Learning Blog: How to Secure Guest Access in Microsoft Teams
Collaboration with external users in Microsoft Teams is common, but it needs to be secure. Microsoft 365 provides different policy layers that control what guests can and cannot do. As an admin, it’s important to know which settings apply where — and this often comes up on the MS-700 exam.
In this post, we’ll walk through a practical scenario to understand how to configure guest access correctly.
📘 Scenario
Your company has a Microsoft 365 subscription and wants to enable external collaboration in Teams. The new security policy requires that:
- Only guest users from specific domains are allowed.
- Guests must be prevented from inviting other guests.
An admin suggests changing the global meeting policy in Teams to meet this goal. Let’s see if that works.
❌ Why Meeting Policies Don’t Work
Meeting policies in Microsoft Teams control meeting behavior, such as:
- Whether users can record meetings.
- Who can bypass the lobby.
- Screen sharing permissions.
👉 They do not manage external collaboration settings. That means modifying a meeting policy will not:
- Restrict guests by domain.
- Prevent guests from inviting other guests.
✅ Correct Approach
To meet the requirements, you need to use two different tools:
1. Restrict Guest Access by Domain
- Configure this in Microsoft Entra ID (Azure AD) → External collaboration settings.
- Allow or block specific domains.
- This ensures only trusted external domains can connect.
2. Prevent Guests from Inviting Other Guests
- Also set in Azure AD external collaboration settings.
- Limit guest invitation permissions to admins only.
- Stops guest users from expanding access without approval.
Together, these settings enforce both security requirements.
💡 Learning Point
- Meeting policies = in-meeting features (recording, screen sharing, lobby rules).
- Guest access policies (Teams + Entra ID) = who can connect, from which domains, and whether they can invite others.
Always match the right tool to the right requirement.
📝 Key Takeaways
- Changing a meeting policy will not meet guest access security requirements.
- Use Microsoft Entra ID (Azure AD) for domain restrictions and guest invitation controls.
- Use the Teams admin center to enable or disable guest access at an organizational level.
- For the MS-700 exam, remember:
- Meeting policies = meeting features.
- Guest/external access = collaboration and security.
