Table of Contents
Existing Federated Chat Controls Can Significantly Reduce the Risk
I love “state of the nation” style reports issued by security companies. Invariably, the report contains details about some horrible new technique attackers are using to penetrate and compromise target systems. The report probably offers some statistics to reinforce the feeling that these techniques should be guarded against, and luckily, the company responsible for the report can help.
All of which brings me to a threat intelligence report issued by ontinue.com. The executive summary starts off by saying that the most effective attacks increasingly don’t like attacks at all, like a Teams chat message from someone claiming to work for the IT department. The report goes on to say that “approximately 30% of monitored organizations experienced at least one Microsoft Teams IT-support impersonation attempt.”
Thirty percent is a high number, but it is not 30% of the Teams installed base. It’s 30% of organizations monitored by Ontinue, and Ontinue don’t tell us if that represents 3 out of 10 organizations or 300 out of 1,000. The statistic tells us that the attacks occur in a certain unknown set of tenants, not how prevalent they are across the Microsoft 365 ecosystem.
It’s an example of the kind of spurious statistic that Microsoft loves to include in their quarterly report when they hype the achievements of some product in growing its installed base or usage. Without a baseline, a statistic is useless.
Hello! I’m Your IT Assistant Ready to Help
It seems like what’s happening here is that the attacker uses a federated chat to contact a user in the target organization, exploits social engineering techniques to gain the victim’s trust, and proceeds to compromise the account to gain a foothold in the organization. This is not a new attack technique. Teams has warned users that a potential chat participant comes from outside the organization since late 2024 and introduced trust indicators in 2025 to help users distinguish between internal and external users. Someone accepting a federated chat from a purported IT worker in another tenant must overlook several visual clues designed to highlight that the contact is external
I don’t deny that successful attacks using the technique happen because they do, but only to users who don’t pay attention or where tenant administrators have not taken steps to block the seamy side of unwanted federated chat. Microsoft is somewhat to blame here because the default state for Teams is to accept federated chat from any other Microsoft 365 tenant that has Teams installed. Federated chat is blocked from unlicensed trial tenants or those that use onmicrosoft.com service domains, but if the attacker buys just one license for their tenant and updates the tenant with a vanity domain, they are good to go to reach out to other tenants.
Clamping Down on External Access
Microsoft recently introduced new external access controls for federated chat to allow tenants to make it harder for unwanted chats to succeed. The controls are off by default but can be easily updated with:
Set-CsTenantFederationConfiguration -EnableExternalAccessRestrictionsForChatParticipants $true -EnableMutualFederationForChatParticipants $true
I have long argued that a lot of the problems with federated chat would go away if tenants simply enabled an allow list of domains to specify exactly which other Microsoft 365 tenants they are willing to support federated chat with. Figure 1 shows how to edit the external access allow list. Once an allow list is in place, Teams only allows federated connections from domains on the list.
The arguments against such a step (which is how my tenants are protected), are two-fold. First, open federation allows easy collaboration between Teams users no matter what tenant they belong to. That’s true, but some dubious characters lurk among the 320 million Teams monthly active users, like the folks posing as IT workers highlighted by the Ontinue report. The second argument is that the administrative workload to maintain the allow list is too onerous. That might be true, but perhaps only initially when the allow list is being populated.
Bottom Line – Use the Defensive Features to Block Dubious IT Support
Reports generated by security companies can make a valuable contribution to our understanding of current threat and potential responses. In this case, it seems like the 30% of organizations monitored by Ontinue need to do some work to tighten controls over Teams federated chat. The necessary controls are there and they can reduce the risk of problems generated though federated chat significantly. The interesting question is how many of the affected organizations had enabled them before the attacks occurred.
So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Microsoft 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.