Set-CsExternalAccessPolicy — usage, script and reference

Quick start script

# Set-CsExternalAccessPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-MicrosoftTeams -CertificateThumbprint $thumb -ApplicationId $appId -TenantId $tenantId

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-CsExternalAccessPolicy
$before | Format-List

# 3. Make the change (dry run first)
Set-CsExternalAccessPolicy  -WhatIf
Set-CsExternalAccessPolicy

# 4. Verify and diff
$after = Get-CsExternalAccessPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 2 parameter sets

Identity (Default)

Set-CsExternalAccessPolicy [[-Identity] <XdsIdentity>]
 [-AllowedExternalDomains <List>]
 [-BlockedExternalDomains <List>]
 [-CommunicationWithExternalOrgs <String>]
 [-Confirm]
 [-Description <String>]
 [-EnableAcsFederationAccess <Boolean>]
 [-EnableFederationAccess <Boolean>]
 [-EnableOutsideAccess <Boolean>]
 [-EnablePublicCloudAudioVideoAccess <Boolean>]
 [-EnableTeamsConsumerAccess <Boolean>]
 [-EnableTeamsConsumerInbound <Boolean>]
 [-EnableTeamsSmsAccess <Boolean>]
 [-EnableXmppAccess <Boolean>]
 [-FederatedBilateralChats <Boolean>]
 [-Force]
 [-RestrictTeamsConsumerAccessToExternalUserProfiles <Boolean>]
 [-Tenant <Guid>]
 [-WhatIf]
 [<CommonParameters>]

Instance

Set-CsExternalAccessPolicy [-Instance <PSObject>]
 [-AllowedExternalDomains <List>]
 [-BlockedExternalDomains <List>]
 [-CommunicationWithExternalOrgs <String>]
 [-Confirm]
 [-Description <String>]
 [-EnableAcsFederationAccess <Boolean>]
 [-EnableFederationAccess <Boolean>]
 [-EnableOutsideAccess <Boolean>]
 [-EnablePublicCloudAudioVideoAccess <Boolean>]
 [-EnableTeamsConsumerAccess <Boolean>]
 [-EnableTeamsConsumerInbound <Boolean>]
 [-EnableTeamsSmsAccess <Boolean>]
 [-EnableXmppAccess <Boolean>]
 [-FederatedBilateralChats <Boolean>]
 [-Force]
 [-RestrictTeamsConsumerAccessToExternalUserProfiles <Boolean>]
 [-Tenant <Guid>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (20)

Parameter	Type	What it controls
-AllowedExternalDomains	List	Specifies the external domains allowed to communicate with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `AllowSpecificExternalDomains`. This...
-BlockedExternalDomains	List	Specifies the external domains blocked from communicating with users assigned to this policy. This setting is applicable only when `CommunicationWithExternalOrgs` is configured to `BlockSpecificExternalDomains`. This...
-CommunicationWithExternalOrgs	String	Indicates how the users get assigned by this policy can communicate with the external orgs. There are 5 options:
-Confirm	SwitchParameter	Prompts you for confirmation before executing the command.
-Description	String	Enables administrators to provide additional text to accompany the policy. For example, the Description might include information about the users the policy should be assigned to.
-EnableAcsFederationAccess	Boolean	Indicates whether Teams meeting organized by the user can be joined by users of customer applications built using Azure Communication Services (ACS). This policy setting only applies if ACS Teams federation has been...
-EnableFederationAccess	Boolean	Indicates whether the user is allowed to communicate with people who have SIP accounts with a federated organization. Read [Manage external access in Microsoft...
-EnableOutsideAccess	Boolean	Indicates whether the user is allowed to connect to Skype for Business Server over the Internet, without logging on to the organization's internal network. The default value is False.
-EnablePublicCloudAudioVideoAccess	Boolean	Indicates whether the user is allowed to conduct audio/video conversations with people who have SIP accounts with a public Internet connectivity provider such as MSN. When set to False, audio and video options in...
-EnableTeamsConsumerAccess	Boolean	(Microsoft Teams Only) Indicates whether the user is allowed to communicate with people who have who are using Teams with an account that's not managed by an organization.
-EnableTeamsConsumerInbound	Boolean	(Microsoft Teams Only) Indicates whether the user is allowed to be discoverable by people who are using Teams with an account that's not managed by an organization. It also controls if people who have who are using...
-EnableTeamsSmsAccess	Boolean	Allows you to control whether users can have SMS text messaging capabilities within Teams. Possible Values: True, False
-EnableXmppAccess	Boolean	Indicates whether the user is allowed to communicate with users who have SIP accounts with a federated XMPP (Extensible Messaging and Presence Protocol) partner. The default value is False.
-FederatedBilateralChats	Boolean	This setting enables bi-lateral chats for the users included in the messaging policy.
-Force	SwitchParameter	Suppresses the display of any non-fatal error message that might occur when running the command.
-Identity	XdsIdentity	Unique identifier for the external access policy to be modified. External access policies can be configured at the global, site, or per-user scopes. To modify the global policy, use this syntax: `-Identity global`....
-Instance	PSObject	Allows you to pass a reference to an object to the cmdlet rather than set individual parameter values.
-RestrictTeamsConsumerAccessToExternalUserProfiles	Boolean	Defines if a user is restriced to collaboration with Teams Consumer (TFL) user only in Extended Directory Possible Values: True, False
-Tenant	Guid	Globally unique identifier (GUID) of the Skype for Business Online tenant account for whom the external access policy is being modified. For example:
-WhatIf	SwitchParameter	Describes what would happen if you executed the command without actually executing the command.