Some policies might be doing more harm than good

External collaboration in Microsoft Teams sounds simple until you open the Teams Admin Center.

Should you allow external organizations? What about unmanaged Teams accounts? Should B2B guest invitations stay enabled? And what exactly happens with a Microsoft 365 trial tenant?

These controls solve different problems, and treating all external users as the same thing can either create unnecessary exposure or make collaboration far more difficult than it needs to be.

Microsoft’s current Teams external collaboration model provides Open, Controlled, and Custom modes. Microsoft describes Controlled as a balanced approach for organizations that want meaningful external collaboration while limiting certain scenarios. [learn.microsoft.com]

For many enterprise environments, that is a good starting philosophy:

Allow external collaboration where there is organizational identity and accountability, while being more restrictive with identities that are not managed by an organization.

First: External access and Guest access are not the same thing

This is the most important distinction.

External access allows Teams users to find, chat, call, and meet with people outside their organization using Microsoft identities. Those external users do not gain access to your Teams, SharePoint sites, or other Microsoft 365 resources simply because federation is enabled. [learn.microsoft.com], [learn.microsoft.com]

Guest access, by contrast, is a collaboration model. An external person is invited into your organization and receives a Microsoft Entra B2B collaboration account in your directory. That guest can then be given access to Teams, channels, files, applications, and other resources that have specifically been shared with them. [learn.microsoft.com], [learn.microsoft.com]

A simple way of remembering the difference is:

External = communicate across organizations

Guest = collaborate inside my organization’s resources

Microsoft also supports B2B Direct Connect, primarily associated with Teams shared channels. Unlike traditional B2B collaboration, B2B Direct Connect doesn’t create the external user as a guest in the workforce directory. [entra-external-id | PDF]

---

What does Microsoft mean by an “unmanaged” Teams account?

This terminology is easy to misinterpret.

In the context of Teams external access, Microsoft describes unmanaged users as Teams users who aren’t managed by an organization, such as users of Microsoft Teams Free. Microsoft also describes this category as users with a Microsoft account. [learn.microsoft.com], [learn.microsoft.com]

This is therefore different from:

• an employee using Teams in another company’s Microsoft 365 tenant;
• a B2B guest invited into your tenant; or
• simply a device that isn’t managed by Intune.

That last distinction is particularly important.

In this context,“unmanaged account” refers to the account/organizational relationship, not whether the user’s PC or phone is enrolled in Intune.

So an external employee from another company’s Microsoft 365 tenant should not automatically be treated as an “unmanaged Teams account.”

Here is the model I would use when designing an enterprise policy:

What happens if you block unmanaged accounts?

Blocking unmanaged Teams accounts does not block normal external access with users from other Microsoft 365 organizations.

Microsoft defines these unmanaged users as Teams users not managed by an organization, such as Microsoft Teams Free / Microsoft accounts. If this setting is disabled, your users cannot communicate with those accounts through Teams external access. [learn.microsoft.com]

This is different from blocking federation with another company.

What happens if you block B2B invitations?

This has a much broader impact.

B2B Guest access is what allows an external person to be invited into your tenant and access resources that are shared with them, such as Teams and associated content. Microsoft Entra creates a B2B collaboration user in your directory for this purpose. [learn.microsoft.com], [learn.microsoft.com]

So:

• Block unmanaged accounts → mainly restricts communication with consumer/non-organizational Teams identities.
• Block B2B invitations → restricts your ability to onboard external collaborators as guests.

They shouldn’t be treated as equivalent security controls.

Trial tenant caveat

Microsoft treats trial-only Microsoft 365 tenants separately from normal organizational federation.

Teams has a specific ExternalAccessWithTrialTenants control, and Microsoft currently sets it to Blocked by default. It’s also Off in both Microsoft’s Open and Controlled external-collaboration presets. [learn.microsoft.com], [learn.microsoft.com]

So there is a strong argument for leaving trial-tenant federation blocked unless there is a specific business requirement.

What is the ideal enterprise balance?

For a typical enterprise, I would use this as the starting position:

Setting	Recommendation
External users from managed M365 organizations	✅ Allow
B2B Guest access	✅ Allow, but govern
Unmanaged Teams accounts	🔴 Block
Trial-only tenants	🔴 Block
B2B Direct Connect / Shared Channels	🟠 Enable selectively
Anonymous meeting access	🟠 Control separately

This is close in philosophy to Microsoft’s Controlled mode, which Microsoft describes as a balanced external-collaboration posture. Microsoft’s Controlled mode keeps normal external-domain communication and Guest access enabled while blocking B2B Direct Connect and trial-tenant communication by default. [learn.microsoft.com]

Conclusion

The goal shouldn’t be to block external collaboration. It should be to distinguish between different levels of trust.

A user coming from another managed Microsoft 365 organization is not the same risk scenario as an unmanaged Microsoft account. Likewise, a B2B Guest who has been deliberately invited to access specific corporate resources serves a very different purpose from basic Teams federation.

A sensible enterprise position is therefore:

Keep legitimate business-to-business collaboration available, while restricting unmanaged and trial identities unless there is a clear business need.

That gives users the collaboration they need without unnecessarily opening every external communication path.