Best External Access configuration

To build on Adam's and Luca's answers, these four settings together give you exactly the behaviour you describe:

1. Allow only specific domains (federation). This stops search, 1:1 chat and calls from everyone else:

Set-CsTenantFederationConfiguration -AllowFederatedUsers $true -AllowedDomainsAsAList @{Add="partner1.com","partner2.com"}

It can take a few hours to take effect.

2. Block unmanaged Teams (consumer) accounts. Otherwise personal Teams accounts can still find people and start chats:

Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false -AllowTeamsConsumerInbound $false

3. Stop meeting guests from showing as "Anonymous". This is a meeting setting, not part of external access. Turn off anonymous join so everyone has to sign in:

Set-CsTeamsMeetingConfiguration -Identity Global -DisableAnonymousJoin $true

(or per policy: Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false)

People with a work account from any tenant, even one not on your allow list, can still join meetings and appear with their name and "(External)". People who won't sign in can no longer join. Warn your users, because customers often join from a browser without signing in.

4. Lobby: set "Who can bypass the lobby" to people in your organisation (and possibly trusted organisations). External participants then wait for approval.

Optional:

- If only some departments should talk to partners, use per-user external access policies.

- Guest access (B2B) is separate from all of this. Review it in Entra and in Teams if you also want to control who gets added to teams as a guest.

Test it from a tenant that isn't on the allow list: search and chat should fail, while joining a meeting with a signed-in account should still work and show the person's name.

Docs: https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat and https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings