Home

Issues with Guest Access inviting other 365 users

%3CLINGO-SUB%20id%3D%22lingo-sub-190556%22%20slang%3D%22en-US%22%3EIssues%20with%20Guest%20Access%20inviting%20other%20365%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-190556%22%20slang%3D%22en-US%22%3E%3CP%3EStarting%20a%20post%20for%20discussion%20around%20issues%20discovered%20with%20Guest%20Access%20and%20Teams.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20If%20you%20invite%20a%20user%20with%20a%20MSA%20account%20that%20matches%20a%20login%20in%20another%20o365%20tenant%20that%20doesn't%20have%20Teams%20activated%2C%20that%20user%20cannot%20join%20or%20login%20and%20access%20your%20Team%20even%20if%20they%20select%20%22Personal%20Account%22%20when%20logging%20into%20teams.%20It%20seems%20the%20Teams%20client%20prioritizes%20the%20work%20account%20regardless%20of%20that%20selection.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2.%20Similar%20issue%20to%20the%20above%2C%20if%20the%20users%20e-mail%20you%20invited%20is%20hosted%20in%20o365%20and%20they%20login%20with%20their%20o365%20work%20account%2C%20but%20that%20tenant%20doesn't%20have%20Teams%20activated%20%2F%20license%2C%20they%20cannot%20connect%20to%20guest%20Teams.%20They%20get%20the%20typical%20%22Ask%20IT%20for%20Teams%20access%22%20error.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20rather%20annoying%20because%20I've%20had%20to%20have%20these%20users%20go%20and%20create%20new%20MSA%20accounts%20on%20different%20e-mail%20to%20join%20as%20guest%20as%20work%20around.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-190556%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EGuest%20Access%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-190624%22%20slang%3D%22en-US%22%3ERe%3A%20Issues%20with%20Guest%20Access%20inviting%20other%20365%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-190624%22%20slang%3D%22en-US%22%3EI%20could%20kind%20of%20see%20That.%20However%20it%20shouldn%E2%80%99t%20default%20to%20off.%20It%20should%20be%20allowed%20with%20an%20option%20to%20enforce%20they%20not%20use%20it%20as%20guests%20on%20other%20tenants.%20But%20then%20that%20comes%20into%20other%20governanc%20tools%20to%20handle%20as%20well.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-190617%22%20slang%3D%22en-US%22%3ERe%3A%20Issues%20with%20Guest%20Access%20inviting%20other%20365%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-190617%22%20slang%3D%22en-US%22%3E%3CP%3ELook%20at%20it%20the%20other%20way%2C%20if%20I%20worked%20for%20a%20company%20and%20we%20decided%20that%20we%20specifically%20didn't%20want%20our%20users%20collaborating%20a%20Teams%20I%20would%20be%20pretty%20shocked%20if%20they%20could%20then%20work%20in%20Teams%20as%20part%20of%20someone%20else's%20tenant.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt's%20not%20great%2C%20but%20this%20is%20the%20only%20logical%20way%20for%20it%20to%20be%20set%20up%20to%20work.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-190597%22%20slang%3D%22en-US%22%3ERe%3A%20Issues%20with%20Guest%20Access%20inviting%20other%20365%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-190597%22%20slang%3D%22en-US%22%3EThat%E2%80%99s%20not%20the%20point.%20The%20point%20is%20their%20email%20is%20tied%20to%20365%20and%20unless%20Teams%20is%20enabled%20they%20cannot%20access%20another%20teams%20instance%20as%20a%20guest.%20In%20either%20scenario.%20I%20agree%20and%20know%20about%20the%20personal%20account%20but%20not%20everyone%20out%20there%20is%20in%20the%20know%20as%20us%20and%20troubleshooting%20these%20issues%20with%20people%20outside%20our%20own%20org%20it%E2%80%99s%20good%20to%20know.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-190593%22%20slang%3D%22en-US%22%3ERe%3A%20Issues%20with%20Guest%20Access%20inviting%20other%20365%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-190593%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20almost%20two%20years%20now%20since%20we%20were%20%22strongly%20advised%22%20to%20stop%20using%20matching%20accounts%20and%20rename%20the%20Personal%20account%20to%20something%20else.%20So%20I'd%20say%20there's%20not%20much%20to%20discuss%20here%2C%20if%20you%20insist%20on%20using%20matching%20personal%20and%20company%20accounts%2C%20you%20will%20be%20facing%20issues.%20Here's%20the%20original%20blog%20post%3A%20%3CA%20href%3D%22https%3A%2F%2Fcloudblogs.microsoft.com%2Fenterprisemobility%2F2016%2F09%2F15%2Fcleaning-up-the-azure-ad-and-microsoft-account-overlap%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcloudblogs.microsoft.com%2Fenterprisemobility%2F2016%2F09%2F15%2Fcleaning-up-the-azure-ad-and-microsoft-account-overlap%2F%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPersonally%2C%20I've%20solved%20all%20my%20issues%20by%20removing%20the%20O365%20alias%2C%20and%20I%20strongly%20advise%20anyone%20else%20to%20do%20the%20same.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Deleted
Not applicable

Starting a post for discussion around issues discovered with Guest Access and Teams. 

 

1. If you invite a user with a MSA account that matches a login in another o365 tenant that doesn't have Teams activated, that user cannot join or login and access your Team even if they select "Personal Account" when logging into teams. It seems the Teams client prioritizes the work account regardless of that selection.  

 

2. Similar issue to the above, if the users e-mail you invited is hosted in o365 and they login with their o365 work account, but that tenant doesn't have Teams activated / license, they cannot connect to guest Teams. They get the typical "Ask IT for Teams access" error. 

 

This is rather annoying because I've had to have these users go and create new MSA accounts on different e-mail to join as guest as work around. 

 

 

4 Replies

It's almost two years now since we were "strongly advised" to stop using matching accounts and rename the Personal account to something else. So I'd say there's not much to discuss here, if you insist on using matching personal and company accounts, you will be facing issues. Here's the original blog post: https://cloudblogs.microsoft.com/enterprisemobility/2016/09/15/cleaning-up-the-azure-ad-and-microsof...

 

Personally, I've solved all my issues by removing the O365 alias, and I strongly advise anyone else to do the same.

That’s not the point. The point is their email is tied to 365 and unless Teams is enabled they cannot access another teams instance as a guest. In either scenario. I agree and know about the personal account but not everyone out there is in the know as us and troubleshooting these issues with people outside our own org it’s good to know.

Look at it the other way, if I worked for a company and we decided that we specifically didn't want our users collaborating a Teams I would be pretty shocked if they could then work in Teams as part of someone else's tenant.

 

It's not great, but this is the only logical way for it to be set up to work.

I could kind of see That. However it shouldn’t default to off. It should be allowed with an option to enforce they not use it as guests on other tenants. But then that comes into other governanc tools to handle as well.
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies