Microsoft Teams guest access vs external access – Which one to choose

Collaborating with people outside one’s organization is one of the top benefits of the Microsoft 365 platform. Microsoft Teams, Microsoft’s household name for online collaboration, has a couple of sophisticated external sharing options. The first – external access – lets you find, call, and chat with users in other domains. The second – guest access – lets you add individuals to your teams, as guests, using their email address. In this blog post, we’ll cover some of the specifics and differences between these two types of access.

Microsoft Teams external access

External access lets users in other domains find, call, chat, and set up meetings with your team members. However, external users have no access to your organization’s teams, channels, or team resources such as files, plans, wiki tab, etc.

There are three scenarios for setting up external access in the Teams admin center.

• Open federation: This is the default setting in Teams, and it lets people in your organization find, call, chat, and set up meetings with people outside your organization in any domain. In this scenario, your users can communicate with all external domains if they:
  • are running Teams or Skype for Business and are using open federation
  • have added your domain to their allow list
• Allow specific domains: By adding domains to an Allow list, you limit external access to only the allowed domains, while all other domains will be blocked. To allow specific domains:

1. Click Add a domain,
2. Add the domain name,
3. Click Action to take on this domain,
4. Select Allowed.

• Block specific domains– By adding domains to a Block list, you can communicate with all external domains except the ones you’ve blocked. To block specific domains:

1. Click Add a domain,
2. Add the domain name,
3. Click Action to take on this domain,
4. Select Blocked.

Microsoft Teams guest access

Guest access lets you add individual users from outside your company to your teams and channels in Microsoft Teams. Anyone with a business or consumer email account, such as Outlook, Gmail, or others, can participate as a Teams guest with full access to team chats, meetings, and files.

A Teams admin can control which features guests can (and can’t) use in Teams, such as delete or edit messages, use memes, stickers or Giphy in conversation, and so on. Check out management options for Microsoft Teams guests.

There are, however, some default limitations to guest access versus regular team membership.  For example, guests in Teams don’t have access to these functionalities:

• OneDrive for Business
• People search outside of Teams
• Calendar, Scheduled Meetings, or Meeting Details
• PSTN
• Organization chart
• Create or revise a team
• Browse for a team
• Upload files to a person-to-person chat

Teams doesn’t restrict the number of guests you can add. However, the total number of guests you can add to your tenant is based on the possibilities of your Azure AD license. For more information, check out Azure AD B2B collaboration licensing.

Differences between external and guest access in Microsoft Teams

See the most important differences between the Microsoft Teams guest and external access in the table below, or find the comparison list of all features on Microsoft’s page.

Recently, we held an online session with one of the most influential Microsoft MVPs in Europe, Adis Jugo. In his course, he explains the difference between these two types of access and how you should govern guest and external users in Teams.

Which type of access to choose – use cases

Use Microsoft Teams external access when:

• You want the people in your organization to use Teams to contact people in specific businesses outside of your organization.
• You want anyone in the world who uses Teams to be able to find and contact you using your email address.

To conclude, you should use external Teams access for those users outside your organization with who you need to communicate rather than collaborate on files. Also, if you don’t have to work with specific people, and want to allow any person from the external domain to communicate with you on Teams, this is a good option for you.

Use Microsoft Teams guest access when:

You want people outside your organization, such as partners, vendors, suppliers, or consultants, to have access to teams, documents in channels, resources, chats, and applications.

Let’s say that your marketing team collaborates with an external advertising agency. They want to share files between them, do regular meetings, collaborate on tasks, and communicate regularly via Teams.

In that case, you should add one or a couple of guest users from the advertising agency to your Azure AD via their business email. Then, you should create a dedicated team inside Microsoft Teams that focuses on advertising matters and give them guest access to it. Once you add them, they will be marked with a Guest tag.

Note that only users who are added through AAD can access your team, while other people from their domain won’t be able to see or edit anything inside the team.

Guests will be able to participate in channel communication, chat in private chats, share channel files, and have access to teams’ resources. However, they won’t be able to create meetings, add apps, or share chat files. See the entire comparison list of guest and team user capabilities and read our ultimate Teams guest users guide.

To manage your company’s Microsoft 365 ecosystem, check out Syskit Point, a platform that will help you govern and secure your environment and give you deep visibility into your entire inventory. Start today with a 21-day free trial.