Teams guest and external access - cannot get it to work!

[3s-gtech]

Hi all. Tearing my hair out with Teams here.

 

Some limited organisations and accounts, I can setup a meeting on our tenant and join it from that external account. For the majority, in testing, I get an error saying "This meeting doesn't allow guests. Please contact organiser." and I can't connect.

 

Guest access in the tenant is on. External federation is on. It's turned on when I check via Powershell. No matter what I do, I cannot schedule a meeting to these external accounts and it actually connect, and it's got to the point where SLT are on at me about it (seeming to believe that pressure = results - telling me it's really important does not make it easier to fix).

 

Any ideas? Google-fu weak - I have been through a lot of links already.

[bezzoh]

You need to enable unauthenticated access to meetings, not just guest access. I've been through that pain before.

[3s-gtech]

I have enabled that one today - though it may not have kicked in yet because having a random time delay makes testing even more fun!

[bezzoh]

You need to enable unauthenticated access to meetings, not just guest access. I've been through that pain before.

 

Which then brings its own difficulties, in kids inviting their mates in from private email addresses who start abusing your staff... because they've let them in without monitoring the lobby properly. - So before doing that, make sure lobby policies are setup properly and even look at applying a school avatar to all your students for ease of identification. That way anyone even with the name of someone legitimately in the meeting without the school avatar can be ignored.

[psydii]

Assuming that anonymous access hasn't solved it (but it may well have if the address you are inviting are not part of a well established authentication federation)

 

Are they guests from another tenant? Could it be *their* policy that is blocking?

 

Either way, I'd raise a ticket via admin.microsoft.com

Edited February 3, 2022 by psydii

[3s-gtech]

Some are guests from other tenants (and some of these work) and some are guests via personal email addresses (which aren't working to my accounts). I definitely think it's an issue with our tenant.

[3s-gtech]

You need to enable unauthenticated access to meetings, not just guest access. I've been through that pain before.

Tried the same call today, to a particular email address that didn't work yesterday (not signing in as Guest) and it works, having changed that setting - so thanks for the affirmation. It's looking hopeful - very weird how that setting is needed!

 

Which then brings its own difficulties, in kids inviting their mates in from private email addresses who start abusing your staff... because they've let them in without monitoring the lobby properly. - So before doing that, make sure lobby policies are setup properly and even look at applying a school avatar to all your students for ease of identification. That way anyone even with the name of someone legitimately in the meeting without the school avatar can be ignored.

 

Not too worried about that at the moment, as we're not doing live lessons. I did put in place the instructions for lobbies for staff though!

Edited February 4, 2022 by 3s-gtech

[Andycat]

Tried the same call today, to a particular email address that didn't work yesterday (not signing in as Guest) and it works, having changed that setting - so thanks for the affirmation. It's looking hopeful - very weird how that setting is needed!

 

Ooo where was this setting, we can only do it with Anonymous access at the mo, which isn't ideal. Not spotted this one...

[3s-gtech]

It's the same setting, "Anonymous users can join a meeting" - it's hacky that this is needed but seemingly the only fix at the moment (unless MS could do it on a support call?)

[Andycat]

It's the same setting, "Anonymous users can join a meeting" - it's hacky that this is needed but seemingly the only fix at the moment (unless MS could do it on a support call?)

 

Yes, that opens the floodgates but has been the only way we can do it too. Got a careers thing in 2 weeks that needs parents/companies/private email users to Teams in and we were hoping there was a more secure way. Ho hum.