Best External Access configuration

To build on Adam's and Luca's answers, these four settings together give you exactly the behaviour you describe:

1. Allow only specific domains (federation). This stops search, 1:1 chat and calls from everyone else:

Set-CsTenantFederationConfiguration -AllowFederatedUsers $true -AllowedDomainsAsAList @{Add="partner1.com","partner2.com"}

It can take a few hours to take effect.

2. Block unmanaged Teams (consumer) accounts. Otherwise personal Teams accounts can still find people and start chats:

Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false -AllowTeamsConsumerInbound $false

3. Stop meeting guests from showing as "Anonymous". This is a meeting setting, not part of external access. Turn off anonymous join so everyone has to sign in:

Set-CsTeamsMeetingConfiguration -Identity Global -DisableAnonymousJoin $true

(or per policy: Set-CsTeamsMeetingPolicy -AllowAnonymousUsersToJoinMeeting $false)

People with a work account from any tenant, even one not on your allow list, can still join meetings and appear with their name and "(External)". People who won't sign in can no longer join. Warn your users, because customers often join from a browser without signing in.

4. Lobby: set "Who can bypass the lobby" to people in your organisation (and possibly trusted organisations). External participants then wait for approval.

Optional:

- If only some departments should talk to partners, use per-user external access policies.

- Guest access (B2B) is separate from all of this. Review it in Entra and in Teams if you also want to control who gets added to teams as a guest.

Test it from a tenant that isn't on the allow list: search and chat should fail, while joining a meeting with a signed-in account should still work and show the person's name.

Docs: https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat and https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings

adam deltinger​  is correct that using the External Access domain allow list is the main control if your goal is to prevent unknown domains from initiating chats, calls, or user lookups. By switching External Access to Allow only specific domains, you effectively block federation with all other organizations.

However, it's important to understand that External Access and meeting participation are separate mechanisms in Teams. Even if a domain is not on the federation allow list, users from that organization can still join a meeting as authenticated external participants, provided they sign in with their Microsoft 365 or Entra ID account.

So a common configuration for this scenario is:

External Access
Set to Allow only specific external domains and add only trusted partner organizations. This prevents random tenants from federating, searching users, or starting chats/calls.

Meeting settings
Ensure meetings allow authenticated external users to join so invited participants do not appear as anonymous when they sign in with their work account.

This approach keeps federation tightly controlled while still allowing normal collaboration through scheduled meetings.

You need to use the domain allow list (blocking all other) then add all domains you collaborate with. Try the experience out with external meetings with non allowed domains

best, Adam