|
[What and Why]
We’re introducing two new Microsoft Teams PowerShell controls that help organizations enforce external access and federation policies more consistently in federated group chats:
- External Access Restrictions for Chat Participants (EnableExternalAccessRestrictionsForChatParticipants)
- Mutual Federation for Chat Participants (EnableMutualFederationForChatParticipants)
These controls are independent from each other and help ensure federated chat participation strictly aligns with configured external access policies. They help reduce indirect exposure to unapproved external organizations and provide admins with greater control over cross-tenant communications.
[Rollout Schedule]
- General Availability (Worldwide): Beginning late July 2026 and expected to complete late September 2026
- External Access Restrictions for Chat Participants available: July 31, 2026
- Mutual Federation for Chat Participants available: September 30, 2026
[Impact on Your Organization]
Who is affected
- Microsoft Teams administrators managing external access and federation settings
- Organizations using federated group chats with external tenants
- Users assigned External Access Policies that restrict federation access
Platforms/Services
- Microsoft Teams
- Teams PowerShell
What will happen
- The new controls are disabled by default.
- The change only affects organizations that choose to enable the controls.
- The controls are configured through the existing Set-CsTenantFederationConfiguration PowerShell cmdlet.
When EnableExternalAccessRestrictionsForChatParticipants is enabled:
- Users whose External Access Policy has EnableFederationAccess set to False cannot be added to federated group chats with external users.
- Those users are automatically removed from existing active federated group chats that include external participants.
- This setting does not change behavior controlled through the CommunicationWithExternalOrgs setting in External Access Policies.
When EnableExternalAccessRestrictionsForChatParticipants is disabled:
- Users whose External Access Policy has EnableFederationAccess set to False can still participate in federated group chats if the chat was created by a user in their organization who is allowed to use federation.
When EnableMutualFederationForChatParticipants is enabled:
- All federated group chat participants from tenants that have this setting enabled must be allowed to federate with the domains of the other tenants in the chat.
- Users who do not meet mutual federation requirements with all other participants cannot be added to or join the chat (not even facilitated through a third-party tenant that they are allowed to federate with)
Participants can be automatically removed from active chats when federation requirements are no longer met.
When EnableMutualFederationForChatParticipants is disabled (default):
- Only the user being added (or joining) and the chat initiator must have a valid federation relationship. Other existing chat participants might not meet the user’s effective external access requirements.
- Supported scenarios include:
- Creating external federated group chats.
- Adding users to external federated group chats.
- Enforcing updated federation requirements after external access or federation policies change.
Additional details:
- Automatic participant removal applies only to active group chats (a chat that has had a message sent within the previous two hours). Users in inactive group chats are evaluated when new activity occurs.
- The user who initiated the chat is never automatically removed.
- These two new controls do not affect:
- Meetings with external users and meeting chats
- Shared Channels
[Action Required/Recommendations]
No immediate action is required.
If you plan to enable these controls:
- Review your organization’s external access requirements and federation strategy.
- Verify that your Allowed Domains configuration is complete and current.
- Review External Access Policies to identify users or groups with EnableFederationAccess set to False.
- Assess business processes that rely on federated group chats involving multiple external organizations.
- Communicate potential impacts to helpdesk staff and affected stakeholders.
- Review the Microsoft Teams PowerShell documentation for Set-CsTenantFederationConfiguration.
Organizations may observe users being removed from existing federated group chats after either they or a partner organization enable these controls and federation requirements are no longer satisfied.
Learn more: Set-CsTenantFederationConfiguration | Microsoft Teams | Microsoft Learn
[Compliance considerations]
| Question |
Answer |
| Does the change provide a new way of communicating between users, tenants, or subscriptions? |
Yes. The change modifies how existing federated group chat communications are governed by enforcing participant eligibility and mutual federation requirements across tenants. |
| Does the change include an admin control and can it be controlled through Entra ID group membership? |
Yes. Two new administrator controls are introduced through Teams PowerShell: EnableExternalAccessRestrictionsForChatParticipants and EnableMutualFederationForChatParticipants. User impact depends on External Access Policy assignments, which can be administered through existing policy assignment mechanisms. |
|