Guest Access In Microsoft Teams - What You Need to Know

With the recent and sudden increase in remote collaboration, many workers are taking advantage of Microsoft Teams. As most businesses already have Microsoft 365, it makes sense to use Teams as a single place to meet with distributed colleagues.

But what if you have people who are outside of your organization that you meet with on a regular basis?

Most of us have partners, vendors, consultants and other constituents that we consider part of our “team” whether or not they work for a different organization.

Wouldn’t it be nice to have one place to exchange chat messages, hold video calls, share files and access content with your partners, all while maintaining complete control over your corporate data?

Your Microsoft 365 consultant should be able to help you out with the many choices, but below we provide a good summary of the options within Microsoft Teams.

How to Enable Guest Access in Microsoft Teams

Good news! You can now enable “guest access” in Teams for external participants.

If you need to collaborate with people who are not on your Office 365 account, you can now invite them to become a guest access user with full control over what they can do.

Note that for external users to be granted guest access, you need to have guest access enabled as an organizational-wide setting in Teams by your Microsoft 365 administrator.

If your organization decides to enable this feature, your admin will specify exactly what guests will be allowed to do and see when it comes to Calling, Meeting and Messaging on a global basis.

Once guest access is enabled and the org-wide settings are configured, it’s time to start adding your guests. Only team owners can add a guest to the “teams” they have created for the purpose of guest access.

By default, all Teams users usually have permission to create a team, but it’s possible this function is turned off for various reasons.  If you do not have this ability, contact your Administrator who will be able to turn on these permissions as needed.

What is a “team” within Microsoft Teams?

To clarify what a “team” is, let’s use a simple example.

Let’s say a company wants to create different teams (think of them as groups) based on company functions such as Sales, Marketing, Engineering, Finance, etc.

Within those high-level teams, “channels” can be created that focus on different topics or projects.

It would be easy to imagine creating a specific team that includes external participants, controlled by the internal team owner. You may or may not have additional channels in that team, which can be modified by the owner as needed.

Note that your invited guests will ONLY have access to features, functions and content within the “team” and associated “channels” that they were invited to join.

Do My Guests Need to Have a Teams or Microsoft 365 Account?

Yes and no. It depends on what you mean by “guest.”

You can always invite anyone with an email address into a Teams Meeting as a temporary guest via your Teams email invite function. Your guest has the option to download the Teams desktop app or join into the call from their web browser.

They do not need to have Microsoft 365 or Teams to join a meeting as a temporary guest. Once the meeting has ended, so does their access to Teams.

This is not the same as assigning “guest access” to an individual.

By assigning guest access to an individual, they will benefit from additional access to many functions in the specific team and channels you have created, including:

• Participating in the chat function
• Initiating and joining voice and video calls
• Sharing their screen while in a call
• Accessing and sharing team files
• Posting, deleting and editing team messages

In other words, as a guest they have many – but not all – of the same functions that internal team members have.

Here is a short list of features that your guest WILL NOT have access to:

• *Your OneDrive or Sharepoint
• Your calendar, scheduled meetings, or details
• The ability to create or revise a team
• The ability to invite other guests
• The ability to browse for a team
• Uploading files to a person-to-person chat

*It is possible to grant guest access to additional Office 365 services including OneDrive and Sharepoint, but for the purposes of this article we are referring to Teams access only.

What Can Microsoft Teams Guest Users Do?

Every member in a team has a role and each one has different permissions. Here is a brief description that describes the roles of team owners, members and guests.

Owners. Team owners manage certain settings for the team. They add and remove members, add guests, change team settings, and handle administrative tasks. There can be multiple owners in a team.

Members. Members are the people in the team. They talk with other team members, view, upload and change files along with the usual sorts of collaboration that the team owners have permitted.

Guests. Guests are people from outside of your organization that a team owner invites. Guests have fewer capabilities than team members or team owners, but there's still a lot they can do.

Here is a handy chart from Microsoft which compares some of the capabilities of team owners, members and guests. Remember, as team owner you can control and modify guest permissions.

How do you add a Guest to your team?

Once the ability to invite guests is granted to a team owner by the Administrator, it’s easy to add a guest to your team in Teams.

• Open your Teams application
• Select Teams from the left-hand menu
• Select the specific team you want your external guest to join
• Select More Options >> Add Member
• Enter the guest’s email address and then click Add
• You can set your guest permissions in Team >> More Options >> Manage Team

Your guests can now collaborate with the other team members in any of the assigned channels.

Is Guest Access in Microsoft Teams Secure?

As per Microsoft, “All guests in Teams are covered by the same compliance and auditing protection as the rest of Office 365.”

However, there are always basic cybersecurity precautions you should take including:

• Turn on multi-factor authentication (you can do this in Microsoft 365, but don’t forget about your other online applications which may need a separate MFA service.)
• Configure the guest sharing settings based on the requirements of your organization
• Review external sharing and guest access on a regular basis
• Ensure every team has someone (usually the team owner) accountable for guest sharing
• Protect sensitive content – employees need to know what data is considered sensitive or classified, where it should live (or not live!) and be cognizant of restricted access

Should Your Business Enable Guest Access?

While some organizations may think it’s safer to disable external sharing entirely, this can actually make the problem worse.

With the rise of the cloud and tons of options available to employees (Dropbox, Box, Gmail, Google Drive, etc.) without IT-approved tools, they’ll simply turn to other solutions to share content externally.

This doesn’t mean that you should just turn on guest access without thinking through your strategy first, using your in-house technology experts, a reputable IT consultant or your Managed IT Service Provider.

How you deploy guest access in Teams, what sort of privileges you enable, and who should be responsible for oversight are all items that need to be thought through and agreed upon within your organization.

If you need assistance with creating a productive and secure guest sharing environment in Microsoft Teams, reach out to us and we’ll help you figure out what’s best for your organization!