apps: review third-party apps and permissions available in Teams.
- Meetings: configure lobby, presenter, and recording settings for external participants.
Protecting users from Teams-based phishing
Criminals have used external Teams chats and calls to pose as help desk staff and persuade users to install remote-access tools or share credentials. Train employees to treat unexpected external messages with the same caution as suspicious email.
Make sure staff know how your real IT support contacts them and how to report a suspicious message. Restricting external access to trusted domains also reduces this risk significantly.
Practical action plan
Steps your business can take
Review external access and limit it to trusted domains where practical.
Control guest access and review guests regularly.
Assign owners to teams and archive inactive ones.
Train staff to verify unexpected Teams messages from outside the organization.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
SharePoint vs. OneDrive vs. Teams
Know where Teams files are stored and shared.
Explore nextRelated guide
What is social engineering?
Recognize fake IT support messages in Teams.
Explore nextRelated guide
Microsoft 365 security checklist
Secure the rest of your Microsoft 365 tenant.
Explore nextService
Security awareness training
Teach staff to verify unexpected chats and calls.
Explore nextWarning signs
Do not ignore these indicators
- External users can message anyone without restriction
- Teams have no owners or many unknown guests
- Employees receive 'IT support' chats from external tenants
Frequently asked questions
Common questions, answered.
What is the difference between external access and guest access in Teams?
External access lets you chat with other organizations; guest access adds outside users to your teams.
Can attackers phish through Microsoft Teams?
Yes. Criminals have posed as IT support in external Teams chats and calls.
How should Teams sprawl be managed?
Limit or govern team creation, require owners, review guests, and archive inactive teams.
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
Microsoft Learn
Security and Microsoft Teams
Microsoft's guide to Teams security features, external access, and administration.
Cybersecurity and Infrastructure Security Agency
Avoiding Social Engineering and Phishing Attacks
CISA's explanation of social engineering tactics and practical ways to avoid becoming a victim.
Cybersecurity and Infrastructure Security Agency
Recognize and Report Phishing
Plain-language guidance for recognizing, reporting, and removing phishing messages.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.