Topic starter
15/01/2026 4:52 pm
TL;DR: Microsoft Teams can now let users start chats with anyone using only an email address, and accepted invites automatically create guest users, according to Valence Security. That convenience expands guest identity sprawl and data-sharing paths faster than many SaaS governance controls can track.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “Microsoft Teams “Chat with Anyone”: Collaboration Breakthrough or Security Blind Spot?”.
Key questions
Q: What breaks when external chat features create guest accounts automatically?
A: The break is in lifecycle control.
A: External collaboration expands the number of people, systems, and locations that can touch sensitive data.
Q: How should security teams handle guest user access in SaaS platforms?
A: Security teams should treat guest access as a tightly scoped exception, not a default entitlement.
Practitioner guidance
- Define external collaboration policy Set rules for who can initiate chats with external users, which domains are trusted, and what data may be shared in those conversations.
- Automate guest lifecycle management Continuously monitor, review, and remove inactive guest users created through collaboration workflows so temporary access does not become standing access.
- Extend SSPM to guest activity Use SaaS security posture management to track guest creation, external sharing, and risky defaults across collaboration platforms.
Bottom line: External chat-with-anyone features can create guest identities as part of the user workflow, which turns collaboration into an identity governance event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:13 pm
External collaboration has become an identity lifecycle event, not a convenience feature. A chat invitation that creates a guest account is a provisioning action wrapped inside user workflow. That means access, data sharing, and offboarding all begin at the moment the message is accepted. The implication for practitioners is that collaboration governance now belongs in identity lifecycle design, not only in messaging policy.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: What is the difference between collaboration convenience and governance control?
A: Convenience makes it easy to connect users quickly, while governance control limits who can connect, what they can access, and how long that access remains valid. In SaaS collaboration, the two diverge when a feature optimises for speed but the security programme still depends on slower review and offboarding cycles.
👉 Read our full editorial: Microsoft Teams chat with anyone raises SaaS governance blind spots