Microsoft Teams Security Best Practices: A CISO's Hardening Guide

Microsoft Teams is where most organizations now live: chat, calls, meetings, files, and a sprawl of third-party apps, all wired directly into your Entra ID identity and SharePoint data. That reach is exactly why it is a high-value target. Teams-borne phishing, malicious app consent, guest-account sprawl, and stolen session tokens have all become routine intrusion paths. This guide walks a CISO or M365 admin through the concrete settings that harden Teams without breaking the collaboration people actually need.

Start with external access and federation

Teams "External access" (federation) governs who from other Microsoft 365 tenants and domains can chat and call your users. Left at the default, it allows communication with every other Teams tenant on the planet, which is how "IT support" impersonators and business-email-compromise actors slide a chat into an employee's window from a look-alike domain.

• Move from open federation to an allow-list of trusted partner domains only. In the Teams admin center under External access, switch to "Allow only specific external domains" and add the domains you actually do business with.
• Block inbound chat and calls from unmanaged and unknown domains. Turn off communication with unmanaged Teams (personal/consumer accounts) and with Skype consumer accounts, which are common social-engineering vectors.
• Review the allow-list quarterly. A partner relationship that ended is a domain that should no longer be able to message your staff.

Govern guest access as its own identity surface

Guest accounts are real Entra ID objects with access to teams, channels, and files. Unmanaged, they accumulate for years after a project ends.

• Decide deliberately whether guest access is on at all. If it is, scope who can invite guests and require approval through Entra access reviews and, where possible, entitlement management with expiration.
• Enforce the same identity controls on guests as on staff: MFA at invitation redemption, and Conditional Access policies that include guest and external users.
• Run recurring access reviews so stale guests are automatically removed, and apply sensitivity labels to guest-accessible teams so external members never land in a container holding regulated data.

Control apps and third-party app permissions

The Teams app store and custom line-of-business apps request Graph permissions and, in many cases, standing OAuth consent to mailbox, files, and chat data. Malicious or over-permissioned apps are a quiet path to persistent data access that survives a password reset.

• Set app permission policies to allow only vetted Microsoft, third-party, and custom apps; block or hold everything else for review rather than allowing all by default.
• Turn off end-user consent for apps that request permissions, and route requests through the Entra admin consent workflow so a human reviews scopes before data access is granted.
• Periodically audit existing enterprise application consents and OAuth grants for excessive or unused permissions, and revoke what is not needed.

Lock down meeting policies

Default meeting settings favor frictionless joining over control. For any meeting that could carry sensitive discussion, the defaults are too loose.

• Lobby / waiting room: place anonymous and external participants in the lobby by default, and disable "anonymous users can join a meeting" where your policy does not need it. This stops uninvited attendees from silently landing in a call.
• Who can present: default to "Specific people" or "Only organizers and co-organizers" rather than "Everyone," so a rogue or compromised attendee cannot screen-share or push content.
• Recording and transcription: decide who may record, and set a retention policy so recordings and transcripts in OneDrive/SharePoint expire instead of living forever. Transcripts capture sensitive dialogue and are discoverable — treat them as records, not scratch files.

Treat Teams as a phishing channel

Users trust a Teams message far more than an email, which is precisely why attackers use it. Watch for and warn staff about:

• Malicious chat links and file shares arriving from external or newly created accounts — Safe Links for Teams (Defender for Office 365) rewrites and scans URLs in messages and should be enabled.
• "IT support" impersonation, where an external account posing as your help desk asks a user to run a command, approve an MFA prompt, or install a "support" app. This is the pattern behind several high-profile ransomware intrusions.
• Give employees a one-click way to report a suspicious Teams message, and make clear that real IT will never DM them from an outside tenant asking them to approve a prompt.

Defend against token theft and session hijacking

Modern attackers increasingly bypass MFA not by cracking it but by stealing the session token issued after a legitimate sign-in — via infostealer malware or adversary-in-the-middle phishing. A stolen Teams/Entra token lets them ride the existing session without re-authenticating.

• Deploy Conditional Access with phishing-resistant MFA (FIDO2 / passkeys / certificate-based) for privileged and high-risk access.
• Require compliant or hybrid-joined devices for Teams access so a token replayed from an unmanaged machine is rejected, and use sign-in risk and token protection (token binding) policies where licensed.
• Shorten session lifetimes for sensitive roles and enable continuous access evaluation so a risky change revokes access mid-session instead of at the next token refresh.

Apply DLP and sensitivity labels

Teams chat, channel messages, and the SharePoint/OneDrive files behind them are all in scope for Microsoft Purview.

• Extend DLP policies to Teams chat and channel messages so credit-card numbers, health data, and other regulated content are blocked or flagged before they spread.
• Apply sensitivity labels to teams and their underlying containers to control guest access, external sharing, and encryption automatically based on classification.
• Use container-level label defaults so a new "Confidential" team cannot silently be created as world-open.

Monitor, audit, and review

You cannot respond to what you never see. Ensure the telemetry is on and reviewed.

• Confirm Purview Audit (unified audit log) is enabled and retained long enough for your investigation and compliance needs; Teams activity, app installs, and admin changes flow here.
• Review Entra sign-in logs for impossible-travel, unfamiliar-location, and legacy-authentication anomalies against Teams service principals.
• Alert on new external federation changes, new app consents, mass file downloads, and DLP hits — route them into your SIEM rather than leaving them in the portal.

Actionable Teams hardening checklist

• Switch external access to an allow-list of trusted domains and block unmanaged/consumer accounts.
• Restrict who can invite guests; enforce MFA at redemption and recurring access reviews with expiration.
• Set app permission policies to allow-listed apps only and disable end-user app consent.
• Route app requests through the admin consent workflow and audit existing OAuth grants.
• Default anonymous/external participants to the lobby; disable anonymous join where not needed.
• Restrict "who can present" to organizers or named people.
• Set retention/expiry on meeting recordings and transcripts.
• Enable Safe Links for Teams and a report-message path for users.
• Train staff on "IT support" impersonation and rogue MFA-approval requests.
• Require phishing-resistant MFA and compliant devices via Conditional Access; enable continuous access evaluation.
• Extend Purview DLP to Teams chat and channel messages; apply sensitivity labels to teams.
• Confirm unified audit logging is on and pipe sign-in and Teams events into your SIEM.

Frequently asked questions

Below are the questions M365 admins ask most often when hardening Teams.

What is the single most important Teams external-access change? Move from open federation to an allow-list of trusted domains and block inbound chat and calls from unmanaged and unknown domains. This closes the most common social-engineering path — a stranger from a look-alike tenant messaging your staff — while preserving communication with the partners you actually work with.

How do I stop malicious or over-permissioned third-party apps in Teams? Set app permission policies to allow only vetted apps, disable end-user consent for apps requesting permissions, and route requests through the Entra admin consent workflow so a human reviews the requested Graph scopes. Then audit existing enterprise-app consents and revoke unused or excessive OAuth grants.

If we enforce MFA, why worry about token theft? Because attackers increasingly steal the session token issued after a valid MFA sign-in — through infostealer malware or adversary-in-the-middle phishing — and replay it without re-authenticating. Conditional Access with phishing-resistant MFA, compliant-device requirements, token protection, and continuous access evaluation are what close that gap.

Which meeting settings matter most for security? Put anonymous and external participants in the lobby by default, restrict "who can present" to organizers or named people, and set retention/expiry on recordings and transcripts. Together these prevent uninvited attendees, rogue screen-sharing, and indefinite storage of sensitive dialogue.

Where do I monitor Teams security activity? Use Microsoft Purview's unified audit log for Teams activity, app installs, and admin changes, and Entra sign-in logs for anomalous authentication. Enable DLP for Teams chat, and forward federation changes, app consents, and DLP hits into your SIEM for alerting.