How to add an external user to Microsoft Teams safely and correctly

Inviting external users (also called guests) to your Microsoft Teams environment is a great way to collaborate with partners, vendors, clients, and contractors. But doing it securely and correctly is crucial to avoid exposing sensitive data or losing control of your workspace.

This guide walks you through the safe, step-by-step process of inviting external users to Teams, including key security settings and best practices.

1. Understand what a “guest” means in Teams

A guest is someone outside your organization who can access your Microsoft Teams environment. They usually log in with a Microsoft account (e.g. Outlook.com) or a work/school email that’s managed through Microsoft Entra ID (formerly Azure AD).

Guests can:

• Join Teams and channels
• Read and post messages
• Access shared files
• Join meetings

But their access is limited compared to internal users—and you can control it.

2. Enable guest access in Microsoft Teams

Guest access must be enabled at the tenant level by an administrator.

To enable it:

1. Go to https://admin.microsoft.com
2. Open Teams Admin Center > Org-wide settings > Guest access
3. Set Allow guest access in Teams to On
4. Configure what guests can do (e.g. make private calls, share screens, edit messages)

🟢 Changes may take up to 24 hours to take effect.

3. Set up Microsoft Entra ID (Azure AD) guest policies

To control external identity behavior more deeply:

1. Go to https://entra.microsoft.com
2. Navigate to External Identities > External collaboration settings
3. Choose:

• Who can invite guests (admins only or all users)
• Whether guests must accept terms of use
• Whether guests can see group memberships

Optional: enforce MFA for guests, require domain filtering, or apply access reviews

4. Invite a guest to a team

Once guest access is allowed:

1. Open Microsoft Teams
2. Go to the Team you want to invite someone to
3. Click … > Manage team > Members > Add member
4. Enter the guest’s full email address
5. Select the “Add as guest” option when prompted

They will receive an invitation email to join as a guest user. They may need to verify their identity using a Microsoft account.

5. Review guest permissions in the team

By default, guests can:

• Create and delete channels
• Post messages
• Share files

To manage this:

1. Go to Teams Admin Center > Teams > Team settings
2. Under Guest permissions, fine-tune what guests can do
3. Consider disabling file deletion or app installation for guests

6. Secure shared files

Files shared in Teams are stored in SharePoint. To protect them:

• Review SharePoint site permissions tied to the Team
• Avoid giving “Edit” access to entire libraries unless needed
• Use sensitivity labels and DLP policies to prevent data leaks
• Turn on external sharing alerts in Microsoft Purview or Defender for Cloud Apps

7. Remove or review guest access regularly

To clean up unused guest accounts:

• Go to Entra ID > Users > External users
• Remove guests who no longer collaborate
• Use Access Reviews to automate this process regularly

Best practices for secure external collaboration

✅ Invite only verified domains (e.g. partnercompany.com)
✅ Use group-based access rather than individual permissions
✅ Avoid sharing entire Teams with guests unless necessary
✅ Use Teams channels, not email, to keep communication transparent
✅ Train staff on how to recognize and report suspicious guest behavior

Summary

Adding external users to Teams makes collaboration easy—but only when done securely. Start by enabling guest access and setting up governance policies in Microsoft Entra ID. Use Teams’ built-in controls to restrict guest actions, protect shared files through SharePoint settings, and audit access regularly.