You block this by using Microsoft Teams external access and guest access controls, then restricting who can chat, call, or meet with people outside your organisation. In practice, allow only approved domains or tenants, review federation settings, and confirm that unmanaged accounts cannot be used as a path for data exfiltration or impersonation.
What “unmanaged accounts” mean in Teams access control
In practice, unmanaged accounts are identities that sit outside your normal control plane, such as personal Microsoft accounts, unaffiliated external tenants, or accounts you have not enrolled in your governance process. The security question is not just whether a user can reach the chat surface, but whether they can create an uncontrolled communication path into your tenant.
Microsoft Teams external access and guest access solve different problems. External access is federation between tenants or domains for chat and calling, while guest access brings an external person into your tenant under tighter governance. If you want to prevent unmanaged accounts from becoming a collaboration channel, you need to treat those two paths separately and close the one you do not explicitly need.
For a broader control view, NHIMG’s Collaboration Tool Security Guide covers how Teams, Slack, Zoom, bots, and related collaboration channels can be governed without turning the tool into an open trust boundary.
How to restrict chat, call, and meeting paths
The most reliable pattern is to allow only the external communication paths you have a business reason to support. In Teams, that usually means allowing only approved domains or tenants for federation, then limiting guest access to people who are explicitly invited and governed. If unmanaged accounts are the concern, do not leave “any external domain” style communication in place by default.
Teams policy design should also reflect the kind of interaction you are blocking. Chat and calls are different from meeting participation, and meeting policies can create a separate exposure path even when federated chat is closed. A user may be blocked from direct communication but still reach your staff through meetings, shared links, or guest presence if those controls are not aligned.
This is where the distinction between people, guests, and service-mediated access becomes important. NHIMG’s Human vs Non-Human Identity explains why governance gets harder when an external party is not a fully enrolled internal user, because the trust model, ownership, and lifecycle are different.
Block rules should be verified from the user perspective, not just the admin console. A control is not effective until you have tested whether a blocked external identity can still initiate chat, join a meeting, or be routed through a permissive tenant configuration elsewhere in Microsoft 365.
Preventing data leakage and impersonation through collaboration channels
The reason this control matters is that collaboration platforms are often used for both legitimate business exchange and low-friction social engineering. Unmanaged accounts can be used to collect sensitive responses, impersonate vendors or partners, and move users into file sharing or message forwarding workflows that bypass other perimeter controls.
The threat is usually not a dramatic exploit, it is trust abuse. A user sees a familiar product interface, assumes the sender is legitimate, and shares information or approves a request that should have been challenged. That is why blocking unmanaged accounts is not only an access-control decision, it is also a trust-boundary decision.
For Teams specifically, the attack path often becomes a blend of impersonation, social engineering, and governance gaps. If external access is too open, an unmanaged account can reach users directly; if guest access is too broad, the same account may gain a more persistent foothold inside your collaboration space. NHIMG’s Internet Archive breach 2024 is a reminder that once an external token or account path is trusted, the issue is often persistence and reuse, not just first access.
Risk and Threat Considerations
Unmanaged accounts are risky because they weaken attribution, reduce policy enforcement, and create a channel for phishing, data exfiltration, and impersonation that may look like normal collaboration traffic. The exposure grows when external access is broad and when guest governance is looser than the rest of your identity controls.
Failure mechanism: A user or tenant policy leaves a federated or guest path open, letting an unmanaged account contact employees, join meetings, or receive data outside the intended approval model.
Impact: Sensitive information can leave the organisation through chat, file sharing, or meeting content, and the sender may be difficult to distinguish from a legitimate external collaborator.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-20 — Use of External Information Systems | Controls external system access paths that Teams federation and guest access create. |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Covers authentication of external people entering collaboration services. | |
| AC-6 — Least Privilege | Limits the reach of external accounts that are allowed into Teams. | |
| Recommendation — Restrict external collaboration paths to approved partners and tenants. Require governed external identities before allowing Teams access. Limit each external identity to the minimum collaboration scope needed. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Teams external access and guest access are access-control decisions over collaboration channels. |
| A.5.16 — Identity management | Managed versus unmanaged accounts is an identity-governance distinction. | |
| A.5.18 — Access rights | Supports review and restriction of collaboration permissions for outside users. | |
| Recommendation — Define and enforce explicit access rules for external Teams users. Maintain an approved identity process for every external collaborator. Review and revoke unnecessary external collaboration rights promptly. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Directly addresses restricting who can access collaboration services and with what scope. |
| CIS-5 — Account Management | External and guest identities need explicit lifecycle control to stay governed. | |
| Recommendation — Allow only approved external Teams communication paths and partners. Inventory, approve, and remove external accounts used in Teams collaboration. | ||
Practitioner Guidance
What to verify: Confirm whether your Teams policy set distinguishes external access from guest access, and test each one independently. A common mistake is to restrict one path while leaving the other open enough for unmanaged accounts to reach users.
Decision rule: If the business need is limited to a small set of partner domains, prefer an allowlist model and keep guest access narrower than federation. If you cannot clearly explain why a domain or tenant is trusted, do not grant it interactive collaboration access.
What good looks like: Users can collaborate only with approved external identities, blocked identities fail cleanly, and security teams can show which tenant or domain was permitted, why it was permitted, and who owns the exception.
Practitioner takeaway: The objective is not to ban all external collaboration, it is to ensure that only identities you can govern, attribute, and review are allowed to reach staff through Teams.
Related resources from NHI Mgmt Group
- How should security teams govern non-human identities alongside human accounts?
- How should security teams govern Active Directory service accounts?
- How do you clean up unmanaged Microsoft Entra accounts created through self-service sign-up?
- How do you block OneDrive sync from unmanaged devices in Microsoft 365?