Guest Access Creates Invisible Vulnerabilities
Microsoft Teams Guest Accounts Can Strip Away Defender Protection
A newly uncovered cross-tenant blind spot in Microsoft Teams is allowing attackers to bypass Microsoft Defender for Office 365, placing organizations at risk whenever employees join an external tenant as a guest. The problem isn’t a bug—it’s a structural flaw in how Microsoft handles identity and security boundaries across tenants.
When a user accepts a Teams guest invitation, they temporarily leave their organization’s security perimeter.
Their home Defender policies no longer apply.
Their enterprise-grade protections vanish.
And attackers know it.
This creates a silent, dangerous gap for SMBs, healthcare systems, law firms, and schools—especially those that rely heavily on Teams for external collaboration.
The Core Issue: Security Policies Don’t Follow the User
According to new research from Ontinue:
When you join another tenant as a guest, you inherit their protections—not your own.
Microsoft Defender Safe Links, Safe Attachments, anti-malware scanning, and phishing protections are applied only by the hosting tenant.
If the hosting environment is poorly secured—or deliberately malicious—your users become exposed:
No Safe Links → phishing URLs go unchecked
No Safe Attachments → malware is delivered directly
No threat detection → attacks bypass your SIEM, SOC, and alerts
No visibility → IT has no record of the attack
Your organization remains completely blind because the attack happens outside your tenant, even though it targets your users.
The Attack Path Is Shockingly Simple
Researchers showed how attackers can weaponize this architecture using a low-cost Microsoft 365 tenant.
1. Attacker creates a malicious tenant
They choose a license like Teams Essentials or Business Basic—no Defender protections included.
2. They disable every available safeguard
They create a “protection-free zone” where malware and phishing flow freely.
3. They target your employees with a Teams guest invitation
Teams automatically sends the invite from Microsoft’s own infrastructure, meaning:
It looks completely legitimate.
4. Your user accepts the invite
With one click, they leave your protected environment and enter the attacker’s unprotected tenant.
5. Attacker delivers malware, phishing links, or data-theft payloads
Your organization sees nothing
Your controls trigger nothing
Your user is now exposed to threats your policies would normally block
And the entire attack happens off your radar.
This is one of the most dangerous forms of cross-tenant exploitation in the Microsoft cloud ecosystem.
Why This Threat Hits SMBs, Healthcare, Law Firms, and Schools Hard
These sectors rely heavily on Teams for collaboration:
Doctors and clinics sharing information with partner facilities
Law firms coordinating with clients and external counsel
Schools interacting with vendors and partner districts
SMBs relying on Teams to communicate with suppliers, subcontractors, and customers
Every external communication becomes an attack surface if guest access isn’t controlled.
Even more concerning:
Microsoft is rolling out “chat with anyone via email” in Teams by early 2026—dramatically expanding the guest-invite exposure window.
What You Must Do Immediately
Organizations need layered controls to close this gap before attackers exploit it.
1. Restrict guest access to trusted domains only
Limit B2B collaboration to approved partners you trust.
2. Implement cross-tenant access policies
Use Entra ID settings to enforce conditional access and apply security boundaries based on tenant trust.
3. Disable external Teams messaging where not required
If Teams is internal-only, restrict or fully block external chat.
4. Train employees to treat Teams invites like phishing
If the user isn’t expecting the invite, they should not accept it.
5. Monitor for unusual cross-tenant authentication patterns
SIEMs and identity protection tools can often detect anomalous tenant switching.
6. Review your TeamsMessagingPolicy settings
Set UseB2BInvitesToAddExternalUsers = false to restrict outbound invitations—but also confirm inbound ones are controlled.
Collaboration is critical — but so is controlling who your users collaborate
with
.
Guest access is now a top-tier cloud attack vector, and organizations must treat it as such.
70% of all cyber attacks target small businesses, I can help protect yours.
#cybersecurity #MSP #managedIT #Microsoft365 #dataprotection
