New-CsExternalAccessPolicy — usage, script and reference

Quick start script

# New-CsExternalAccessPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-MicrosoftTeams -CertificateThumbprint $thumb -ApplicationId $appId -TenantId $tenantId

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-CsExternalAccessPolicy
$before | Format-List

# 3. Make the change (dry run first)
New-CsExternalAccessPolicy -Identity <XdsIdentity> -WhatIf
New-CsExternalAccessPolicy -Identity <XdsIdentity>

# 4. Verify and diff
$after = Get-CsExternalAccessPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-CsExternalAccessPolicy [-Identity] <XdsIdentity>
 [-AllowedExternalDomains <List>]
 [-BlockedExternalDomains <List>]
 [-CommunicationWithExternalOrgs <String>]
 [-Confirm]
 [-Description <String>]
 [-EnableAcsFederationAccess <Boolean>]
 [-EnableFederationAccess <Boolean>]
 [-EnableOutsideAccess <Boolean>]
 [-EnablePublicCloudAudioVideoAccess <Boolean>]
 [-EnableTeamsConsumerAccess <Boolean>]
 [-EnableTeamsConsumerInbound <Boolean>]
 [-EnableTeamsSmsAccess <Boolean>]
 [-EnableXmppAccess <Boolean>]
 [-FederatedBilateralChats <Boolean>]
 [-Force]
 [-InMemory]
 [-RestrictTeamsConsumerAccessToExternalUserProfiles <Boolean>]
 [-Tenant <Guid>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (20)

Parameter	Type	Required	What it controls
-AllowedExternalDomains	List		Specifies the external domains allowed to communicate with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `AllowSpecificExternalDomains`. This...
-BlockedExternalDomains	List		Specifies the external domains blocked from communicating with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `BlockSpecificExternalDomains`. This...
-CommunicationWithExternalOrgs	String		Indicates how users assigned to the policy can communicate with external organizations (domains). This setting has 5 possible values:
-Confirm	SwitchParameter		Prompts you for confirmation before executing the command.
-Description	String		Enables administrators to provide explanatory text to accompany the policy. For example, the Description might include information about the users the policy should be assigned to.
-EnableAcsFederationAccess	Boolean		Indicates whether Teams meetings organized by the user can be joined by users of customer applications built using Azure Communication Services (ACS). This policy setting only applies if ACS Teams federation has been...
-EnableFederationAccess	Boolean		Indicates whether the user is allowed to communicate with people who have SIP accounts with a federated organization. Read [Manage external access in Microsoft...
-EnableOutsideAccess	Boolean		Indicates whether the user is allowed to connect to Skype for Business Server over the Internet, without logging on to the organization's internal network. The default value is False.
-EnablePublicCloudAudioVideoAccess	Boolean		Indicates whether the user is allowed to conduct audio/video conversations with people who have SIP accounts with a public Internet connectivity provider such as MSN. When set to False, audio and video options in...
-EnableTeamsConsumerAccess	Boolean		(Microsoft Teams Only) Indicates whether the user is allowed to communicate with people who have who are using Teams with an account that's not managed by an organization.
-EnableTeamsConsumerInbound	Boolean		(Microsoft Teams Only) Indicates whether the user is allowed to be discoverable by people who are using Teams with an account that's not managed by an organization. It also controls if people who have who are using...
-EnableTeamsSmsAccess	Boolean		Allows you to control whether users can have SMS text messaging capabilities within Teams.
-EnableXmppAccess	Boolean		Indicates whether the user is allowed to communicate with users who have SIP accounts with a federated XMPP (Extensible Messaging and Presence Protocol) partner. The default value is False.
-FederatedBilateralChats	Boolean		This setting enables bi-lateral chats for the users included in the messaging policy.
-Force	SwitchParameter		Suppresses the display of any non-fatal error message that might occur when running the command.
-Identity	XdsIdentity	yes	Unique Identity to be assigned to the policy. New external access policies can be created at the site or per-user scope.
-InMemory	SwitchParameter		Creates an object reference without actually committing the object as a permanent change. If you assign the output of this cmdlet called with this parameter to a variable, you can make changes to the properties of...
-RestrictTeamsConsumerAccessToExternalUserProfiles	Boolean		Defines if a user is restricted to collaboration with Teams Consumer (TFL) user only in Extended Directory
-Tenant	Guid		Globally unique identifier (GUID) of the Skype for Business Online tenant account for whom the new external access policy is being created. For example:
-WhatIf	SwitchParameter		Describes what would happen if you executed the command without actually executing the command.