External access vs guest access in Teams
Two features sound alike but solve different problems. Pick the wrong one and either the partner cannot work with you, or you open far more than you intended.
External access
External access (also called federation) lets your users find, chat, call and meet with people who have their own Microsoft 365 tenant, or Skype for Business. The other person stays in their own tenant. They are not added to teams and cannot see your channels or files.
You manage it in the Teams admin center under Users > External access. You can allow all domains, allow only listed domains, or block listed domains. To stop users talking to one partner such as litewareinc.com, add that domain to the blocked list.
Guest access
Guest access adds an individual outside user to a team. The person becomes a guest account (Microsoft Entra B2B) in your directory and can use channels, chat in the team, and open files in that team. Guests get fewer capabilities than members.
Guest access has several layers, and all must allow it:
| Layer | Where |
|---|---|
| Teams guest access switch | Teams admin center > Users > Guest access |
| Microsoft 365 group guest setting | Microsoft 365 admin center > Settings > Org settings > Microsoft 365 Groups |
| External collaboration settings | Microsoft Entra admin center > External Identities |
| SharePoint sharing | SharePoint admin center > Sharing |
If guests can be invited but cannot open files, check SharePoint sharing for the team site.
Comparing them
| External access | Guest access | |
|---|---|---|
| Account in your directory | No | Yes (guest) |
| Added to a team | No | Yes |
| Sees channels and files | No | Yes, for that team |
| Main admin location | Teams admin center | Teams, Entra ID, Microsoft 365 admin center, SharePoint |
Blocking guests for one team
Turning off guest access in the Teams admin center blocks everyone. To block guests for a single team, use a sensitivity label from Microsoft Purview that sets external user access to off for the container, then apply it to the team. The older method is a directory setting that sets AllowToAddGuests to false for that group, created with New-AzureADObjectSetting. Both affect only the chosen team.
Exam traps
- “Chat with users in another company” is external access. “Add a person to a team” is guest access.
- Blocking one domain is done in External access, not by creating a messaging policy or meeting policy.
- Disabling guest access in the Teams admin center is tenant-wide. If the question says “no impact on other teams”, look for a sensitivity label.
- Guest access needs more than one setting. If it still fails after the Teams switch is on, check the other layers.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Users must chat and call people in a partner company that has its own Microsoft 365 tenant. The partner users must not be added to any team. What do you configure?
Show answer
Answer: B.External access (federation) lets users in different domains chat, call and meet without being members of your teams.
2. A partner consultant needs to open files and post in channels of one team. Which feature gives this access?
Show answer
Answer: B.Guest access adds an external person to a team as a guest account in Microsoft Entra ID, so they can use channels and files.
3. Guests are allowed in the organization, but the team named Legal must never accept guests. What is the cleanest method?
Show answer
Answer: C.A sensitivity label with guest access disabled applies to that team only. Turning guest access off in the Teams admin center would affect every team.
4. You turned on guest access in the Teams admin center, but owners still cannot add guests. Which other setting should you check?
Show answer
Answer: A.Guest access depends on several layers, including the Microsoft 365 groups guest setting and the Entra ID external collaboration settings.