Fix Teams External Access Setting Does Not Work for a Security Group

When you configure Teams external access for a security group, you may find that members of that group still cannot communicate with users outside your organization. This typically happens because external access policies are assigned per-user, not directly to groups. The Teams admin center shows a security group in the policy assignment list, but the policy does not apply to group members unless you use the correct assignment method. This article explains the technical cause and provides step-by-step fixes to make the external access setting work for a security group.

You will learn how to check effective policy assignments, how to use PowerShell to assign policies to group members, and how to troubleshoot common issues like cached policy data and priority conflicts.

Why Teams External Access Policy Does Not Apply to Security Groups

External access in Teams is controlled by the ExternalAccessPolicy, which defines whether users can communicate with Teams users outside your organization. This policy is a user-level policy, meaning it applies to individual user accounts. When you try to assign a policy to a security group in the Teams admin center, the admin center creates a policy assignment that applies to all members of the group. However, the assignment is not dynamic: it only applies to users who are members of the group at the time of the assignment. If a user joins the group later, the policy is not automatically assigned.

Another common cause is that the global external access setting is disabled. Even if the policy allows external access, the global switch in the Teams admin center blocks all external communication. The global setting acts as a master switch that overrides any policy that allows external access.

Policy Assignment Priority

When multiple policies apply to a user, Teams uses a priority order: a direct user assignment overrides a group assignment, and a group assignment overrides the global default. If a user has a direct assignment that blocks external access, that assignment takes precedence over the group policy that allows it. You must check the effective policy for each user to see which policy is actually applied.

Cached Policy Data

Teams clients cache policy data for up to 24 hours. After you change a policy or assign a new one, users may not see the effect immediately. The client refreshes policy data when it restarts or after the cache expires. This delay can make it appear that the setting does not work.

Steps to Make External Access Work for a Security Group

Follow these steps in order. You need Teams admin access and PowerShell with the Teams module installed.

1. Enable the global external access setting
   Open the Teams admin center at admin.teams.microsoft.com. Go to Teams apps > External access. Set the toggle for Users can communicate with other Teams users and organizations to On. If this is off, no policy can override it. Save the change.
2. Create or select an external access policy that allows external access
   Go to Teams admin center > External access > External access with Teams accounts. Check the policy assigned to the security group. If you do not have a custom policy, create one by selecting Add and naming it, for example, AllowExternal. Set Users can communicate with other Teams users and organizations to On.
3. Assign the policy to the security group using PowerShell
   Open PowerShell as an administrator. Connect to Teams with the command Connect-MicrosoftTeams. Then run the following command to assign the policy to the group:
   Grant-CsExternalAccessPolicy -Group "securitygroup@yourdomain.com" -PolicyName "AllowExternal"
   Replace the group email and policy name with your values. This command applies the policy to all existing members of the group.
4. Verify the effective policy for a group member
   Run Get-CsExternalAccessPolicy -Identity "user@yourdomain.com" to see the effective policy for a specific user. The output shows the policy that is actually applied, considering direct assignments and group assignments. If the output shows a different policy, check for a direct assignment on the user.
5. Clear the Teams client cache on the user’s device
   On the user’s computer, close Teams completely. Press Ctrl+Shift+Escape to open Task Manager. In the Processes tab, end any Teams processes. Then navigate to %appdata%\Microsoft\Teams and delete the contents of the Cache folder. Restart Teams. This forces the client to fetch the latest policy data.
6. Test external communication
   Ask a group member to start a chat with an external Teams user. If the chat fails, check the user’s effective policy again and confirm the global setting is still On.

If Teams External Access Still Does Not Work After the Main Fix

Users Who Joined the Group After the Policy Assignment

The PowerShell group assignment applies only to members at the time you run the command. New members added later do not get the policy automatically. To fix this, you must run the Grant-CsExternalAccessPolicy -Group command again after adding new members. Alternatively, use a dynamic group in Azure AD and assign the policy via a group assignment in the Teams admin center, but note that the admin center group assignment also does not update automatically for new members.

Direct User Policy Overrides the Group Policy

If a user has a direct external access policy assignment that blocks external access, that policy takes precedence. To check, run Get-CsExternalAccessPolicy -Identity "user@yourdomain.com" and look at the DirectAssignment property. If it is True, remove the direct assignment with Remove-CsExternalAccessPolicy -Identity "user@yourdomain.com". Then the group policy applies.

External Access Setting Is Grayed Out in the Admin Center

If the external access toggle is grayed out, your organization may have a Microsoft 365 policy that restricts external sharing. Go to Microsoft 365 admin center > Settings > Org settings > Security & privacy and check the Let users add new guests to the organization setting. Also check Azure AD external identities settings. These settings can block external access at a higher level.

Teams Shows “External access is blocked by your administrator”

This message appears when the global setting is Off or the effective policy blocks external access. Verify the global setting and the effective policy. Also confirm that the user is not part of a different security group that has a blocking policy assigned.

Teams External Access Policy Assignment Methods: Comparison

Item	Teams Admin Center Group Assignment	PowerShell Group Assignment
Method	GUI in admin center	PowerShell cmdlet
Applies to existing members	Yes	Yes
Applies to new members automatically	No	No
Can override direct user assignment	No	No
Best for	Quick one-time setup	Scripted bulk assignment

After you complete these steps, your security group members will have the correct external access policy. Test with a real external user to confirm. To manage future changes, use PowerShell scripts to reapply the group assignment when members change. For deeper control, explore the Get-CsExternalAccessPolicy cmdlet to audit all effective policies in your tenant.