Teams External Federation Enables Chat with Teams and Skype Users

External federation has existed in Microsoft integrated communications applications for a long time. Teams has supported federated chat with users in other Microsoft 365 tenants since 2019 and generally it all works very well, including federation with Teams consumer users and Skype consumer users.

If problems do occur when attempting to chat with a Teams user in another tenant, the usual cause is that the external access configuration for either tenant blocks communication. By default, the external access configuration allows connections to all other tenants, but it can be restricted to specific domains. For instance, one way to block the GIFShell exploit (when an external user sent an infected GIF to a Teams user), is to only permit federation with selected tenants.

Presence States

Presence is an important feature of online chat. It allows other people to know if you’re available. Teams supports several presence states such as Available, Busy, and Do Not Disturb You can even appear to be offline. Presence can have a duration. For instance, you can set presence to be Do Not Disturb for the next two hours, after which Teams resets your presence to Available.

While most people set their presence by clicking the avatar in the top right-hand corner of the Teams desktop or browser client (top left-hand corner for the mobile clients), force of habit means that I like using the command box to input my presence status there. Teams supports the following presence shortcuts:

• /available
• /away
• /busy
• /brb (be right back)
• /dnd (do not disturb)
• /offline

Making Presence Private in Teams External Federation

By default, your presence information is available in a Teams federated chat. This seems like a logical thing to do. After all, you’re communicating with someone for a reason. But an argument exists that it’s not good to let external people know your presence. For instance, if I go to a federated chat and view the person’s profile card (click on their avatar), I see their presence information, which is available even if a chat is inactive (Figure 1).

The Set-CsPrivacyConfiguration cmdlet (which the documentation says goes back to Lync Server 2010) is now part of the Teams PowerShell module. A setting in the cmdlet controls the tenant privacy mode. By default, Teams disables privacy mode. To enable privacy mode, run the cmdlet and set the EnablePrivacyMode parameter to True:

Set-CsPrivacyConfiguration -EnablePrivacyMode $True

It can take several hours for the change to the configuration to propagate across Microsoft 365. When it’s active, presence information doesn’t appear in federated chats (Figure 2).

To revert, run Set-CsPrivacyConfiguration and set the EnablePrivacyMode parameter to False:

Set-CsPrivacyConfiguration -EnablePrivacyMode $False

Enabling privacy mode does not suppress the display of the person’s contact information and Teams never displays photos for federated users. It’s possible to add photos for guest accounts in the local Azure AD but not for federated users. I recommend that you do this for “persistent” guest accounts, those that are likely to remain in your directory for extended periods because of their business relationship with the organization.

Privacy Mode On or Off for All

I don’t think that many organizations will rush to enable privacy mode for Teams federated chat. It’s a feature that’s available but it’s also a mode that applies for the entire tenant. In other words, you cannot enable privacy mode for specific users and leave it off for the remainder. Many Teams policies are per-user for maximum flexibility. I suspect that the age of this policy is a contributing factor to why it’s a simple on/off switch.

Learn more about how the Office 365 applications really work on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Configure Shared Mailbox Auto Reply for External Contacts

Contact handling is an important part of website communication. Most sites have a contact form that people can fill in to ask questions, perhaps after passing a CAPTCHA test. Behind the scenes, the information from the form might end up in an email to allow the site owners to deal with the query, which is how things should work normally.

Much to the embarrassment of the Office 365 for IT Pros team, we discovered that the contact form for our website has not worked for quite a time. We’ve fixed the problem now to make sure that if anyone uses the contact form to ask a question about the book or comment on book text, the site emails the query to a shared mailbox. If anyone’s interested, we upgraded the site to use the WPForms Lite plug-in for WordPress.

Suitably chastened, we have reached out to people who entered queries through the contact form to follow up and make sure that their questions are answered.

Shared Mailboxes versus Microsoft 365 Groups

Now that everything is fixed on our web site, contact messages sent to Office 365 for IT Pros flow into a shared mailbox. We could use the Microsoft 365 group to process book comments, but it’s cleaner to separate the two. And anyway, we want to use an auto-reply message to acknowledge the receipt of queries, and that feature isn’t supported yet by Microsoft 365 groups (see this comparison between shared mailboxes and Microsoft 365 groups). Some people don’t know that shared mailboxes support auto-reply, but they do and it’s a very useful option at times. For instance, when national holidays roll around, you can use PowerShell to quickly configure shared mailboxes used for customer communication with an appropriate auto-reply message saying that responses will be delayed.

We do use a Microsoft 365 group to organize the production of the book because we keep our chapter and other files in a SharePoint Online site and use Teams to discuss different aspects of the book, like what we’re working on in a monthly update or who hasn’t filed their chapter updates for a monthly update. So many options exist within Microsoft 365 to achieve goals in different ways that it’s often hard to decide which is best. In our case, being able to send auto-replies for contact messages tipped the balance.

Configuring the Distribution List

The email address used for comments configured on our website directs messages to a distribution list. The membership of the distribution list includes the shared mailbox and some other user mailboxes that might be involved in answering queries.

Because the first address reached by inbound messages is a distribution list, we need to configure the list to allow the generation of auto-reply messages and to allow external people to send messages to the list:

Set-DistributionGroup -Identity O365.Book.Comments -RequireSenderAuthenticationEnabled $False -SendOofMessageToOriginatorEnabled $True

To configure the shared mailbox auto reply, we use the Set-MailboxAutoReplyConfiguration cmdlet:

$AutoReplyText = "<h1>Thanks For Your Message</h1><p>We've received your email to <b>Office 365 for IT Pros</b>. If we need to respond to you, we'll be in touch by email within 48 hours. If you need help faster, reply to this email and we'll accelerate our response.</p><p>Best Regards</p><p><i>The Office 365 for IT Pros team</i></p>"
Set-MailboxAutoReplyConfiguration -Identity book.comments@office365itpros.com -AutoReplyState "Enabled" -InternalMessage $AutoReplyText –ExternalMessage $AutoReplyText -ExternalAudience 'All' 

Figure 1 shows the auto-reply we generate:

The technique of allowing Exchange Online to generate and deliver auto-reply messages for messages received by mailboxes through their membership of a distribution list is uncommon but it is used in practice (which is why the SendOofMessageToOriginatorEnabled parameter exists). For instance, this recent example of a use case is in the Microsoft Technical Community.

Another thing to check is to ensure that the shared mailbox doesn’t have a forwarding SMTP address set (this article is worth checking out when debugging OOF issues). Exchange Online won’t send auto-replies for a mailbox when a forwarding address is set.

Forwarding from a Shared Mailbox

We could have reversed the process and configured the shared mailbox to forward messages to another address. Any valid internal SMTP address works including one for a distribution list, but the outbound spam filter probably blocks forwarding to external addresses. If the organization blocks forwarding to external addresses, senders receive a non-delivery notification (5.7.520 Access Denied). In general, mail forwarding from mailboxes is a practice to avoid, so it’s one that we decided not to investigate too much.

Normal Service Resumed

Running a website throws up challenges on an ongoing basis. We should have caught the problem with our contact form earlier and sincerely regret if this caused anyone any extra hassle. On the upside, it did give us a chance to review the handling of contact queries from the website through to Exchange Online to make sure that everything now works as it should.

Learn about using Exchange Online and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.