Guest access in Microsoft Teams

Guest access in Microsoft Teams allows teams in your organization to collaborate with people outside your organization by granting them access to teams and channels. A guest is someone who isn't an employee, student, or member of your organization. They don't have a school or work account with your organization. For example, guests may include partners, vendors, suppliers, or consultants.

Organizations using Microsoft Teams can provide external access to teams, documents in channels, resources, chats, and applications to their partners, while maintaining complete control over their own corporate data.

Microsoft Teams is built upon Office 365 Groups and provides a new way to access shared assets for an Office 365 group. Microsoft Teams is the best solution for persistent chat among group/team members. Office 365 Groups is a service that provides cross-application membership for a set of shared team assets, like a SharePoint site or a Power BI dashboard, so that the team can collaborate effectively and securely.

How a guest joins a team

A team owner in Microsoft Teams can add and manage guests in their teams via the web or desktop. Only users who have an email address corresponding to an Azure Active Directory or Office 365 work or school account can be added as a guest user.

Note: Before guests can join a team, an admin must enable guest access in Microsoft Teams. To do that, sign in with your Office 365 global admin account. Then, choose Settings > Services & add-ins > Microsoft Teams. Select Guest in Select the user/license type you want to configure, and select On in Turn Microsoft Teams on or off for all users of this type. It can take up to an hour for the settings to take effect. For more details, see "Turn on or off guest access for Microsoft Teams" on this article's Manage tab.

Here's how a guest becomes a member of a team:

  • Step 1 A team owner or an Office 365 admin adds a guest to a team.

  • Step 2 The Office 365 admin or the team owner can manage a guest's capabilities as necessary. For example, allowing a guest to add or delete channels or disabling access to files.

  • Step 3 The guest receives a welcome email from the team owner, inviting them to join the team. After accepting the invitation, the guest can participate in teams and channels, receive and respond to channel messages, access files in channels, and participate in chat. While using Microsoft Teams, a combination of text and icons gives all team members clear indication of guest participation in a team. For more details, see What the guest experience is like.

Guests can leave the team at any time via Microsoft Teams web and desktop clients. For details, see How do I leave a team?

Note: Only people who are outside of your organization, such as partners or consultants, can be added as guests. People from within your organization can join as regular team members.

What the guest experience is like

When a guest is invited to join a team, they receive a welcome email message that includes some information about the team and what to expect now that they're a member. The guest must redeem the invitation in the email message before they can access the team and its channels.

Screenshot shows an example of a welcome email message sent by a team owner in Microsoft Teams to a guest user. The message includes text that can be customized by the team owner and brief descriptions of Teams features like chat, calls, and meetings.

All team members see a message in the channel thread announcing that the team owner has added a guest and providing the guest's name. Everyone on the team can identify easily who is a guest. As shown in the following screenshot of a sample team, a banner indicates "This team has guests" and a "GUEST" label appears next to each guest's name.

Screenshot shows a portion of the Marketing channel for Northwind Traders, with the notification in the top banner stating "This team has guests" and users who are guests identified with the word "GUEST" next to their name.

The following table compares the Microsoft Teams functionality available for an organization's team members to the functionality available for a guest user on the team.

Capability in Teams

Teams user in the organization

Guest user

Create a channel

Team owners control this setting.

checkmark checkmark

Participate in a private chat

checkmark checkmark

Participate in a channel conversation

checkmark checkmark

Post, delete, and edit messages

checkmark checkmark

Share a channel file

checkmark checkmark

Share a chat file

checkmark

Add apps (tabs, bots, or connectors)

checkmark

Create tenant-wide and teams/channels guest access policies

checkmark

Invite a user outside the Office 365 tenant's domain

checkmark

Create a team

checkmark

Discover and join a public team

checkmark

View organization chart

checkmark

Note: Office 365 admins control the features available to guests.

Guest access is included with all Office 365 Business Premium, Office 365 Enterprise, and Office 365 Education subscriptions. No additional Office 365 license is necessary.

Microsoft Teams guest access is a tenant-level setting and is turned off by default. Admins can manage guest access via the Office 365 admin center. For more details, see Manage guest access to Microsoft Teams and Control guest access to Microsoft Teams.

Note: The Microsoft Teams guest access tenant setting only prevents guest sign-in. Team owners will be able to invite new guests and add existing directory guest users to their respective teams.  As a reminder, Microsoft Teams always honor Azure Active Directory external settings to allow or prevent guest user addition to the tenant.

In addition, you can use the Azure Active Directory portal to manage guests and their access to Office 365 and Microsoft Teams resources. Microsoft Teams guest access makes use of Azure Active Directory business-to-business (B2B) collaboration capabilities as the underlying infrastructure to store security principles information such as identity properties, memberships, and multi-factor authentication settings. To learn more about Azure Active Directory B2B, see What is Azure AD B2B collaboration? and Azure Active Directory B2B collaboration FAQs.

Related key services and dependencies

Microsoft Teams relies on SharePoint Online and OneDrive for Business to store files and documents for channels and chat conversations. In addition, Microsoft Teams relies on Office 365 groups to store teams' memberships and other properties such as team data classification settings.

To enable the full Microsoft Teams guest access experience, Office 365 admins need to select On for the following settings:

Control guest access to Microsoft Teams

  1. Sign in with your Office 365 global admin account at https://portal.office.com/adminportal/home.

  2. In the navigation menu, choose Settings and then select Services & add-ins.

    Sign in to Office 365, go to the Office 365 admin center, go to Settings, and then choose Services & add-ins.
  3. Select Microsoft Teams.

    Screenshot shows the option for the Microsoft Teams add-in, as selected in the Office 365 admin center.
  4. In Select the user/license type you want to configure, select Guest.

    Screenshot of the Microsoft Teams add-in shows the Guest license selected and the Microsoft Teams option set to On.

  5. Click or tap the toggle next to Turn Microsoft Teams on or off for all users of this type to On to turn on Teams and guest access for your organization, and then choose Save.

Note: It can take up to an hour for the settings to take effect.

  1. Sign in with your Office 365 global admin account at https://portal.office.com/adminportal/home.

  2. In the navigation menu, choose Settings and then select Services & add-ins.

  3. Select Office 365 Groups.

    Office 365 groups
  4. On the Office 365 Groups page, set the toggle to On or Off, depending if you want to let team and group owners outside your organization access Office 365 groups. Click or tap the toggle to On next to Let group owners add people outside the organization to groups.

    Screenshot shows the Office 365 Groups panel with the options turned on to let group members outside the organization access group content and to let group owners add people outside the organization to groups.

The Sharing option allows guests to be added to your organization. By default, the Sharing option is enabled. For information about how to turn off the Sharing option, see Turn on or off the Sharing option.

Important: If you turn off the Sharing option, guest access isn't available.

In addition to using the Office 365 admin center and the Azure Active Directory portal, you can use Windows PowerShell to control guest access. With PowerShell, you can do the following:

  • Allow or block guest access to all teams and Office 365 groups

  • Allow guests to be added to all teams and Office 365 groups

  • Allow or block guest users from a specific team or Office 365 group

For more details, see Use PowerShell to control guest access.

You can also use PowerShell to allow or block a guest user based on their domain. For example, let's say your business (Contoso) has a partnership with another business (Fabrikam). You can add Fabrikam to your Allow list so your users can add those guests to their groups. For more information, see Allow/Block guest access to Office 365 groups.

Manage guest access to Microsoft Teams

  1. Sign in with your Office 365 global admin account at https://portal.office.com/adminportal/home.

  2. Go to Users > Guest users.

    Screenshot shows the guest users option selected from the Users section of the Office 365 admin center.

A team owner or an Office 365 admin can invite a guest to a team on an individual basis. However, admins can't use the Office 365 admin center or the Azure Active Directory portal to invite multiple guests in one action. To invite guests centrally, consider using the Azure Active Directory B2B collaboration preview. For more information, see About the Azure AD B2B collaboration preview.

Currently, you can't edit guest information from the Office 365 admin center or the Exchange admin center. To edit guest accounts (such as display name or profile photo), go to your Azure Active Directory portal. For more information, see Understanding Office 365 Identity and Azure Active Directory.

Frequently asked questions for admins

Here are common questions Office 365 admins have about inviting guests to join a team in Microsoft Teams.

A guest is not an employee, student, or member of your organization. They don't have a school or work account with your organization.

Only users who have an email address corresponding to an Azure Active Directory or Office 365 work or school account can be added as a guest user.

Only people who are outside of your organization, such as partners or consultants, can be added as guests. Users can invite people from within your organization to join as regular team members or subscribers.

As the Office 365 admin, you must enable the guest feature before you or your organization's users (specifically, team owners) can add guests. When a user sees that message, it's likely that the guest feature hasn't been enabled.

As a global admin, you can add a new guest user to the organization in a couple ways:

  • Global admins who are owners of a team and owners of a team can add a guest to a team through either the Microsoft Teams desktop or the web clients.

  • Add guests to your organization through Azure Active Directory B2B collaboration. Azure Active Directory B2B collaboration allows a global admin to invite and authorize a set of external users by uploading a comma-separated values (CSV) file of no more than 2,000 lines to the B2B collaboration portal. For more details, check out  Azure Active Directory B2B collaboration.

No, individual guest users can't be blocked.

Yes, global admins can use Azure Active Directory Powershell cmdlets to disable the AllowGuestAccessToGroups parameter on the Company object, assuming external sharing is turned on for SharePoint sites.

IT admins can add guests at the tenant level, set and manage guest user policies and permissions, determine which users can invite guests, and pull reports on guest user activity. These controls are available through the Office 365 admin center. Guest user content and activities are under the same compliance and auditing protection as the rest of Office 365.

No. Users can only share Microsoft Teams files with guests who have been invited to join the team.

No additional license is required. Guest access is included with all Office 365 Business Premium, Office 365 Enterprise, and Office 365 Education subscriptions.

Yes, guests are subject to Office 365 and Azure Active Directory service limits.

The guest settings are set in Azure Active Directory. It takes 2 hours to 24 hours for the changes to be effective across your Office 365 organization.

Yes, you can manage SharePoint Online external user settings for the Teams connected team site. For more details, see Manage your SharePoint team site settings.

With Azure Active Directory B2B collaboration, organizations can enforce conditional access and multi-factor authentication (MFA) policies for B2B users. These policies can be enforced at the tenant, app, or individual user level, the same way that they are enabled for full-time employees and members of the organization. Such policies are enforced at the resource organization. For more information, see Conditional access for B2B collaboration users.

Yes, the guest will get access to the team. Adding a guest via the Office 365 group doesn't generate an invitation email to the guest, so someone on the team should notify the guest.

You can track guest additions in Azure Active Directory or the Office 365 Security & Compliance Center. Adding a guest in Microsoft Teams is audited and logged as an Azure AD group administration activity "Added member to group”. For more details, see Auditing and reporting a B2B collaboration user and Search the audit log in the Office 365 Security & Compliance Center.

Guest users you have already added via Azure Active Directory B2B, Office 365 Groups or SharePoint Online are ready to go. The Office 365 admin or a team owner can add those guests to their respective teams.

Admins can create guest accounts in Azure Active Directory, independent from external sharing settings. If external sharing is off, only an admin can create guest accounts.

More information

Administrator settings for Microsoft Teams

Frequently asked questions about Microsoft Teams – Admin Help

Adding guests to teams

Video: Deep Dive into Guest Access

Connect with an expert
Contact us
Expand your skills
Explore training

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×