Microsoft Teams Guest Access allows attackers to bypass Defender for Office 365 protections

Du'aine Davis

Observed in the wild

• In November, Microsoft enabled feature MC1182004 (“Chat with anyone via email”) by default in Teams. This allows users to join external tenants as guests, where Defender forOffice 365 protections do not apply. Attackers exploit this by creating malicious Microsoft 365 tenants without security controls, inviting victims into these unprotected environments.
• Threat actors set up low-cost or trial Microsoft 365 tenants lacking Defender protections (Safe Links, Safe Attachments, ZAP). They send legitimate-looking guest invitations from Microsoft infrastructure, bypassing email security checks. Once victims join, attackers can deliver phishing links, malware, and conduct social engineering without detection, as all security policies are governed by the attacker’s tenant.
• Organisations should not assume Defender protections follow users externally. Recommended actions include:
  • Restrict B2B guest invitations to trusted domains via Microsoft Entra External ID.
  • Implement cross-tenant access policies and limit external Teams communication in the Admin Centre.
  • Disable MC1182004 using PowerShell (Set-CsTeamsMessagingPolicy -UseB2BInvitesToAddExternalUsers $false).
  • Educate users to treat unexpected Teams invitations with caution.

B2B Guest Access Creates an Unprotected Attack Vector