Skip to content

Update Set-CsExternalAccessPolicy.md #12720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
May 15, 2025
Merged

Update Set-CsExternalAccessPolicy.md #12720

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2dfc1bc
Update Set-CsExternalAccessPolicy.md
krammerliu May 5, 2025
d717c46
Update Set-CsExternalAccessPolicy.md
krammerliu May 5, 2025
6ff6201
Update Set-CsExternalAccessPolicy.md
krammerliu May 8, 2025
91d96c4
Update New-CsExternalAccessPolicy.md
krammerliu May 8, 2025
6c01f10
Update New-CsExternalAccessPolicy.md
krammerliu May 14, 2025
46edee9
Update Set-CsExternalAccessPolicy.md
krammerliu May 14, 2025
cc68787
Update New-CsExternalAccessPolicy.md
krammerliu May 15, 2025
bf8c657
Update Set-CsExternalAccessPolicy.md
krammerliu May 15, 2025
a088edb
Merge branch 'main' into patch-6
Ruchika-mittal01 May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 19 additions & 9 deletions teams/teams-ps/teams/New-CsExternalAccessPolicy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ New-CsExternalAccessPolicy -Identity GranularFederationExample -CommunicationWit
Set-CsTenantFederationConfiguration -CustomizeFederation $true
```

In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains. After that, we still have to enable the `CustomizeFederation` setting in the TenantFederationConfiguration to allow the federation settings as defined in the ExternalAccessPolicy to work.
In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains.

## PARAMETERS

Expand Down Expand Up @@ -166,7 +166,10 @@ Accept wildcard characters: False
```

### -AllowedExternalDomains
Indicates the domains that are allowed to communicate with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `AllowSpecificExternalDomains`.
> [!NOTE]
> Please note that this parameter is in Private Preview.

Specifies the external domains allowed to communicate with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `AllowSpecificExternalDomains`. This setting can be modified only in custom policy. In Global (default) policy `CommunicationWithExternalOrgs` can only be set to `OrganizationDefault` and cannot be changed.

```yaml
Type: List
Expand All @@ -181,7 +184,10 @@ Accept wildcard characters: False
```

### -BlockedExternalDomains
Indicates the domains that are blocked from communicating with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `BlockSpecificExternalDomains`.
> [!NOTE]
> Please note that this parameter is in Private Preview.

Specifies the external domains blocked from communicating with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `BlockSpecificExternalDomains`. This setting can be modified only in custom policy. In Global (default) policy `CommunicationWithExternalOrgs` can only be set to `OrganizationDefault` and cannot be changed.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu same question as above.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

replied above

```yaml
Type: List
Expand All @@ -196,14 +202,18 @@ Accept wildcard characters: False
```

### -CommunicationWithExternalOrgs
Indicates how the users get assigned by this policy can communicate with the external orgs. There are 5 options:
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates how users assigned to the policy can communicate with external organizations (domains). This setting has 5 possible values:

- OrganizationDefault: the users of this policy will follow the federation settings defined in TenantFederationConfiguration
- AllowAllExternalDomains: the users are open to communicate with all domains
- AllowSpecificExternalDomains: the users can only communicate with the users of the domains defined in `AllowedExternalDomains`
- BlockSpecificExternalDomains: only users from the domains defined in `BlockedExternalDomains` are blocked from communicating with the users of this policy
- BlockAllExternalDomains: the users are not able to communicate with any external domains
- OrganizationDefault: users follow the federation settings specified in `TenantFederationConfiguration`. This is the default value.
- AllowAllExternalDomains: users are allowed to communicate with all domains.
- AllowSpecificExternalDomains: users the users can communicate with external domains listed in `AllowedExternalDomains`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the "users the"

- BlockSpecificExternalDomains: users are blocked from communicating with domains listed in `BlockedExternalDomains`.
- BlockAllExternalDomains: users cannot communicate with any external domains.

The setting is only applicable when `EnableFederationAccess` is set to true. This setting can only be modified in custom policies. In the Global (default) policy, it is fixed to `OrganizationDefault` and cannot be changed.
```yaml
Type: String
Parameter Sets: (All)
Expand Down
27 changes: 18 additions & 9 deletions teams/teams-ps/teams/Set-CsExternalAccessPolicy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,8 +155,7 @@ In this example, the Global policy is updated to allow Teams-ACS federation for
New-CsExternalAccessPolicy -Identity GranularFederationExample -CommunicationWithExternalOrgs "AllowSpecificExternalDomains" -AllowedExternalDomains @("example1.com", "example2.com")
Set-CsTenantFederationConfiguration -CustomizeFederation $true
```

In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains. After that, we still have to enable the `CustomizeFederation` setting in the TenantFederationConfiguration to allow the federation settings as defined in the ExternalAccessPolicy to work.
In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains.

## PARAMETERS

Expand Down Expand Up @@ -200,7 +199,10 @@ Accept wildcard characters: False
```

### -AllowedExternalDomains
Indicates the domains that are allowed to communicate with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `AllowSpecificExternalDomains`
> [!NOTE]
> Please note that this parameter is in Private Preview.

Specifies the external domains allowed to communicate with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `AllowSpecificExternalDomains`. This setting can be modified only in custom policy. In Global (default) policy `CommunicationWithExternalOrgs` can only be set to `OrganizationDefault` and cannot be changed.
```yaml
Type: List
Parameter Sets: (All)
Expand All @@ -215,7 +217,10 @@ Accept wildcard characters: False
```

### -BlockedExternalDomains
Indicates the domains that are blocked from communicating with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `BlockSpecificExternalDomains`
> [!NOTE]
> Please note that this parameter is in Private Preview.

Specifies the external domains blocked from communicating with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `BlockSpecificExternalDomains`. This setting can be modified only in custom policy. In Global (default) policy `CommunicationWithExternalOrgs` can only be set to `OrganizationDefault` and cannot be changed.
```yaml
Type: List
Parameter Sets: (All)
Expand All @@ -230,14 +235,18 @@ Accept wildcard characters: False
```

### -CommunicationWithExternalOrgs
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates how the users get assigned by this policy can communicate with the external orgs. There are 5 options:

- OrganizationDefault: the users of this policy will follow the federation settings defined in TenantFederationConfiguration.
- AllowAllExternalDomains: the users are open to communicate with all domains.
- AllowSpecificExternalDomains: the users can only communicate with the users of the domains defined in `AllowedExternalDomains`.
- BlockSpecificExternalDomains: only users from the domains defined in `BlockedExternalDomains` are blocked from communicating with the users of this policy.
- BlockAllExternalDomains: the users are not able to communicate with any external domains.
- OrganizationDefault: users follow the federation settings specified in `TenantFederationConfiguration`. This is the default value.
- AllowAllExternalDomains: users are allowed to communicate with all domains.
- AllowSpecificExternalDomains: users the users can communicate with external domains listed in `AllowedExternalDomains`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove "users the"

- BlockSpecificExternalDomains: users are blocked from communicating with domains listed in `BlockedExternalDomains`.
- BlockAllExternalDomains: users cannot communicate with any external domains.

The setting is only applicable when `EnableFederationAccess` is set to true. This setting can only be modified in custom policies. In the Global (default) policy, it is fixed to `OrganizationDefault` and cannot be changed.
```yaml
Type: String
Parameter Sets: (All)
Expand Down