CsExternalAccessPolicy
Enables you to modify the properties of an existing external access policy.
This cmdlet was introduced in Lync Server 2010.
When you install Skype for Business Server your users are only allowed to exchange instant messages and presence information among themselves: by default, they can only communicate with people who have SIP accounts in your Active Directory Domain Services. In addition, users are not allowed to access Skype for Business Server over the Internet; instead, they must be logged on to your internal network before they will be able to log on to Skype for Business Server.
That might be sufficient to meet your communication needs. If it doesn't meet your needs, you can use external access policies to extend the ability of your users to communicate and collaborate. External access policies can grant (or revoke) the ability of your users to do any or all of the following:
1. Communicate with people who have SIP accounts with a federated organization. Note that enabling federation alone will not provide users with this capability. Instead, you must enable federation and then assign users an external access policy that gives them the right to communicate with federated users.
- (Microsoft Teams only) Communicate with users who are using custom applications built with Azure Communication Services (ACS). this policy setting only applies if acs federation has been enabled at the tenant level using the Set-CsTeamsAcsFederationConfiguration cmdlet.
3. Access Skype for Business Server over the Internet, without having to first log on to your internal network. This enables your users to use Skype for Business and log on to Skype for Business Server from an Internet café or other remote location.
- Communicate with people who have SIP accounts with a public instant messaging service such as Skype.
The following parameters are not applicable to Skype for Business Online/Microsoft Teams: Description, EnableXmppAccess, Force, Identity, Instance, PipelineVariable, and Tenant
- (Microsoft Teams Only) Communicate with people who are using Teams with an account that's not managed by an organization. This policy only applies if Teams Consumer Federation has been enabled at the tenant level using the Set-CsTeamsAcsFederationConfiguration cmdlet or Teams admin center under the External Access setting.
After an external access policy has been created, you can use the Set-CsExternalAccessPolicy cmdlet to change the property values of that policy. For example, by default the global policy does not allow users to communicate with people who have accounts with a federated organization. If you would like to grant this capability to all of your users you can call the Set-CsExternalAccessPolicy cmdlet and set the value of the global policy's EnableFederationAccess property to True.
Available cmdlets
Parameters
| Name | Type | Default value | Accepted values |
|---|---|---|---|
| AllowedExternalDomains | List | ||
| BlockedExternalDomains | List | ||
| CommunicationWithExternalOrgs | String | OrganizationDefault | |
| EnableAcsFederationAccess | Boolean | True | |
| EnableFederationAccess | Boolean | ||
| EnableOutsideAccess | Boolean | ||
| EnablePublicCloudAudioVideoAccess | Boolean | ||
| EnableTeamsConsumerAccess | Boolean | True | |
| EnableTeamsConsumerInbound | Boolean | True | |
| EnableTeamsSmsAccess | Boolean | ||
| EnableXmppAccess | Boolean | ||
| FederatedBilateralChats | Boolean | False | |
| RestrictTeamsConsumerAccessToExternalUserProfiles | Boolean |
Examples
Example 1
Set-CsExternalAccessPolicy -Identity RedmondExternalAccessPolicy -EnableFederationAccess $TrueThe command shown in Example 1 modifies the per-user external access policy that has the Identity RedmondExternalAccessPolicy. In this example, the command changes the value of the EnableFederationAccess property to True.
Example 2
Get-CsExternalAccessPolicy | Set-CsExternalAccessPolicy -EnableFederationAccess $TrueIn Example 2, federation access is enabled for all the external access policies configured for use in the organization. To do this, the command first calls the Get-CsExternalAccessPolicy cmdlet without any parameters; this returns a collection of all the external policies currently configured for use. That collection is then piped to the Set-CsExternalAccessPolicy cmdlet, which changes the value of the EnableFederationAccess property for each policy in the collection.
Example 3
Get-CsExternalAccessPolicy -Filter tag:* | Set-CsExternalAccessPolicy -EnableFederationAccess $TrueExample 3 enables federation access for all the external access policies that have been configured at the per-user scope. To carry out this task, the first thing the command does is use the Get-CsExternalAccessPolicy cmdlet and the Filter parameter to return a collection of all the policies that have been configured at the per-user scope. (The filter value "tag:*" limits returned data to policies that have an Identity that begins with the string value "tag:". Any policy with an Identity that begins with "tag:" has been configured at the per-user scope.) The filtered collection is then piped to the Set-CsExternalAccessPolicy cmdlet, which modifies the EnableFederationAccess property for each policy in the collection.
Example 4
Set-CsExternalAccessPolicy -Identity Global -EnableAcsFederationAccess $false
New-CsExternalAccessPolicy -Identity AcsFederationAllowed -EnableAcsFederationAccess $trueIn this example, the Global policy is updated to disallow Teams-ACS federation for all users, then a new external access policy instance is created with Teams-ACS federation enabled and which can be assigned to selected users for which Team-ACS federation will be allowed.
Example 5
Set-CsExternalAccessPolicy -Identity Global -EnableAcsFederationAccess $true
New-CsExternalAccessPolicy -Identity AcsFederationNotAllowed -EnableAcsFederationAccess $falseIn this example, the Global policy is updated to allow Teams-ACS federation for all users, then a new external access policy instance is created with Teams-ACS federation disabled and which can then be assigned to selected users for which Team-ACS federation will not be allowed.
Example 6
New-CsExternalAccessPolicy -Identity GranularFederationExample -CommunicationWithExternalOrgs "AllowSpecificExternalDomains" -AllowedExternalDomains @("example1.com", "example2.com")
Set-CsTenantFederationConfiguration -CustomizeFederation $trueIn this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely example1.com and example2.com. The federation policy is set to restrict communication to only these allowed domains.