Commands › Microsoft Teams
Set-CsTenantFederationConfiguration
Manages federation configuration settings for your Skype for Business Online tenants.
Quick start script
# Set-CsTenantFederationConfiguration — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-MicrosoftTeams -CertificateThumbprint $thumb -ApplicationId $appId -TenantId $tenantId
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-CsTenantFederationConfiguration
$before | Format-List
# 3. Make the change (dry run first)
Set-CsTenantFederationConfiguration -WhatIf
Set-CsTenantFederationConfiguration
# 4. Verify and diff
$after = Get-CsTenantFederationConfiguration
Compare-Object ($before | Out-String) ($after | Out-String)Syntax — 2 parameter sets
Identity (Default)
Set-CsTenantFederationConfiguration [-Tenant <Guid>]
[-AllowedDomains <IAllowedDomainsChoice>] [-BlockedDomains <List>] [-BlockAllSubdomains <Boolean>]
[-AllowFederatedUsers <Boolean>] [-AllowTeamsConsumer <Boolean>] [-AllowTeamsConsumerInbound <Boolean>]
[-TreatDiscoveredPartnersAsUnverified <Boolean>] [-SharedSipAddressSpace <Boolean>] [-RestrictTeamsConsumerToExternalUserProfiles <Boolean>]
[-AllowedDomainsAsAList <List>] [-ExternalAccessWithTrialTenants <ExternalAccessWithTrialTenantsType>]
[-SecurityTeamAllowBlockListDelegation <SecurityTeamAllowBlockListDelegationType>]
[-AllowedTrialTenantDomains <List>]
[-EnableExternalAccessRestrictionsForChatParticipants <Boolean>]
[-EnableMutualFederationForChatParticipants <Boolean>]
[[-Identity] <XdsIdentity>] [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]Instance
Set-CsTenantFederationConfiguration [-Tenant <Guid>] [-AllowedDomains <IAllowedDomainsChoice>]
[-BlockedDomains <List>] [-BlockAllSubdomains <Boolean>] [-AllowFederatedUsers <Boolean>]
[-TreatDiscoveredPartnersAsUnverified <Boolean>] [-SharedSipAddressSpace <Boolean>] [-RestrictTeamsConsumerToExternalUserProfiles <Boolean>]
[-AllowedDomainsAsAList <List>]
[-EnableExternalAccessRestrictionsForChatParticipants <Boolean>]
[-EnableMutualFederationForChatParticipants <Boolean>]
[-Instance <PSObject>] [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]Parameters (21)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -AllowedDomains | Boolean | Domain objects (created by using the `New-CsEdgeAllowList` cmdlet or the `New-CsEdgeAllowAllKnownDomains` cmdlet) that represent the domains that users are allowed to communicate with. If the... | |
| -AllowedDomainsAsAList | List | You can specify allowed domains using a List object that contains the domains that users are allowed to communicate with. See Examples section. | |
| -AllowedTrialTenantDomains | List | You can safelist specific "trial-only" tenant domains, while keeping the `ExternalAccessWithTrialTenants` set to `Blocked`. This will allow you to protect your organization against majority of tenants that don't have... | |
| -AllowFederatedUsers | Boolean | When set to True (the default value) users will be potentially allowed to communicate with users from other domains. If this property is set to False then users cannot communicate with users from other domains,... | |
| -AllowTeamsConsumer | Boolean | Allows federation with people using Teams with an account that's not managed by an organization. | |
| -AllowTeamsConsumerInbound | Boolean | Allows people using Teams with an account that's not managed by an organization, to discover and start communication with users in your organization. When -AllowTeamsConsumer is enabled and this parameter is... | |
| -BlockAllSubdomains | SwitchParameter | If the BlockedDomains parameter is used, then BlockAllSubdomains can be used to activate all subdomains blocking. If the BlockedDomains parameter is ignored, then BlockAllSubdomains is also ignored. Just like for... | |
| -BlockedDomains | List | If the AllowedDomains property has been set to AllowAllKnownDomains, then users will be allowed to communicate with users from any domain except domains that appear in the blocked domains list. If the AllowedDomains... | |
| -Confirm | SwitchParameter | Prompts you for confirmation before executing the command. | |
| -SecurityTeamAllowBlockListDelegation | SecurityTeamAllowBlockListDelegationType | When set to 'Enabled', security operations team will be able to add domains and users to the blocklist on security portal. | |
| -ExternalAccessWithTrialTenants | ExternalAccessWithTrialTenantsType | When set to 'Blocked', all external access with users from Teams subscriptions that contain only trial licenses will be blocked. This means users from these trial-only tenants will not be able to reach to your users... | |
| -EnableExternalAccessRestrictionsForChatParticipants | EnableExternalAccessRestrictionsForChatParticipants | When set to False (the default value), users in the tenant who have `EnableFederationAccess` set to False in their assigned `ExternalAccessPolicy` can be added to group chats that include external users only when the... | |
| -EnableMutualFederationForChatParticipants | EnableMutualFederationForChatParticipants | This parameter specifies whether additional mutual federation requirements are extended across all participants in a group chat. Mutual federation relationships are determined by each user’s effective external access... | |
| -Force | SwitchParameter | Suppresses the display of any non-fatal error message that might arise when running the command. | |
| -Identity | XdsIdentity | Specifies the collection of tenant federation configuration settings to be modified. Because each tenant is limited to a single, global collection of federation settings there is no need to include this parameter... | |
| -Instance | PSObject | Allows you to pass a reference to an object to the cmdlet rather than set individual parameter values. | |
| -RestrictTeamsConsumerToExternalUserProfiles | Boolean | Defines if a user is restricted to collaboration with Teams Consumer (TFL) user only in Extended Directory. Possible values: True, False | |
| -SharedSipAddressSpace | Boolean | When set to True, indicates that the users homed on Skype for Business Online use the same SIP domain as users homed on the on-premises version of Skype for Business Server. The default value is False, meaning that... | |
| -Tenant | Guid | Globally unique identifier (GUID) of the tenant account whose federation settings are being modified. For example: | |
| -TreatDiscoveredPartnersAsUnverified | Boolean | When set to True, messages sent from discovered partners are considered unverified. That means that those messages will be delivered only if they were sent from a person who is on the recipient's Contacts list. The... | |
| -WhatIf | SwitchParameter | Describes what would happen if you executed the command without actually executing the command. |
Message Center changes mentioning this command
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.