Microsoft Teams Security Best Practices for UK Businesses

Why does Microsoft Teams security matter for UK businesses?

Teams is now one of the most data-rich systems most UK firms run. It carries commercially sensitive negotiations, HR matters, financial approvals and strategic plans, while every file shared lives in SharePoint and every recording in OneDrive. That concentration of data, plus heavy external collaboration, makes it a target worth securing properly.

Attackers have noticed. The NCSC treats messaging and collaboration platforms as prime ground for social engineering, and phishing remains the single most common attack type reported by UK businesses in the government's Cyber Security Breaches Survey 2025. Once an attacker compromises one Microsoft 365 account, Teams chat becomes a trusted channel to impersonate colleagues and approve payments.

The default settings make this worse. Guest access, external federation, anonymous meeting join and open app installation all ship switched on, prioritising ease of use over containment. Tightening them — alongside Conditional Access — is the work that turns a usable platform into a safe one.

How do you control guest access in Microsoft Teams?

Guest access lets people outside your organisation join teams and channels using any email address. It is genuinely useful for client and supplier collaboration, but uncontrolled it becomes the most common Teams data-exposure route. The fix is to limit who can invite, force MFA on guests, and review accounts on a schedule.

By default a guest can read and post in channels they are added to, join meetings, and open files in those channels. They cannot create teams, invite other guests, or reach the admin centre. The problems are accumulation and scope: guests rarely get removed, and a guest invited at team level can often see every non-private channel in that team.

Recommended configuration:

• Restrict guest invitations to administrators and named roles, not all users.
• Require MFA for guests through Conditional Access — see MFA setup for Microsoft 365.
• Run Access Reviews in Microsoft Entra ID P2 so stale guests are re-confirmed or removed.
• Use private channels for sensitive topics when external guests sit in a team.
• Scope external federation to named partner domains, not "any organisation". See Microsoft's guest access guidance.

How do you secure Teams meetings?

External meetings are now the default for client and supplier calls, and anyone holding a meeting link can often join without challenge. Three controls close that gap: a lobby that holds external attendees until admitted, disabled anonymous join for sensitive calls, and recording policies that stop sessions being shared or kept forever.

• Lobby: admit only people in your organisation (and invited guests) automatically; never auto-admit dial-in callers.
• Anonymous join: disable it at tenant or policy level for internal and sensitive external meetings.
• Recordings: control who can record, who recordings auto-share with, and set expiry so they do not persist indefinitely.

Recordings inherit SharePoint and OneDrive access controls, so a single over-shared recording can expose a confidential discussion to every attendee, including guests. Treat recording governance as part of your wider data protection obligations under UK GDPR.

How do you stop sensitive data leaking from Teams?

Teams files are SharePoint and OneDrive files, so Teams sharing risk is SharePoint sharing risk. The strongest control is Microsoft Purview sensitivity labels, included in Microsoft 365 Business Premium, which can stamp a team as "Confidential" and automatically enforce its privacy, guest and external-sharing rules rather than relying on each owner to get it right.

• Apply sensitivity labels to teams to auto-configure guest and external-sharing behaviour.
• Set SharePoint external sharing to authenticated external users only — never anonymous links.
• Use Microsoft Intune compliance policies with Conditional Access to block or browser-restrict Teams on unmanaged devices; see Microsoft Intune.
• Turn on Data Loss Prevention to detect and block regulated data types leaving a chat.

How do you manage third-party app permissions in Teams?

Teams supports thousands of third-party apps, and each one requests permissions to read messages, open files, or act on a user's behalf. Left open, any user can install anything, which creates two real risks: over-permissioned apps reaching sensitive data, and OAuth consent phishing where a malicious app tricks staff into granting it access.

Bring this under governance:

• Allow only Microsoft-published apps or ones you have explicitly approved in the Teams admin centre.
• Review the global app permission policy — the default lets every user add apps.
• Use Entra ID App Governance to monitor consented permissions and flag unusual access patterns.

This pairs naturally with endpoint and identity protection from Microsoft Defender for Business, which gives you the telemetry to spot a compromised account before it abuses an app grant.

How does Teams phishing work, and how do you stop it?

As email defences improve, attackers move to Teams. Tactics include impersonation accounts using names close to real contacts, compromised supplier tenants messaging your staff through existing federation, and malicious links pasted into chat. Defence needs both technical filtering and trained scepticism — the NCSC's phishing guidance applies to Teams as much as email.

Microsoft Defender for Office 365 Safe Links can sandbox URLs inside Teams messages, but it is not always enabled for Teams by default — confirm the policy covers Teams, not just email. Defender does not read message body content the way it scans email, so user awareness remains essential: verify unexpected payment or credential requests through a known phone number, never the chat thread that made them.

What about Teams voice security and the 2025 PSTN switch-off?

Many UK firms are moving voice onto Microsoft Teams Direct Routing ahead of the 2025 PSTN switch-off, which adds voice-specific risks on top of collaboration ones. Call recordings need the same information governance as other sensitive data, SIP trunks must be configured to block toll fraud, and emergency call routing has to be verified because Teams handles it differently from a traditional line.

How much does securing Microsoft Teams cost?

The technical controls above are licensing-dependent, and the controls that matter most — Defender for Office 365 Safe Links and Purview sensitivity labels — live in Microsoft 365 Business Premium. The table below shows Microsoft's UK list prices; AMVIA's role is configuring and managing these features, not reselling licences.

Prices are Microsoft UK list prices via Microsoft 365 plans. Business Premium is the practical baseline for the Teams hardening described here.

Default Teams vs AMVIA-hardened Teams

The difference between a secure Teams tenant and an exposed one is configuration, not licensing alone. This is what changes when AMVIA takes it on.

How does AMVIA secure Microsoft Teams?

AMVIA configures Teams security as a standard component of its managed Microsoft 365 service: one provider, security-first, Microsoft-certified engineers. We audit current Teams settings against NCSC guidance, then own the configuration and the ongoing reviews so it does not drift.

• Audit of Teams admin settings against NCSC guidance.
• Guest access policy and cleanup of stale guest accounts.
• Meeting and recording policy configuration for external calls.
• App permission governance in the Teams admin centre.
• Safe Links extended to Teams in Defender for Office 365.
• Purview sensitivity labels for Teams information protection.
• Quarterly review of guest accounts and app permissions.