Teams external access phishing calls for tighter federation settings

Lately I keep running into the same worrying pattern in several tenants. Attackers contact employees through Microsoft Teams chats and pretend to be the IT helpdesk, even though they write from entirely external tenancies. They take advantage of Teams’ open federation settings, introduce themselves as support and, a little later, offer to "help" with Quick Assist. Microsoft described this technique publicly in May 2024 in connection with Storm-1811. It usually starts with an email bombing campaign, moves on to Teams chats, then to Quick Assist, and ends with ransomware on the device. Teams external access phishing is no longer a theoretical scenario; I see it in the field far too often.

Teams external access phishing follows a predictable pattern

The method is clever. Threat actors use the default open federation in Teams to send chat messages straight to users. Before that, the victim typically gets hit with a flood of nuisance emails (email bombing), which wears them down and makes them more open to an offer of "help." When the attacker then gets in touch via Teams, they claim to be IT support and propose remote assistance, often through Quick Assist or a similar tool. Plenty of users go along with it, particularly when they don’t notice, or don’t understand, that the Teams chat comes from outside.

The diagram below shows the usual sequence:

flowchart TD
  A["Attacker sends mass emails"] --> B["Victim receives external Teams chat"]
  B --> C["Attacker impersonates IT helpdesk"]
  C --> D["Victim accepts Quick Assist session"]
  D --> E["Attacker takes control"]
  E --> F["Ransomware or data exfiltration"]

Figure: Typical Teams phishing attack flow using open federation

As soon as Quick Assist or another remote tool is running, the attacker is often one click away from a breach. Microsoft has documented the approach in detail: Threat actors misusing Quick Assist in social engineering attacks.

Locking down Teams federation closes the main entry point

If nobody has ever changed your Teams federation settings, your tenant probably still allows external chats with nearly any domain. That default dates back to the early Teams days, when open collaboration was the norm. In most tenants I review, federation is either still wide open or only partly restricted. You can and should tighten this in the Teams Admin Center. Under Users → External access, list only the specific domains you trust instead of using "all except blocked." In security-conscious environments I always recommend limiting federation to known partners, blocking everyone else and turning off chats with unmanaged Teams accounts. Microsoft’s own guidance points in the same direction (Manage external access in Teams).

Tip from the field: Changes to federation settings can take up to 24 hours to fully apply. Tell your users about this upfront, otherwise the support team will get a wave of questions.

A solid external access configuration usually covers these points:

• Allowing only specific, verified partner domains
• Blocking all other domains
• Disabling chats with unmanaged Teams accounts
• No guest access for unknown organizations
• Telling end users how their experience will change

Microsoft also has an article on trusted organizations and external meetings.

Quick Assist and other remote tools need tight control

Microsoft Quick Assist is another popular way in. Attackers like it because it comes pre-installed on most Windows endpoints. If your company already relies on a different managed remote support solution, disable Quick Assist via Intune or restrict its use. In the Intune Admin Center, go to Devices → Configuration → Device restrictions and set "Allow Quick Assist" to "No." If some scenarios still require Quick Assist, make sure users know one thing at minimum: the IT helpdesk will never start a Quick Assist session through a Teams chat, and certainly not from an external tenant. Build this rule into your security awareness training.

Users often overlook the External label in Teams

Teams does show a clear "External" label at the top of chats with people outside your tenant. In training sessions, though, I see again and again that employees ignore or misread it, because "external" is perfectly normal for legitimate partners too. Technical warnings alone won’t do the job, so awareness matters a lot here. Your real helpdesk will never contact you unexpectedly from an external organization, and it won’t propose a remote session out of nowhere. Anyone who gets that kind of message should be suspicious right away.

In awareness campaigns, simple roleplay exercises have worked best for me. Once staff have practiced spotting external chats in a safe setting, the "External" label actually starts to mean something to them. The technology covers only part of the problem.

Federation in Teams still cuts both ways

For years, open federation in Teams made people more productive, particularly in international work. With social engineering tactics like Teams external access phishing, it has turned into a security risk. My advice for 2024 is to restrict Teams federation to trusted partners, train your users and stay alert, because attackers will keep looking for new ways in. If you want to go a step further, look at Conditional Access and Sensitivity Labels to protect particularly exposed groups (see /blog/conditional-access-entra-id-getting-started). My experience keeps confirming it: only technical controls combined with user awareness can really keep Teams external access phishing in check.