Know What's Happening in SaaS

Microsoft Teams Guest Access Could Let Hackers Bypass some Critical Security Protections

Microsoft Teams recently enabled a guest chat feature that lets any user start a conversation with an external email address, even if the recipient does not use Teams. The feature is turned on by default for many small‑business licenses and creates an unprotected attack vector, allowing malicious actors to share malware or phishing links without triggering typical security alerts. Researchers at Ontinue warn that guests inherit the host’s security posture, so a compromised host can bypass the victim’s own defenses. Microsoft has not publicly responded to the findings.