Microsoft Teams guest access: how it works and how to keep it secure
By Jera IT
Originally published August 2021. Refreshed November 2026: Teams now offers shared channels alongside guest and external access, and attackers use chats from outside organisations to pose as IT support, so we've rewritten this guide for today.
Working with clients and suppliers in Microsoft Teams saves a lot of email. But “let outsiders into our systems” is exactly the kind of thing that needs doing carefully.
The short answer: guest access adds an outside person to specific teams so they can see channels and files. Set it up deliberately, then review your guests regularly.
Three ways to work with people outside your business
| What it does | Best for | |
|---|---|---|
| Guest access | Adds the person to your teams, with access to channels, chats, meetings and files | Ongoing work with a client or contractor on shared files |
| External access | Lets you chat and call people in other organisations, without access to your content | Quick conversations with suppliers and partners |
| Shared channels | One channel shared between two organisations; each person uses their own account | Joint projects with another business that also uses Teams |
How to set up guest access
- Decide your policy. Who can invite guests (owners only, or everyone)? Which organisations can be invited?
- Configure it centrally. In the Microsoft 365 and Teams admin centres, set guest permissions: file sharing, chat, meetings and whether guests can edit or delete messages.
- Require multi-factor authentication. Guests need it just as much as staff.
- Add the guest. A team owner chooses Add member and enters the guest’s email address. The guest accepts the invitation and signs in.
- Keep sensitive content separate. Use a dedicated team or channel for each client relationship, not your internal Finance team.
What guests can and can’t do
Guests can join channels, chat, attend meetings and work on files in the teams they’re added to. By default they can’t create teams, browse your organisation directory, or see anything outside those teams. Admins can restrict them further.
Keeping outside access secure
- Restrict external access to the organisations you actually work with. Open external access is how criminals send “IT support” messages to your staff from lookalike organisations.
- Allow-list domains for guests. Where you can, allow named organisations rather than anyone.
- Review guests regularly. Remove contractors and clients when the work ends. Guests from finished projects are easy to forget, and they keep their access until someone removes them.
- Label sensitive teams so they can’t have guests at all. Sensitivity labels need the right licence: Business Premium includes them, Basic and Standard don’t. See our Business Premium guide.
- Remember Copilot. Copilot and search surface whatever a person already has access to, so check what’s shared in guest-enabled teams.
What has changed since we first wrote this
- Shared channels now offer a tidier way to collaborate with another organisation without guest accounts. Both organisations’ administrators have to switch it on (Microsoft calls it B2B direct connect), so it starts with a conversation with the other side’s IT.
- Teams is an attack route. Criminals now use external chats to pose as IT support, so locking down external access matters as much as any other security setting. See how to set up Microsoft Teams.
- AI reads what people can see. With Copilot in Microsoft 365, loose sharing has bigger consequences.
How Jera can help
We set up Teams guest and external access for businesses across Edinburgh, Glasgow and Aberdeenshire as part of Microsoft 365, so old access doesn’t linger. Not sure who’s in your Teams right now? Book a call and we’ll talk through how to find out.
Frequently asked questions
What is guest access in Microsoft Teams?
Guest access lets you add someone from outside your organisation, such as a client, contractor or supplier, to a team. They can join its channels, chats, meetings and files, with permissions you control.
What's the difference between guest access and external access in Teams?
Guest access adds the person to your teams and gives them access to your content. External access lets your staff find, chat and call people in other organisations using their own accounts, without giving them access to your teams or files.
What are the limitations of guest access in Teams?
Guests have fewer rights than members by default. For example, they can't create teams, see the full organisation directory or access content outside the teams they're added to. Admins control what guests can do, such as whether they can delete messages or share files.
Is Microsoft Teams guest access secure?
Yes, if it's set up deliberately: restrict which organisations can be invited, require multi-factor authentication for guests, remove guests when the work ends, and keep sensitive files out of teams that include guests.
How do I add a guest to Microsoft Teams?
If guest access is turned on, a team owner selects the team, chooses Add member, types the guest's email address and adds them. The guest gets an email invitation and signs in with their own account.
Sources
- B2B direct connect overview, Microsoft
- Shared channels in Microsoft Teams, Microsoft
- Information protection in Microsoft 365 Business Premium, Microsoft
