Blocking external Teams from all onmicrosoft.com domains

I understand not wanting to block the entire onmicrosoft.com domain. We usually do not see any legitimate clients who do not have their own domain in their tenant. We do, however, see numerous phishing attempts to users from malicious actors who have set up temporary tenants under a .onmicrosoft.com tenant and I think the "microsoft.com" part of that address makes it appear more legitimate to users. I just wanted to make sure that in blocking the onmicrosoft.com domain would not cause any internal issues because our .onmicrosoft.com domain in our tenant still exists underneath everything.

Hi Jeff,

Thank you for sharing the details of your concern. 

The domain restrictions configured under External access in the Microsoft Teams admin center are intended to control communication with users from external organizations. Therefore, blocking an external domain should not disable your tenant’s own default tenantname.onmicrosoft.com domain, affect your custom domains, or interfere with communication between users within your organization. 

However, blocking the entire onmicrosoft.com domain may be broader than intended. Many legitimate Microsoft 365 organizations use tenant-specific domains in the format organizationname.onmicrosoft.com. Depending on whether the configuration also applies to subdomains, this could prevent your users from communicating through Teams with legitimate external organizations that use those domains. 

For this reason, I recommend blocking the specific tenant domains associated with the suspicious activity, such as suspicioustenant.onmicrosoft.com, or blocking the individual sender addresses, rather than blocking the entire onmicrosoft.com domain. You may also review the Teams external domain anomalies report to help identify the external domains responsible for the unwanted communication before adding them to the block list.   

• If your organization communicates only with a defined group of external partners, you could also consider configuring External access to allow only specific trusted domains.  

Kindly note that External access controls external chats and meetings and is separate from guest access to teams, channels, and other organizational resources. 

For reference, you may find these Microsoft articles helpful: 

• Block domains and addresses in Microsoft Teams using the Tenant Allow/Block List - Microsoft Defender for Office 365 | Microsoft Learn 
• IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities - Microsoft Teams | Microsoft Learn 

I hope this helps clarify the expected impact and the safer options available. Should you have any further questions or need additional assistance, please feel free to share them in the comment below. I'm very happy to help.  

If the answer is helpful, please click 'Yes' and kindly upvote it.

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.