Skip to content

Update Set-CsExternalAccessPolicy.md #12720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
May 15, 2025
Merged

Update Set-CsExternalAccessPolicy.md #12720

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2dfc1bc
Update Set-CsExternalAccessPolicy.md
krammerliu May 5, 2025
d717c46
Update Set-CsExternalAccessPolicy.md
krammerliu May 5, 2025
6ff6201
Update Set-CsExternalAccessPolicy.md
krammerliu May 8, 2025
91d96c4
Update New-CsExternalAccessPolicy.md
krammerliu May 8, 2025
6c01f10
Update New-CsExternalAccessPolicy.md
krammerliu May 14, 2025
46edee9
Update Set-CsExternalAccessPolicy.md
krammerliu May 14, 2025
cc68787
Update New-CsExternalAccessPolicy.md
krammerliu May 15, 2025
bf8c657
Update Set-CsExternalAccessPolicy.md
krammerliu May 15, 2025
a088edb
Merge branch 'main' into patch-6
Ruchika-mittal01 May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 18 additions & 8 deletions teams/teams-ps/teams/New-CsExternalAccessPolicy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ New-CsExternalAccessPolicy -Identity GranularFederationExample -CommunicationWit
Set-CsTenantFederationConfiguration -CustomizeFederation $true
```

In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains. After that, we still have to enable the `CustomizeFederation` setting in the TenantFederationConfiguration to allow the federation settings as defined in the ExternalAccessPolicy to work.
In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains.

## PARAMETERS

Expand Down Expand Up @@ -166,7 +166,10 @@ Accept wildcard characters: False
```

### -AllowedExternalDomains
Indicates the domains that are allowed to communicate with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `AllowSpecificExternalDomains`.
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates the domains that are allowed to communicate with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `AllowSpecificExternalDomains`. Only custom policies can change this setting. In Global (default) policy this setting should be default value always and is not allowed to be changed.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu I may not be aware of the most recent changes to GFC plan, therefore, asking. Are we saying that global org wide external access policy will not allow specifying Specific domains? This would only be available in org settings page?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MJMicrosoft yes and no. Are we saying that global org wide external access policy will not allow specifying Specific domains? <- yes, but for "This would only be available in org settings page?" <- this would only be available in external access policy page, which is not enabled yet in our preview

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu shouldn't we update the Tenant Federation config doc as well in this case ?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu just to make sure that I understand this correctly:
external access org wide policy - will only have 2 options:

  1. Off
  2. follow org settings
    Correct?

External access custom policies will have 5 options:

  1. Follow org settings
  2. Allow specific
  3. Allow all
  4. Block specific
  5. Block all
    Correct?

I am probably not getting that information reading the document.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MJMicrosoft for custom polies, yes. for org wide policy, based on "In Global (default) policy this setting should be default value always and is not allowed to be changed", it will be "Follow org settings" by default and customers can't change this value

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Specifies the external domains allowed to communicate with users assigned to this policy. This setting is applicable only when CommunicationWithExternalOrgs is configured to AllowSpecificExternalDomains. This setting can be modified only in custom policy. In Global (default) policy CommunicationWithExternalOrgs can only be set to OrganizationDefault and cannot be changed.


```yaml
Type: List
Expand All @@ -181,7 +184,10 @@ Accept wildcard characters: False
```

### -BlockedExternalDomains
Indicates the domains that are blocked from communicating with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `BlockSpecificExternalDomains`.
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates the domains that are blocked from communicating with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `BlockSpecificExternalDomains`. Only custom policies can change this setting. In Global (default) policy this setting should be default value always and is not allowed to be changed.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Specifies the external domains blocked from communicating with users assigned to this policy. This setting is applicable only when CommunicationWithExternalOrgs is configured to BlockSpecificExternalDomains. This setting can be modified only in custom policy. In Global (default) policy CommunicationWithExternalOrgs can only be set to OrganizationDefault and cannot be changed.


Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu same question as above.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

replied above

```yaml
Type: List
Expand All @@ -196,14 +202,18 @@ Accept wildcard characters: False
```

### -CommunicationWithExternalOrgs
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates how the users get assigned by this policy can communicate with the external orgs. There are 5 options:
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indicates how users assigned to the policy can communicate with external organizations (domains). This setting has 5 possible values:


- OrganizationDefault: the users of this policy will follow the federation settings defined in TenantFederationConfiguration
- AllowAllExternalDomains: the users are open to communicate with all domains
- AllowSpecificExternalDomains: the users can only communicate with the users of the domains defined in `AllowedExternalDomains`
- BlockSpecificExternalDomains: only users from the domains defined in `BlockedExternalDomains` are blocked from communicating with the users of this policy
- BlockAllExternalDomains: the users are not able to communicate with any external domains
- OrganizationDefault: the users of this policy will follow the federation settings defined in TenantFederationConfiguration.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • OrganizationDefault: users follow the federation settings specified in TenantFederationConfiguration. This is the default value.

- AllowAllExternalDomains: the users are open to communicate with all domains.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • AllowAllExternalDomains: the users are allowed to communicate with all domains.

- AllowSpecificExternalDomains: the users can only communicate with the users of the domains defined in `AllowedExternalDomains`.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • AllowSpecificExternalDomains: the users can communicate with external domains listed in AllowedExternalDomains.

- BlockSpecificExternalDomains: only users from the domains defined in `BlockedExternalDomains` are blocked from communicating with the users of this policy.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • BlockSpecificExternalDomains: users are blocked from communicating with domains listed in BlockedExternalDomains

- BlockAllExternalDomains: the users are not able to communicate with any external domains.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • BlockAllExternalDomains: users cannot communicate with any external domains.


The setting only applies if `EnableFederationAccess` is true. Simiar to `AllowedExternalDomains` and `BlockedExternalDomains`, only custom policies can change this setting. In Global (default) policy this setting should be default value always and is not allowed to be changed.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu should we add clarity about what is the default value?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MJMicrosoft yes, the default value is listed below (line #214 before the change. line #224 in the new change)

Copy link

@akhilsoman akhilsoman May 13, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But that is not clear enough I feel . OrganizationDefault , is what it says right ? What I am missing is the default behavior

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @akhilsoman what's missing in your opinion based on "the users of this policy will follow the federation settings defined in TenantFederationConfiguration"? feel free to suggest. thanks!

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The setting is only applicable when EnableFederationAccess is set to true. This setting can only be modified in custom policies. In the Global (default) policy, it is fixed to OrganizationDefault and cannot be changed.

```yaml
Type: String
Parameter Sets: (All)
Expand Down
17 changes: 13 additions & 4 deletions teams/teams-ps/teams/Set-CsExternalAccessPolicy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,8 +155,7 @@ In this example, the Global policy is updated to allow Teams-ACS federation for
New-CsExternalAccessPolicy -Identity GranularFederationExample -CommunicationWithExternalOrgs "AllowSpecificExternalDomains" -AllowedExternalDomains @("example1.com", "example2.com")
Set-CsTenantFederationConfiguration -CustomizeFederation $true
```

In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains. After that, we still have to enable the `CustomizeFederation` setting in the TenantFederationConfiguration to allow the federation settings as defined in the ExternalAccessPolicy to work.
In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely `example1.com` and `example2.com`. The federation policy is set to restrict communication to only these allowed domains.

## PARAMETERS

Expand Down Expand Up @@ -200,7 +199,10 @@ Accept wildcard characters: False
```

### -AllowedExternalDomains
Indicates the domains that are allowed to communicate with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `AllowSpecificExternalDomains`
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates the domains that are allowed to communicate with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `AllowSpecificExternalDomains`. Only custom policies can change this setting. In Global (default) policy this setting should be default value always and is not allowed to be changed.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@krammerliu should we add clarity about what is the default value?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

default value is listed below, which is an empty list

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Specifies the external domains allowed to communicate with users assigned to this policy. This setting is applicable only when CommunicationWithExternalOrgs is configured to AllowSpecificExternalDomains. This setting can be modified only in custom policy. In Global (default) policy CommunicationWithExternalOrgs can only be set to OrganizationDefault and cannot be changed.

```yaml
Type: List
Parameter Sets: (All)
Expand All @@ -215,7 +217,10 @@ Accept wildcard characters: False
```

### -BlockedExternalDomains
Indicates the domains that are blocked from communicating with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `BlockSpecificExternalDomains`
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates the domains that are blocked from communicating with the users of this policy. This is referenced only when `CommunicationWithExternalOrgs` is set to be `BlockSpecificExternalDomains`. Only custom policies can change this setting. In Global (default) policy this setting should be default value always and is not allowed to be changed.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Specifies the external domains blocked from communicating with users assigned to this policy. This setting is applicable only when CommunicationWithExternalOrgs is configured to BlockSpecificExternalDomains. This setting can be modified only in custom policy. In Global (default) policy CommunicationWithExternalOrgs can only be set to OrganizationDefault and cannot be changed.

```yaml
Type: List
Parameter Sets: (All)
Expand All @@ -230,6 +235,9 @@ Accept wildcard characters: False
```

### -CommunicationWithExternalOrgs
> [!NOTE]
> Please note that this parameter is in Private Preview.

Indicates how the users get assigned by this policy can communicate with the external orgs. There are 5 options:

- OrganizationDefault: the users of this policy will follow the federation settings defined in TenantFederationConfiguration.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-OrganizationDefault: users follow the federation settings specified in TenantFederationConfiguration. This is the default value.

Expand All @@ -238,6 +246,7 @@ Indicates how the users get assigned by this policy can communicate with the ext
- BlockSpecificExternalDomains: only users from the domains defined in `BlockedExternalDomains` are blocked from communicating with the users of this policy.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-BlockSpecificExternalDomains: users are blocked from communicating with domains listed in BlockedExternalDomains

- BlockAllExternalDomains: the users are not able to communicate with any external domains.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-BlockAllExternalDomains: users cannot communicate with any external domains.


The setting only applies if `EnableFederationAccess` is true. Simiar to `AllowedExternalDomains` and `BlockedExternalDomains`, only custom policies can change this setting. In Global (default) policy this setting should be default value always and is not allowed to be changed.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The setting is only applicable when EnableFederationAccess is set to true. This setting can only be modified in custom policies. In the Global (default) policy, it is fixed to OrganizationDefault and cannot be changed.

```yaml
Type: String
Parameter Sets: (All)
Expand Down