Fix Teams External Access Setting Does Not Work in a New Tenant

When you create a new Microsoft Teams tenant, you expect external access to work immediately after enabling it. Many administrators find that external chats and meetings still fail, even though the setting appears correct. This usually happens because the default external access policy in a new tenant is set to block all domains. This article explains the root cause and shows you how to configure external access correctly in a fresh tenant.

The issue is not a bug. It is a combination of restrictive default policies and missing federation settings. You will learn how to verify your tenant’s external access configuration and apply the correct settings to allow external communication.

Why External Access Fails in a New Tenant

When you create a new tenant, Teams applies a default external access policy. This policy blocks external access by default. Even if you later enable external access in the admin center, the policy may still have restrictions that prevent external communication.

The root cause is the default federation configuration. In a new tenant, the external access setting is set to Only allow specific external domains. This means only domains you explicitly add to the allowed list can connect. If you do not add any domains, all external access is blocked.

Another common cause is that the external access with Teams accounts setting is turned off. This setting controls whether users in your tenant can communicate with users in other Teams tenants. If this is off, no external chats or meetings will work.

Default External Access Policy in a New Tenant

The default policy is called Global (Org-wide default). In this policy, the external access with Teams accounts setting is Off. Additionally, the blocked domains list is empty, but the allowed domains list is also empty. This combination blocks all external communication.

The policy also affects external access with Skype for Business. If you have Skype for Business users, you must enable that separately. This article focuses on Teams-to-Teams external access.

Steps to Fix External Access in a New Tenant

Follow these steps in order. You need global admin or Teams admin permissions.

1. Sign in to the Teams admin center
   Go to https://admin.teams.microsoft.com and sign in with your admin account.
2. Open External access settings
   In the left navigation, select Users > External access. This page shows the external access with Teams accounts setting and the blocked or allowed domain lists.
3. Enable external access with Teams accounts
   Under External access with Teams accounts, set the toggle to On. This allows users in your tenant to communicate with users in other Teams tenants.
4. Choose the domain type
   Select Allow all external domains if you want to allow communication with all Teams tenants. If you prefer to restrict to specific domains, select Only allow specific external domains and add the domains you want to allow. For a new tenant, the simplest fix is to allow all external domains.
5. Check the blocked domains list
   Scroll to Blocked domains. If any domains are listed, remove them unless you specifically want to block them. In a new tenant, this list is usually empty, but verify it.
6. Save your changes
   Click Save. The changes take effect within a few minutes, but can take up to 24 hours to fully propagate.
7. Verify per-user external access policies
   Go to Users > Manage users, select a user, and click Policies. Check that the assigned external access policy is the global policy or a custom policy that allows external access. If a custom policy blocks external access, change the assignment.

After completing these steps, test external access by sending a chat to a user in another tenant. If the chat fails, check the next section for additional issues.

If External Access Still Fails After the Main Fix

Teams Shows “You can’t chat with this user”

This error appears when the external access policy is still blocking the domain. Verify that the domain is not in the blocked list. Also confirm that the other tenant has external access enabled. External access requires both tenants to allow communication.

External Access Works for Some Users but Not Others

This usually means a custom external access policy is assigned to some users. Go to Users > Manage users, select the affected user, and check the assigned policy. If the policy is not the global one, update it to allow external access.

External Meetings Fail to Join

External meeting join is controlled by the external access setting, but also by meeting policies. Go to Meetings > Meeting policies and check the global policy. Ensure that Allow external participants is enabled. This setting is separate from external access.

Changes Take Time to Propagate

After changing external access settings, wait at least 4 hours before testing. In some cases, it takes up to 24 hours. If you test immediately, you may see stale results. Clear the Teams cache on the client after the wait period.

New Tenant External Access: Default vs Configured Comparison

Item	New Tenant Default	After Configuration
External access with Teams accounts	Off	On
Allowed domains	Empty	All domains or specific list
Blocked domains	Empty	Only intentionally blocked domains
Per-user policy	Global (Org-wide default)	Global or custom with external access enabled

The table shows the key differences. The most important change is turning on the external access with Teams accounts setting. Without this, no other configuration matters.

Now you can enable external access in a new tenant by adjusting the external access settings in the Teams admin center. Start by turning on external access with Teams accounts and choosing your domain policy. Then verify per-user policies and meeting policies to cover all scenarios. For advanced control, create a custom external access policy and assign it to specific groups of users.