Teams external chat was abused in more than 400 incidents. What should your IT lead lock down?

What does the attack look like from the inside?

It usually opens with mail bombing: hundreds of newsletter and subscription confirmations land in one inbox within minutes. An external Teams account then appears, named something like "IT Support (Internal)" or carrying the target company's own name, and offers to clear the mess, often by voice call inside Teams. The caller asks for a remote session, most often through Quick Assist, which ships with Windows, is signed by Microsoft and needs only a six digit code read back.

Per Arctic Wolf, 30 to 40 percent of cases came from default onmicrosoft.com tenant domains, which require no verification and can be stood up in minutes. Several users at one organization were often targeted within about five minutes of each other.

Control 1: Replace open federation with an allow list

In the Teams admin center, under Users, External access, move from open federation to allowing only the specific external domains your organization works with. This removes the default path every one of these attacks relies on. Build the list from the partners staff actually chat with, and give business owners a named route for requesting additions so the list does not get bypassed.

Control 2: Block trial tenants

Trial tenants cost an attacker almost nothing to create or abandon. Block federation with them in PowerShell: Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked". Behind an allow list this is a second layer. If business needs force a more open policy, it carries more of the weight.

Control 3: Block unmanaged Teams accounts

Unmanaged accounts are personal Teams accounts that no organization administers. Block chat with them unless there is a documented business need. Alongside this, let the security team manage blocked domains in the Microsoft Defender Tenant Allow/Block List, so a domain seen in an attempt can be cut off without waiting on a change request.

Control 4: Restrict Quick Assist and unsanctioned RMM tools

Arctic Wolf saw Quick Assist most often, followed by AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn. Pick the one remote support tool your organization sanctions. Restrict or remove Quick Assist where real support does not use it, and block the others through application control.

Control 5: Make out of band verification mandatory

Every remote access request gets a callback on a known number before anyone accepts it. Tell staff exactly how real IT contacts them, train them to read the External tag on a chat, and point them to the built in Teams option to report suspicious messages.

What should leadership decide?

Three calls belong above the IT lead. Who approves additions to the external domain allow list, and on what basis. Which remote support tool is the only sanctioned one, outside vendors included. And whether the callback rule applies to everyone, executives included, with no exception for urgency.

None of these controls is exotic. The common failure is ownership: a setting nobody owns stays at its default.

Where are the sources?

Arctic Wolf Labs, Beyond the Inbox, Shubham Dubey, October 26, 2026: https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/

Arctic Wolf, Similar tradecraft across two Teams and Quick Assist intrusions: https://arcticwolf.com/resources/blog/similar-tradecraft-across-two-teams-quick-assist-intrusions/

TechNadu, Microsoft Teams external chat abused in 400 incidents: https://www.technadu.com/microsoft-teams-external-chat-abused-in-400-incidents-arctic-wolf-finds/644678/

BleepingComputer, Microsoft Teams increasingly abused in helpdesk impersonation attacks: https://www.bleepingcomputer.com/news/security/microsoft-teams-increasingly-abused-in-helpdesk-impersonation-attacks