⚙️🪟🧑💼CP - Teams - Block other tenant sign-in
What this policy is about 🛑
We love Microsoft Teams.
We don’t love when users suddenly log in with an account from some completely unrelated tenant “because it was convenient.”
This policy says:
“If you’re not one of us, you’re not logging in.”
The result: no random tenants in your Teams client, no unexplained chats with unmanaged environments, and no “accidental” data leaks.
Why? 🤨
Cross-tenant logins might look harmless, but:
- You don’t know who manages that other tenant (if anyone)
- You can’t enforce compliance or logging
- You lose all visibility into where your data ends up
Unless you’re in the middle of a merger, acquisition, or cross-tenant migration, there’s simply no reason to keep this door open.
🛠️ Configuration
Type: Settings Catalog
| Setting | State | Details |
|---|---|---|
| Microsoft Teams → Restrict sign in to Teams to accounts in specific tenants (User) | Enabled | Tenant IDs (User): ${SUPERVISION_TENANTID} |
Only our own tenant ID is allowed. Period.
💡 SuperVision Tip
Never hardcode a tenant ID.
With ${SUPERVISION_TENANTID}, SuperVision will automatically inject the correct value for each customer environment.
That makes your blueprint instantly multi-tenant ready and prevents awkward “oops, wrong tenant” moments.
👥 Group Assignments
✅ Included:
All Users
❌ Excluded:
🔗 Related
Need to temporarily allow someone to log into another tenant?
Use the ⚙️🪟🧑💼🔓CP - Teams - Allow other tenant sign-in.
With approval. And a good reason. And probably a raised eyebrow.
Governance Check ✅
Shadow IT is like mold: it grows in the dark, and when you notice it, it’s usually too late.
Document your exceptions, get them approved, and remove them when they’re no longer needed.