Teams External Access With Trial Tenants
Query
CloudAppEvents
| where ActionType == "TeamsAdminAction"
| where RawEventData has "ExternalAccessWithTrialTenants"
| extend ModifiedProperties = parse_json(RawEventData).ModifiedProperties
| mv-apply ModifiedProperties on
(
where ModifiedProperties.Name == "ExternalAccessWithTrialTenants"
| project
PropertyName = tostring(ModifiedProperties.Name),
NewValue = tostring(ModifiedProperties.NewValue),
OldValue = tostring(ModifiedProperties.OldValue)
)
| project
TimeGenerated,
ActionType,
AccountDisplayName,
PropertyName,
OldValue,
NewValue,
RawEventDataAbout this query
Explanation
This KQL query is designed to monitor changes in Microsoft Teams settings related to external communication with trial-only tenants. Specifically, it tracks when the ExternalAccessWithTrialTenants setting is altered between Blocked and Allowed. This setting determines whether users can interact with trial tenants, which are organizations using Teams without purchasing licenses. Allowing communication with these tenants can increase the risk of spam, social engineering, and unauthorized contact, as attackers have previously exploited trial tenants. The query extracts information about these changes, including the time of the change, the administrator who made the change, and the previous and new values of the setting. This helps organizations identify potentially risky changes early and take appropriate action.
Details
Alex Verboon
Released: June 1, 2026
Tables
Keywords
Operators