CyberDrain · KelvinTegelaar · Aug 15, 2026 · Aug 15, 2026
diff --git a/backend/Config/BaselineStandards/Teams Standards/TeamsExternalAccessPolicy.json b/backend/Config/BaselineStandards/Teams Standards/TeamsExternalAccessPolicy.json
@@ -37,11 +37,22 @@
       "type": "switch",
       "label": "Allow communication with unmanaged Teams accounts",
       "default": false
+    },
+    "EnableTeamsConsumerInbound": {
+      "type": "switch",
+      "label": "Allow unmanaged Teams users to initiate contact",
+      "default": false,
+      "condition": {
+        "field": "EnableTeamsConsumerAccess",
+        "compareType": "is",
+        "compareValue": true
+      }
     }
   },
   "expected": {
     "EnableFederationAccess": "%EnableFederationAccess%",
-    "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%"
+    "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%",
+    "EnableTeamsConsumerInbound": "%EnableTeamsConsumerInbound%"
   },
   "read": {
     "cacheType": "CsExternalAccessPolicy"
@@ -53,7 +64,8 @@
         "cmdlet": "Set-CsExternalAccessPolicy",
         "params": {
           "EnableFederationAccess": "%EnableFederationAccess%",
-          "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%"
+          "EnableTeamsConsumerAccess": "%EnableTeamsConsumerAccess%",
+          "EnableTeamsConsumerInbound": "%EnableTeamsConsumerInbound%"
         }
       }
     ]

diff --git a/backend/Config/standards.json b/backend/Config/standards.json
@@ -6021,6 +6021,16 @@
         "type": "switch",
         "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess",
         "label": "Allow communication with unmanaged Teams accounts"
+      },
+      {
+        "type": "switch",
+        "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerInbound",
+        "label": "Allow unmanaged Teams users to initiate contact",
+        "condition": {
+          "field": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess",
+          "compareType": "is",
+          "compareValue": true
+        }
       }
     ],
     "label": "External Access Settings for Microsoft Teams",
@@ -6045,6 +6055,16 @@
         "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumer",
         "label": "Allow users to communicate with consumer Teams accounts"
       },
+      {
+        "type": "switch",
+        "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumerInbound",
+        "label": "Allow unmanaged Teams users to initiate contact",
+        "condition": {
+          "field": "standards.TeamsFederationConfiguration.AllowTeamsConsumer",
+          "compareType": "is",
+          "compareValue": true
+        }
+      },
       {
         "type": "autoComplete",
         "required": true,

diff --git a/backend/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1 b/backend/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1
@@ -84,12 +84,12 @@ function Get-CippTestDataFieldManifest {
             'ConditionalAccessPolicies'          = @('id', 'displayName', 'state', 'conditions', 'grantControls', 'sessionControls', 'createdDateTime', 'modifiedDateTime')
             'CopilotReadinessActivity'           = @('userPrincipalName', 'usesOutlookEmail', 'usesTeamsMeetings', 'usesTeamsChat', 'usesOfficeDocs', 'onQualifiedUpdateChannel', 'hasCopilotLicenseAssigned')
             'CrossTenantAccessPolicy'            = @('id', 'b2bCollaborationOutbound', 'b2bDirectConnectOutbound', 'tenantRestrictions')
-            'CsExternalAccessPolicy'             = @('EnableFederationAccess', 'EnableTeamsConsumerAccess')
+            'CsExternalAccessPolicy'             = @('EnableFederationAccess', 'EnableTeamsConsumerAccess', 'EnableTeamsConsumerInbound')
             'CsTeamsAppPermissionPolicy'         = @('Identity', 'GlobalCatalogAppsType', 'DefaultCatalogAppsType')
             'CsTeamsClientConfiguration'         = @('AllowDropbox', 'AllowBox', 'AllowGoogleDrive', 'AllowShareFile', 'AllowEgnyte', 'AllowEmailIntoChannel')
             'CsTeamsMeetingPolicy'               = @('AllowAnonymousUsersToJoinMeeting', 'AllowAnonymousUsersToStartMeeting', 'AutoAdmittedUsers', 'AllowPSTNUsersToBypassLobby', 'MeetingChatEnabledType', 'DesignatedPresenterRoleMode', 'AllowExternalParticipantGiveRequestControl', 'AllowExternalNonTrustedMeetingChat', 'AllowCloudRecording')
             'CsTeamsMessagingPolicy'             = @('UseB2BInvitesToAddExternalUsers', 'AllowSecurityEndUserReporting')
-            'CsTenantFederationConfiguration'    = @('AllowFederatedUsers', 'AllowedDomains', 'AllowTeamsConsumer')
+            'CsTenantFederationConfiguration'    = @('AllowFederatedUsers', 'AllowedDomains', 'AllowTeamsConsumer', 'AllowTeamsConsumerInbound')
             'DefaultAppManagementPolicy'         = @('isEnabled', 'applicationRestrictions', 'servicePrincipalRestrictions')
             'DeviceRegistrationPolicy'           = @('azureADJoin', 'userDeviceQuota', 'localAdminPassword', 'multiFactorAuthConfiguration')
             'DeviceSettings'                     = @('secureByDefault')

diff --git a/...d/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 b/...d/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
@@ -18,6 +18,7 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
         ADDEDCOMPONENT
             {"type":"switch","name":"standards.TeamsExternalAccessPolicy.EnableFederationAccess","label":"Allow communication from trusted organizations"}
             {"type":"switch","name":"standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess","label":"Allow communication with unmanaged Teams accounts"}
+            {"type":"switch","name":"standards.TeamsExternalAccessPolicy.EnableTeamsConsumerInbound","label":"Allow unmanaged Teams users to initiate contact","condition":{"field":"standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess","compareType":"is","compareValue":true}}
         IMPACT
             Medium Impact
         ADDEDDATE
@@ -55,18 +56,21 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
 
     $EnableFederationAccess = $Settings.EnableFederationAccess ?? $false
     $EnableTeamsConsumerAccess = $Settings.EnableTeamsConsumerAccess ?? $false
+    $EnableTeamsConsumerInbound = $Settings.EnableTeamsConsumerInbound ?? $false
 
     $StateIsCorrect = ($CurrentState.EnableFederationAccess -eq $EnableFederationAccess) -and
-    ($CurrentState.EnableTeamsConsumerAccess -eq $EnableTeamsConsumerAccess)
+    ($CurrentState.EnableTeamsConsumerAccess -eq $EnableTeamsConsumerAccess) -and
+    ($CurrentState.EnableTeamsConsumerInbound -eq $EnableTeamsConsumerInbound)
 
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'External Access Policy already set.' -sev Info
         } else {
             $cmdParams = @{
-                Identity                  = 'Global'
-                EnableFederationAccess    = $EnableFederationAccess
-                EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess
+                Identity                   = 'Global'
+                EnableFederationAccess     = $EnableFederationAccess
+                EnableTeamsConsumerAccess  = $EnableTeamsConsumerAccess
+                EnableTeamsConsumerInbound = $EnableTeamsConsumerInbound
             }
 
             try {
@@ -92,12 +96,14 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
         Add-CIPPBPAField -FieldName 'TeamsExternalAccessPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
-            EnableFederationAccess    = $CurrentState.EnableFederationAccess
-            EnableTeamsConsumerAccess = $CurrentState.EnableTeamsConsumerAccess
+            EnableFederationAccess     = $CurrentState.EnableFederationAccess
+            EnableTeamsConsumerAccess  = $CurrentState.EnableTeamsConsumerAccess
+            EnableTeamsConsumerInbound = $CurrentState.EnableTeamsConsumerInbound
         }
         $ExpectedValue = @{
-            EnableFederationAccess    = $EnableFederationAccess
-            EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess
+            EnableFederationAccess     = $EnableFederationAccess
+            EnableTeamsConsumerAccess  = $EnableTeamsConsumerAccess
+            EnableTeamsConsumerInbound = $EnableTeamsConsumerInbound
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalAccessPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }

diff --git a/...odules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 b/...odules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
@@ -17,6 +17,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
             Configures how the organization federates with external organizations for Teams communication, controlling whether employees can communicate with specific external domains or all external organizations. This setting enables secure inter-organizational collaboration while maintaining control over external communications.
         ADDEDCOMPONENT
             {"type":"switch","name":"standards.TeamsFederationConfiguration.AllowTeamsConsumer","label":"Allow users to communicate with other organizations"}
+            {"type":"switch","name":"standards.TeamsFederationConfiguration.AllowTeamsConsumerInbound","label":"Allow unmanaged Teams users to initiate contact","condition":{"field":"standards.TeamsFederationConfiguration.AllowTeamsConsumer","compareType":"is","compareValue":true}}
             {"type":"autoComplete","required":true,"multiple":false,"creatable":false,"name":"standards.TeamsFederationConfiguration.DomainControl","label":"Communication Mode","options":[{"label":"Allow all external domains","value":"AllowAllExternal"},{"label":"Block all external domains","value":"BlockAllExternal"},{"label":"Allow specific external domains","value":"AllowSpecificExternal"},{"label":"Block specific external domains","value":"BlockSpecificExternal"}]}
             {"type":"textField","name":"standards.TeamsFederationConfiguration.DomainList","label":"Domains, Comma separated","required":false,"condition":{"field":"standards.TeamsFederationConfiguration.DomainControl.value","compareType":"isOneOf","compareValue":["AllowSpecificExternal","BlockSpecificExternal"]}}
         IMPACT
@@ -60,6 +61,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
     $DomainControl = $Settings.DomainControl.value ?? $Settings.DomainControl
     # An untoggled switch is absent from the settings; default it to $false so we never send null to the ConfigApi
     $AllowTeamsConsumer = $Settings.AllowTeamsConsumer ?? $false
+    $AllowTeamsConsumerInbound = $Settings.AllowTeamsConsumerInbound ?? $false
     $AllowedDomainsAsAList = @()
     $BlockedDomains = @()
     switch ($DomainControl) {
@@ -140,6 +142,7 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
     $ExpectedBlockedDomains = $BlockedDomains ?? @()
 
     $StateIsCorrect = ($CurrentState.AllowTeamsConsumer -eq $AllowTeamsConsumer) -and
+    ($CurrentState.AllowTeamsConsumerInbound -eq $AllowTeamsConsumerInbound) -and
     ($CurrentState.AllowFederatedUsers -eq $AllowFederatedUsers) -and
     $AllowedDomainsMatches -and
     $BlockedDomainsMatches
@@ -150,8 +153,9 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
         } else {
             $cmdParams = @{
                 Identity            = 'Global'
-                AllowTeamsConsumer  = $AllowTeamsConsumer
-                AllowFederatedUsers = $AllowFederatedUsers
+                AllowTeamsConsumer         = $AllowTeamsConsumer
+                AllowTeamsConsumerInbound = $AllowTeamsConsumerInbound
+                AllowFederatedUsers       = $AllowFederatedUsers
                 AllowedDomains      = $AllowedDomainsPayload
                 BlockedDomains      = @($BlockedDomains)
             }
@@ -210,15 +214,17 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
         }
 
         $CurrentValue = @{
-            AllowTeamsConsumer  = $CurrentState.AllowTeamsConsumer
-            AllowFederatedUsers = $CurrentState.AllowFederatedUsers
+            AllowTeamsConsumer         = $CurrentState.AllowTeamsConsumer
+            AllowTeamsConsumerInbound = $CurrentState.AllowTeamsConsumerInbound
+            AllowFederatedUsers       = $CurrentState.AllowFederatedUsers
             AllowedDomains      = $CurrentAllowedDomainsForReport
             BlockedDomains      = $CurrentBlockedDomainsForReport
         }
         $ExpectedValue = @{
-            AllowTeamsConsumer  = $AllowTeamsConsumer
-            AllowFederatedUsers = $AllowFederatedUsers
-            AllowedDomains      = $ExpectedAllowedDomainsForReport
+            AllowTeamsConsumer         = $AllowTeamsConsumer
+            AllowTeamsConsumerInbound = $AllowTeamsConsumerInbound
+            AllowFederatedUsers       = $AllowFederatedUsers
+            AllowedDomains            = $ExpectedAllowedDomainsForReport
             BlockedDomains      = $ExpectedBlockedDomainsForReport
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsFederationConfiguration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant

diff --git a/frontend/src/data/standards.json b/frontend/src/data/standards.json
@@ -6021,6 +6021,16 @@
         "type": "switch",
         "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess",
         "label": "Allow communication with unmanaged Teams accounts"
+      },
+      {
+        "type": "switch",
+        "name": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerInbound",
+        "label": "Allow unmanaged Teams users to initiate contact",
+        "condition": {
+          "field": "standards.TeamsExternalAccessPolicy.EnableTeamsConsumerAccess",
+          "compareType": "is",
+          "compareValue": true
+        }
       }
     ],
     "label": "External Access Settings for Microsoft Teams",
@@ -6045,6 +6055,16 @@
         "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumer",
         "label": "Allow users to communicate with consumer Teams accounts"
       },
+      {
+        "type": "switch",
+        "name": "standards.TeamsFederationConfiguration.AllowTeamsConsumerInbound",
+        "label": "Allow unmanaged Teams users to initiate contact",
+        "condition": {
+          "field": "standards.TeamsFederationConfiguration.AllowTeamsConsumer",
+          "compareType": "is",
+          "compareValue": true
+        }
+      },
       {
         "type": "autoComplete",
         "required": true,