That co-counsel you added to a Teams channel for a matter that settled two years ago probably still has an account inside your firm's system.
Here's the part most firms miss about guest access in Microsoft Teams. When you add someone from outside, Microsoft creates an account for them in your directory. Microsoft's own documentation is blunt about what happens next: if that guest later leaves the team on their own, it does not remove the account. An admin has to go delete it.
So matters close, guests pile up, and nobody notices. Expert witnesses. Co-counsel. The e-discovery vendor you used once. Each one is a live door into your firm, and if their mailbox gets popped next year, that stops being their problem and starts being yours.
Attackers have figured out that the collaboration layer is softer than the firewall. Microsoft's incident response team published a case earlier this year where someone posed as IT support over Teams and talked an employee into granting remote access — after two others had already said no.
Three things worth an afternoon:
Pull a list of every guest in your tenant and ask whether that matter is still open.
Limit which outside domains can reach your people at all. Microsoft's own recommendation is an allowlist.
For one-off collaboration, use shared channels. No guest account gets created.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email