🎯 Teams Administration Course · Module 5 of 6
Apps, External Access & Guest Access
MS-700 Exam Alignment
MS-700
Manage apps, external access, and guest access in Teams: configure org-wide app settings, create app permission policies and app setup policies, manage custom app uploads, configure external access (federation) with specific domains, and control guest access capabilities for meetings, channels, and messaging.
- Distinguish org-wide app settings (global on/off switches) from app permission policies (per-user granular control)
- Know the three app permission policy categories: Microsoft apps, Third-party apps, Custom/Line-of-business apps
- Configure external access to allow or block specific domains rather than all external organisations
- Know the difference between external access (federation) and guest access — authentication model, Azure AD presence, and capabilities
- Identify which guest access settings are in TAC vs which are in Entra ID (Azure AD B2B settings)
Exam Tip: The most frequently confused pair in MS-700 — External Access vs Guest Access. External access = federated chat/calls with someone at another Microsoft 365 org using their own credentials, no account in your tenant, very limited capabilities. Guest access = B2B invite, guest account created in your Azure AD, full Teams collaboration (channels, files, meetings). If a question mentions a user needing access to channels and files → Guest Access. If it's just federated chat → External Access.
Three separate but related governance areas live in this module. Apps governance controls which third-party and Microsoft apps users can install and pin in Teams. External access determines whether your users can chat and call people at other Microsoft 365 organisations without them being guests. Guest access controls what invited external users (who have a guest account in your Azure AD) can do inside Teams. Getting all three right is essential for a secure and productive collaboration environment.
📱 Teams Apps — Governance Layers
App governance in Teams operates at multiple layers. Understanding which layer overrides which is essential for the exam:
| Layer | Where Configured | What It Controls | Scope |
|---|---|---|---|
| 1. Org-wide app settings | TAC → Apps → Org-wide app settings | Global on/off switches — whether any third-party apps are allowed at all, whether custom apps can be uploaded | Tenant-wide — applies to everyone regardless of policy |
| 2. App permission policies | TAC → Apps → Permission policies | Which apps (by category) a user can install or use | Per-user — different users can have different policies |
| 3. App setup policies | TAC → Apps → Setup policies | Which apps are pinned to the Teams sidebar (left rail) and in what order | Per-user — controls the Teams client experience |
| 4. Individual app management | TAC → Apps → Manage apps | Enable or disable specific apps for the entire organisation | Tenant-wide — overrides per-user policies for that specific app |
⚠️ Override Order — Org-Wide Settings Trump Everything
If org-wide app settings block third-party apps, no app permission policy can override it — third-party apps are blocked for everyone. Individual app blocks in Manage apps also override user policies — if an app is disabled at the tenant level, users cannot install it regardless of their permission policy. The order from most restrictive to least: (1) Org-wide settings → (2) Manage apps (individual app) → (3) App permission policy → (4) User action.
🔐 App Permission Policies
App permission policies control which apps users can discover, install, and use in Teams. Each policy defines rules for three app categories. Configured in TAC → Apps → Permission policies.
| Category | What It Covers | Options |
|---|---|---|
| Microsoft apps | First-party apps published by Microsoft (e.g. Planner, OneNote, Stream, Whiteboard, Viva Engage) | Allow all / Allow specific / Block specific / Block all |
| Third-party apps | Apps from the Teams Store published by external vendors (e.g. Salesforce, Zoom, Trello, Jira, ServiceNow) | Allow all / Allow specific / Block specific / Block all |
| Custom apps (line-of-business) | Apps developed internally or uploaded by your organisation as custom packages | Allow all / Allow specific / Block specific / Block all |
TAC › Apps › Permission policies › + Add
🏠 Dashboard
👥 Teams
📅 Meetings
📞 Voice
📱 Apps
Permission policies
Setup policies
Manage apps
Org-wide settings
⚙️ Org-wide settings
App permission policies
+ Add
+ Add
📌 App Setup Policies
App setup policies control which apps are pinned to the Teams navigation rail (the left sidebar) and in what order — defining the default Teams experience for users. Configured in TAC → Apps → Setup policies.
💡 App Setup Policy — Key Settings
- Upload custom apps — Whether users assigned this policy can upload their own custom app packages directly (side-loading). Even if org-wide custom apps are allowed, this individual setting adds another layer of control
- User pinning — Whether users can reorder or pin additional apps themselves, or whether the admin-defined pin order is locked
- Pinned apps list — The ordered list of apps that appear in the Teams sidebar for users with this policy (e.g. Activity, Chat, Teams, Calendar, Calls, Files — in that order)
- Installed apps — Apps automatically installed for users without requiring them to find and install them from the Store
PowerShell — App Permission & Setup Policies
Connect-MicrosoftTeams # View all app permission policies Get-CsTeamsAppPermissionPolicy | Select-Object Identity,DefaultCatalogApps,GlobalCatalogApps,PrivateCatalogApps # Restrictive policy — Microsoft apps only, block all third-party and custom New-CsTeamsAppPermissionPolicy -Identity "Frontline-Apps" -DefaultCatalogApps @{Action="Allow"} -GlobalCatalogApps @{Action="BlockAll"} -PrivateCatalogApps @{Action="BlockAll"} # Assign app permission policy to a user Grant-CsTeamsAppPermissionPolicy -Identity user@techcareers.in -PolicyName "Frontline-Apps" # View all app setup policies Get-CsTeamsAppSetupPolicy | Select-Object Identity,AllowUserPinning,AllowSideLoading # Setup policy — lock sidebar pins, no custom side-loading New-CsTeamsAppSetupPolicy -Identity "Frontline-Setup" -AllowUserPinning $false -AllowSideLoading $false # Assign setup policy to a user Grant-CsTeamsAppSetupPolicy -Identity user@techcareers.in -PolicyName "Frontline-Setup"
🌐 External Access (Federation)
External access — also called federation — allows your users to search for, chat with, and call users at other Microsoft 365 organisations without those people being guests in your tenant. Configured in TAC → Org-wide settings → External access.
| Setting | What It Controls |
|---|---|
| Allow all external domains | Users can chat and call anyone at any other Microsoft 365 tenant by default |
| Allow specific external domains | Only users at the listed domains can be chatted with — all others are blocked. Use for tightly controlled partner access |
| Block specific external domains | All external domains allowed except the ones listed (e.g. block a competitor's domain) |
| Block all external domains | No federation with any external organisation — users cannot chat with anyone outside the tenant |
| Allow users in external organisations to find you by phone number | Whether Teams users at other orgs can search for your users using a phone number (used with Teams Phone) |
| Allow Teams accounts not managed by an organisation | Whether users with personal Microsoft accounts (Teams personal) can be chatted with — separate from enterprise federation |
💡 What External Access (Federation) Allows vs Restricts
- Allowed: 1:1 chat, group chat, audio and video calls with federated external users
- NOT allowed via external access alone: Being added to a Teams channel, accessing shared files, joining a team as a member. These require guest access (a guest account in your Azure AD)
- External users appear with an "(External)" label in Teams chat to visually distinguish them from internal colleagues
PowerShell — External Access (Federation)
Connect-MicrosoftTeams # View current federation configuration Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers,AllowedDomains,BlockedDomains,AllowTeamsConsumer # Open federation — allow all external Microsoft 365 organisations Set-CsTenantFederationConfiguration -AllowFederatedUsers $true # Allowlist — only allow specific partner domains $allowList = New-CsEdgeAllowList -Domain @("partner.com","contractor.co.uk") Set-CsTenantFederationConfiguration -AllowedDomains $allowList # Blocklist — block a specific domain while keeping open federation $blockList = New-CsEdgeAllowList -Domain "competitor.com" Set-CsTenantFederationConfiguration -BlockedDomains $blockList # Disable all external access completely Set-CsTenantFederationConfiguration -AllowFederatedUsers $false # Block personal Microsoft account (Teams consumer) federation Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false
👤 Guest Access
Guest access allows people from outside your organisation to be invited into Teams as guests — they get a guest account created in your Azure Active Directory (B2B collaboration) and can participate in teams, channels, meetings, and file collaboration.
External Access vs Guest Access — Key Differences
| External Access (Federation) | Guest Access | |
|---|---|---|
| Account created in your Azure AD | No — they use their own org's credentials | Yes — a guest account (user@partner.com#EXT#) is created |
| Authentication | Federated — authenticates against their own Azure AD | B2B collaboration — authenticates against your Azure AD as a guest |
| Chat and calls | Yes — 1:1 and group chat, audio/video calls | Yes — full Teams chat and calls |
| Team channel access | No — cannot be added to channels | Yes — can be added as a channel member |
| File access (SharePoint) | No | Yes — access to the team's SharePoint files |
| Meeting access | Can join meetings via link but with limited lobby control | Full meeting participant — subject to meeting policy |
| Where enabled/disabled | TAC → Org-wide settings → External access | TAC → Org-wide settings → Guest access + Entra ID (Azure AD) B2B settings |
| Licence required | No additional licence | Azure AD B2B — no additional charge up to 5:1 ratio (5 guests per internal licensed user) |
Configuring Guest Access in TAC
TAC › Org-wide settings › Guest access
| Guest Access Setting (TAC) | What It Controls for Guests |
|---|---|
| Allow guest access in Teams | Master switch — if off, all other guest settings are irrelevant; no guests can be invited |
| Make private calls | Whether guests can make and receive private calls with Teams users |
| Allow IP video | Whether guests can turn on their camera in meetings |
| Screen sharing mode | Whether guests can share their screen (Entire screen, Single application, Disabled) |
| Allow Meet Now | Whether guests can start an ad-hoc Meet Now call |
| Edit sent messages | Whether guests can edit messages they have already sent |
| Delete sent messages | Whether guests can delete their own messages |
| Allow chat | Whether guests can send messages in channels they are members of |
| Use Giphy | Whether guests can insert Giphy animations |
⚠️ Guest Access Is Controlled in TWO Places
Guest access in Teams requires both settings to be enabled: (1) TAC → Org-wide settings → Guest access → Allow guest access in Teams must be On, AND (2) Entra admin center → External Identities → External collaboration settings → Guest invite settings must permit B2B invitations. If either is off, guests cannot be added. The TAC setting controls Teams-specific guest behaviour; the Entra setting controls whether Azure AD B2B invitations can be sent at all.
PowerShell — Guest Access
Connect-MicrosoftTeams # Check whether guest access is enabled Get-CsTeamsClientConfiguration | Select-Object AllowGuestUser # Enable guest access tenant-wide Set-CsTeamsClientConfiguration -AllowGuestUser $true # View guest calling, meeting, and messaging capabilities Get-CsTeamsGuestCallingConfiguration | Select-Object AllowPrivateCalling Get-CsTeamsGuestMeetingConfiguration | Select-Object AllowIPVideo,AllowMeetNow,ScreenSharingMode Get-CsTeamsGuestMessagingConfiguration | Select-Object AllowUserChat,AllowGiphy,AllowImmersiveReader # Restrict guests — no private calls, no screen sharing Set-CsTeamsGuestCallingConfiguration -AllowPrivateCalling $false Set-CsTeamsGuestMeetingConfiguration -ScreenSharingMode Disabled -AllowMeetNow $false Set-CsTeamsGuestMessagingConfiguration -AllowUserChat $true -AllowGiphy $false # List all guest users in the tenant Get-CsOnlineUser -Filter { UserType -eq "Guest" } | Select-Object DisplayName,UserPrincipalName,AccountEnabled | Sort-Object DisplayName
💡 Best Practices
- Block all third-party apps by default in the Global permission policy and only allow specific vetted apps — this prevents shadow IT and data leakage via unvetted third-party integrations
- Create a separate app permission policy for frontline or regulated users (e.g. financial services, healthcare) that restricts apps to Microsoft-only — easier to prove compliance
- Use app setup policies to pin the apps most relevant to each role — frontline workers need Shifts and Walkie Talkie pinned; knowledge workers need Loop and Planner
- Use external access (federation) for chat-only partner relationships where you don't want to create guest accounts — simpler to manage with no Azure AD overhead
- Use guest access when partners need access to team channels, files, or project workspaces — federation alone is not enough for collaborative file work
- Audit guest accounts quarterly using Get-CsOnlineUser filtering on UserType = Guest — stale guest accounts from departed contractors are a common security risk
- Disable guest access for guests (IP video, screen sharing, private calls) as a baseline and enable only what is genuinely needed — reduces attack surface from compromised guest accounts
🎓 Interview Q&A
Q: What is the difference between external access and guest access in Microsoft Teams?
External access (federation) allows your users to chat and call people at other Microsoft 365 organisations using their own credentials — no account is created in your Azure AD. It is limited to 1:1 and group chat and calls; external users cannot access Teams channels or files. Guest access creates a B2B guest account in your Azure AD, allowing the external person to be added to teams and channels, access shared files in SharePoint, and participate fully in meetings. Guest access provides far more collaboration capability but creates an account in your directory that must be governed.
Q: An admin has created an app permission policy that allows all third-party apps and assigned it to a user, but the user still cannot install any third-party apps. What is the most likely cause?
The most likely cause is that org-wide app settings (TAC → Apps → Org-wide app settings) have third-party apps blocked at the tenant level. Org-wide settings override all per-user app permission policies — if third-party apps are disabled globally, no user can install them regardless of their assigned policy. The admin must first enable third-party apps in the org-wide settings before per-user permission policies take effect.
Q: A legal team needs to collaborate with an external law firm on a shared Teams channel including shared documents. Should you use external access or guest access?
Guest access is required. External access (federation) only allows chat and calls — external users cannot be added to Teams channels or access shared files. For the legal team to share a channel and collaborate on documents with the partner law firm, the firm's users must be invited as guests (creating B2B guest accounts in your Azure AD) — or use a shared channel with B2B Direct Connect if both organisations are on Microsoft 365 (no guest account needed in either tenant). For full SharePoint document library access within a standard channel, guest access with a guest account is the appropriate approach.
Q: Guest access is enabled in TAC but guests are still unable to join teams. What else needs to be checked?
Check Entra admin center → External Identities → External collaboration settings → Guest invite settings. Even with Teams guest access enabled in TAC, if Azure AD B2B invitations are disabled or restricted (e.g. set to "No one can invite guests" or "Only users in specific admin roles"), the Teams invitation process fails because it relies on Azure AD B2B. Both TAC guest access AND Entra B2B invitation settings must be correctly configured for guest invitations to work end-to-end.
Q: What does an app setup policy control and how is it different from an app permission policy?
An app permission policy controls which apps a user can discover, install, and use — it defines what apps are available to them. An app setup policy controls how those apps are presented in the Teams client — specifically which apps are pinned to the sidebar (left navigation rail), in what order, and whether the user can add or reorder pins themselves. A user might have permission to use an app (permission policy allows it) but the app is not pinned (setup policy doesn't include it) — they'd need to find it manually. Admins use setup policies to pre-configure the Teams experience for specific roles without requiring users to customise it themselves.
🎯 MS-700 Mock Test
Module 5 — Apps, External Access & Guest Access
Question 1 of 5
An admin creates an app permission policy allowing all third-party apps and assigns it to all users. However, a specific third-party app called "FieldOps" has been disabled in TAC → Apps → Manage apps. Can users install FieldOps?
✅ Correct answer: A. Disabling an app in Manage apps (TAC → Apps → Manage apps) blocks it at the tenant level — this overrides all per-user app permission policies. Even if a user's permission policy says "Allow all third-party apps," a specifically disabled app in Manage apps cannot be installed by any user in the tenant. The governance hierarchy is: org-wide settings → Manage apps (individual app block) → permission policies → user action.
Question 2 of 5
Users at your organisation need to be able to chat and make audio calls with colleagues at partner.com, which is also on Microsoft 365. The partner users should NOT be able to access any Teams channels or files. Which feature should you configure?
✅ Correct answer: C. External access (federation) is exactly right — it enables chat and audio/video calls between your users and partner.com users without creating guest accounts or giving access to channels and files. Since both orgs are on Microsoft 365, federation works natively. Guest access (A) would create guest accounts and give channel/file access — which the requirement explicitly does not want. Shared channels (B) would also give channel access.
Question 3 of 5
A contractor from an external company needs to be added to the "Product Launch" Teams channel to collaborate on project files and attend planning meetings. Which access method is required?
✅ Correct answer: B. Access to Teams channels and files requires the person to be a team member — which requires guest access (a B2B guest account in your Azure AD). External access (federation) only allows chat and calls and cannot add someone to a channel. Creating an internal account (D) is a security anti-pattern — it gives full internal access and bypasses all external user governance. Guest access is the purpose-built B2B collaboration mechanism for this scenario.
Question 4 of 5
Your organisation has guest access enabled in TAC, but users report that when they try to invite external guests, the invitation fails. What should you check first?
✅ Correct answer: D. Guest access in Teams requires both TAC guest access (enabled) AND Azure AD B2B invitation settings in Entra admin center to permit invitations. If the Entra setting is set to "No one can invite guests" or restricts invitations to specific admin roles, the Teams invitation fails even with TAC guest access enabled. There is no separate "Guest Access licence" (A) — Azure AD B2B is included in all Azure AD plans.
Question 5 of 5
A frontline retail team should only have access to Microsoft-published apps (Shifts, Walkie Talkie, Praise). They should not be able to install any third-party apps or custom apps. The sidebar should be pre-configured with Shifts and Walkie Talkie pinned and users should not be able to change the pin order. What combination of policies achieves this?
✅ Correct answer: C. Two separate policies are needed because they control different things. The app permission policy controls which apps can be installed and used (block third-party, block custom, allow Microsoft apps). The app setup policy controls what's pinned to the sidebar and whether users can change pins (pin Shifts and Walkie Talkie, set AllowUserPinning = false). Neither policy alone handles both requirements — you need both assigned to the frontline user group. Updating the Global permission policy (D) would affect all users in the tenant, not just frontline workers.
🔒
This module is lockedComplete Module 4 and pass its mock test to unlock this module.