Eight Teams Settings That Decide Whether Your Collaboration Data Stays Private

Teams is where the whole company talks: chat, meetings, and file sharing in one place. That convenience means a single app potentially holds most, if not all, of an organization's sensitive information, which makes its configuration worth real scrutiny. The eight settings below are each mapped to the CIS Controls (opens in new tab), the widely used set of cybersecurity best practices that helps teams decide what to prioritize first.

A more extensive set of recommendations exists beyond these eight, including configuration steps, end-user impact, and enablement content for each one. A sample is available here: Security Baselines, CIS Controls sample (PDF) (opens in new tab).

Who can get in: membership and external access#

1. Use private teams and shared channels, not public ones#

Access controls are fundamental to every compliance regulation, and channels where users collaborate on sensitive topics or share critical documents should follow least privilege. Private channels handle this inside the organization: users request access from the owners, and everyone else is blocked from seeing the content.

Shared channels go a step further by letting you explicitly grant channel access to users both inside and outside your organization, which makes them the safer pattern for external collaboration.

Both differ from a public channel, where anyone in the org can gain access. Put a formal process in place for the creation of new teams and channels.

2. Restrict external user access#

External access lets outside users look up internal users by email address and start chats and calls entirely within Teams. Blocking it removes Teams as an avenue for reconnaissance and phishing. Note that even with external access disabled, external users can still join Teams calls as long as anonymous join is enabled. If an organization needs both external access and anonymous join blocked, which this baseline neither requires nor recommends, external collaborators could only attend meetings as B2B guest users. External access can also be granted per domain, which fits cases like agency-to-agency collaboration.

3. Restrict who can create new teams#

Any user in a tenant can create a public or private team by default. Behind the scenes, each new team also creates a Microsoft 365 or Office 365 Group plus a SharePoint site with a document library storing every document shared in its channels. Left unmanaged, the tenant fills with teams nobody remembers creating, and that sprawl leads to data loss, insecure document sharing, and organization-wide confusion. We recommend limiting team creation to designated members and putting a formal request process behind new channels. The configuration itself restricts who can create a group, since groups are the backend of a team.

4. Keep anonymous users in the meeting lobby#

This setting controls which participants wait in the lobby before being admitted. Anonymous users, including dial-in users, should not be admitted automatically.

What can run: apps and storage providers#

5. Allow only approved apps#

Teams integrates with three classes of apps:

• Microsoft apps, published by Microsoft
• Third-party apps, not authored by Microsoft, published to the Teams store
• Custom apps, not published to the Teams store, such as apps under development that users sideload into Teams

Only authorized and approved applications should be available to end users, both to manage exfiltration of corporate data and because unmanaged applications may carry vulnerabilities that exploit users, devices, or data.

6. Block third-party file storage#

By default, users can wire external storage providers like Google Drive and Dropbox into their Teams channels. For data loss prevention, only managed, trusted providers should be allowed.

What the content itself gets: DLP and threat protection#

7. Create DLP policies scoped to Teams#

Data loss prevention catches both the accidental leak and the intentional exfiltration, and it is integral to securing Teams. DLP policies scoped to Teams block the sharing of sensitive information and PII such as credit cards, Social Security numbers, and bank account details before it leaves the conversation.

8. Enforce Safe Links and Safe Attachments#

Safe Attachments policies from Defender for Office 365 should be enabled and configured for Teams, so attachments get detonated in a sandbox and scanned for malware on open or download.

For links, Defender protects users from malicious URLs in Teams messages by prepending https://*.safelinks.protection.outlook.com/?url= to URLs in the message. That prefix routes the original URL through Microsoft's scanning proxy, which:

• Compares the URL with a block list
• Compares the URL with a list of known malicious sites
• Applies real-time file scanning if the URL points to a downloadable file

Only when every check passes is the user redirected to the original URL.

Treat this list as a starting line#

These eight settings close the most common Teams gaps, but securing collaboration is a continuous process rather than a one-time configuration pass. Threats change, Microsoft ships new defaults, and settings drift between reviews. Schedule a recurring check of these controls the same way you would patch cycles, and Teams stays a tool you can trust with the company's most sensitive conversations.