Sep 4, 2026: Microsoft Teams Cross-Tenant Phishing Resilience & Remediation

What's Happening:

Attackers are leveraging a free-trial service within Microsoft 365 to create onmicrosoft[.]com subdomains to send phishing messages via Microsoft Teams.

Over the past few weeks, Expel’s SOC has observed an increase in attackers leveraging Microsoft Teams to deliver phishing messages to users. These messages typically impersonate an IT user or group to socially engineer users into joining a Teams call with the attacker. During this call, attackers will convince the user to download a Remote Monitoring and Management (RMM) tool, granting the attacker access to the environment.

These messages typically include domain prefixes that look similar to “helpdesk.onmicrosoft[.]com” or “itservicedesk.onmicrosoft[.]com” and may even become as targeted as to include your organization’s name in the domain. Attackers are able to create these onmicrosoft[.]com subdomains quickly and effortlessly by signing up for a Microsoft 365 Business Trial or joining the Microsoft 365 Developer Program; blocking one domain is not enough to stop these phishing messages.

Why It Matters:

Microsoft Teams users may not be aware of an attacker’s ability to leverage Microsoft Teams' cross-tenant messaging feature to send phishing messages and could fall victim to messages they believe are being sent from a trusted source.

What You Need to Do:

Evaluate the following Microsoft Teams resilience recommendations to fortify your Teams infrastructure.

Note that blocking these domains reduces this attack vector, but the impact isn’t zero for every tenant. Before applying this, review who you currently communicate with over Teams federation. If any legitimate partner, vendor, or contractor is still operating on an unconfigured default onmicrosoft.com subdomain, this change will affect them, too. Specifically, Microsoft’s documented behavior is that turning on subdomain blocking will disable any existing 1:1 chats with users from newly blocked subdomains, and will remove those users from any existing group chats. Check your active external contacts first so you’re not caught off guard by a disrupted conversation with a real partner.

Choose one of two options depending on your use case:

Option 1: Block All .onmicrosoft[.]com Domains/SubDomains This option is best for organizations who communicate frequently with other organizations via Microsoft Teams. Warning: this flag is tenant-wide, not per-entry. Once enabled, every domain already on your blocked list also blocks its subdomains (blocking company[.]com will now also block mail[.]company[.]com). Review your existing block list first. Note it matches true subdomains only; sub-company[.]com, for example, is a different registrable domain and still needs its own entry.

Prerequisites

1. You must have permission to run PowerShell commands as a Teams Administrator.

2. You must be running Teams PowerShell module 6.4.0+.

   • If you need to install the latest version, run the following commands:

Install-Module MicrosoftTeams -Scope CurrentUser -Force
Import-Module MicrosoftTeams
Connect-MicrosoftTeams

Step 1: Add onmicrosoft.com to the Blocked Domains List

1. In PowerShell, run the following commands:

$moera = New-CsEdgeDomainPattern -Domain "onmicrosoft.com"
Set-CsTenantFederationConfiguration -BlockedDomains @{Add=$moera}

The @{Add=...} syntax appends new values instead of overwriting existing entries.

Step 2: Enable Tenant-wide Subdomain Blocking

This step is required to block *.onmicrosoft.com. Teams does not block subdomains by default, so Step 1 on its own has no effect. There is no admin center configuration available; this is PowerShell-only.

1. In Powershell, run:

Set-CsTenantFederationConfiguration -BlockAllSubdomains $True

Option 2: Configure External/Spam Filtering and Inbound Call Routing for Inbound Teams Messages and Calls This option is best for organizations who communicate with few (or a fixed list) of organizations via Microsoft Teams. If you are an organization who frequently communicates with new organizations, we recommend using Option 1 as maintaining an approved list of organizations may become impractical.

Prerequisites

1. You must have Administrator privileges in Microsoft Teams console.

Step 1: Configure Spam Filtering Call Routing

Spam filtering is on by default. In this step, you'll confirm this setting hasn't been disabled.

1. In the left navigation of the Microsoft Teams admin center, select Voice > Calling policies.

2. Choose the policy you would like to update, or select Add to create a new policy.

3. Select an option for Routing for PSTN calls. Select Send to voicemail if external calls should always be sent to voicemail. Learn more about these options in Microsoft's documentation.

4. Select Save.

Step 2: Block All External Domains

Next you will use the Teams admin center to configure the external access settings. Choosing to allow specific external domains and then adding only your internal domains to the allow list will effectively block all other domains from accessing your organization's Teams.

1. In the Teams admin center, go to Users > External access.

2. Next to "Teams and Skype for Business users in external organizations", choose Allow only specific external domains.

3. Select Add external domains.

4. In the Domain box, enter any internal domain(s) that you want to allow, and then select Done.

5. Select Done.