New-CsExternalAccessPolicy

Syntax

New-CsExternalAccessPolicy
   [-Identity] <XdsIdentity>
   [-AllowedExternalDomains <List>]
   [-BlockedExternalDomains <List>]
   [-CommunicationWithExternalOrgs <Boolean>]
   [-Confirm]
   [-Description <String>]
   [-EnableAcsFederationAccess <Boolean>]
   [-EnableFederationAccess <Boolean>]
   [-EnableOutsideAccess <Boolean>]
   [-EnablePublicCloudAccess <Boolean>]
   [-EnablePublicCloudAudioVideoAccess <Boolean>]
   [-EnableTeamsConsumerAccess <Boolean>]
   [-EnableTeamsConsumerInbound <Boolean>]
   [-EnableXmppAccess <Boolean>]
   [-FederatedBilateralChats <Boolean>]
   [-Force]
   [-InMemory]
   [-Tenant <Guid>]
   [-WhatIf]
   [<CommonParameters>]

Description

When you install Skype for Business Server your users are only allowed to exchange instant messages and presence information among themselves: by default, they can only communicate with other people who have SIP accounts in your Active Directory Domain Services. In addition, users are not allowed to access Skype for Business Server over the Internet; instead, they must be logged on to your internal network before they will be able to log on to Skype for Business Server.

That might be sufficient to meet your communication needs. If it doesn't meet your needs you can use external access policies to extend the ability of your users to communicate and collaborate. External access policies can grant (or revoke) the ability of your users to do any or all of the following:

1. Communicate with people who have SIP accounts with a federated organization. Note that enabling federation alone will not provide users with this capability. Instead, you must enable federation and then assign users an external access policy that gives them the right to communicate with federated users.

2. (Microsoft Teams only) Communicate with users who are using custom applications built with Azure Communication Services (ACS). this policy setting only applies if acs federation has been enabled at the tenant level using the cmdlet Set-CsTeamsAcsFederationConfiguration.

3. Access Skype for Business Server over the Internet, without having to first log on to your internal network. This enables your users to use Skype for Business and log on to Skype for Business Server from an Internet café or other remote location.

4. Communicate with people who have SIP accounts with a public instant messaging service such as Skype.

5. (Microsoft Teams Only) Communicate with people who are using Teams with an account that's not managed by an organization. This policy only applies if Teams Consumer Federation has been enabled at the tenant level using the cmdlet Set-CsTenantFederationConfiguration or Teams Admin Center under the External Access setting.

When you install Skype for Business Server, a global external access policy is automatically created for you. In addition to the global policy, you can also create custom external access policies at either the site or the per-user scope. If you create an external access policy at the site scope, that policy will automatically be assigned to the site upon creation. If you create an external access policy at the per-user scope, that policy will be created but will not be assigned to any users. To assign the policy to a user or group of users, use the Grant-CsExternalAccessPolicy cmdlet.

New external access policies can be created by using the New-CsExternalAccessPolicy cmdlet. Note that these policies can only be created at the site or the per-user scope; you cannot create a new policy at the global scope. In addition, you can have only one external access policy per site: if the Redmond site already has been assigned an external access policy you cannot create a second policy for the site.

The following parameters are not applicable to Skype for Business Online/Microsoft Teams: Description, EnableXmppAccess, Force, Identity, InMemory, PipelineVariable, and Tenant

Examples

-------------------------- EXAMPLE 1 --------------------------

New-CsExternalAccessPolicy -Identity site:Redmond -EnableFederationAccess $True -EnableOutsideAccess $True

The command shown in Example 1 creates a new external access policy that has the Identity site:Redmond; upon creation, this policy will automatically be assigned to the Redmond site. Note that this new policy sets both the EnableFederationAccess and the EnableOutsideAccess properties to True.

-------------------------- Example 2 ------------------------

Set-CsExternalAccessPolicy -Identity Global -EnableAcsFederationAccess $true
New-CsExternalAccessPolicy -Identity AcsFederationNotAllowed -EnableAcsFederationAccess $false

In this example, the Global policy is updated to allow Teams-ACS federation for all users, then a new external access policy instance is created with Teams-ACS federation disabled and which can then be assigned to selected users for which Team-ACS federation will not be allowed.

-------------------------- Example 3 ------------------------

New-CsExternalAccessPolicy -Identity site:Redmond -EnableTeamsConsumerAccess $True -EnableTeamsConsumerInbound $False

The command shown in Example 3 creates a new external access policy that has the Identity site:Redmond; upon creation, this policy will automatically be assigned to the Redmond site. Note that this new policy enables communication with people using Teams with an account that's not managed by an organization and limits this to only be initiated by people in your organization. This means that people using Teams with an account that's not managed by an organization will not be able to discover or start a conversation with people with this policy assigned.

-------------------------- EXAMPLE 4 --------------------------

$x = New-CsExternalAccessPolicy -Identity RedmondAccessPolicy -InMemory

$x.EnableFederationAccess = $True

$x.EnablePublicCloudAccess = $True

$x.EnableOutsideAccess = $True

Set-CsExternalAccessPolicy -Instance $x

Example 4 demonstrates the use of the InMemory parameter; this parameter enables you to create an in-memory-only instance of an external access policy. After it has been created, you can modify the in-memory-only instance, then use the Set-CsExternalAccessPolicy cmdlet to transform the virtual policy into a real external access policy.

To do this, the first command in the example uses the New-CsExternalAccessPolicy cmdlet and the InMemory parameter to create a virtual policy with the Identity RedmondAccessPolicy; this virtual policy is stored in a variable named $x. The next three commands are used to modify three properties of the virtual policy: EnableFederationAccess, EnablePublicCloudAccess, and the EnableOutsideAccess. Finally, the last command uses the Set-CsExternalAccessPolicy cmdlet to create an actual per-user external access policy with the Identity RedmondAccessPolicy. If you do not call the Set-CsExternalAccessPolicy cmdlet, then the virtual policy will disappear as soon as you end your Windows PowerShell session or delete the variable $x. Should that happen, an external access policy with the Identity RedmondAccessPolicy will never be created.

-------------------------- Example 5 ------------------------

New-CsExternalAccessPolicy -Identity GranularFederationExample -CommunicationWithExternalOrgs "AllowSpecificExternalDomains" -AllowedExternalDomains @("example1.com", "example2.com")
Set-CsTenantFederationConfiguration -CustomizeFederation $true

In this example, we create an ExternalAccessPolicy named "GranularFederationExample" that allows communication with specific external domains, namely example1.com and example2.com. The federation policy is set to restrict communication to only these allowed domains. After that, we still have to enable the CustomizeFederation setting in the TenantFederationConfiguration to allow the federation settings as defined in the ExternalAccessPolicy to work.

Parameters

-AllowedExternalDomains

-BlockedExternalDomains

-CommunicationWithExternalOrgs

-Confirm

-Description

-EnableAcsFederationAccess

-EnableFederationAccess

-EnableOutsideAccess

-EnablePublicCloudAccess

-EnablePublicCloudAudioVideoAccess

-EnableTeamsConsumerAccess

-EnableTeamsConsumerInbound

-EnableXmppAccess

-FederatedBilateralChats

-Force

-Identity

-InMemory

-Tenant

-WhatIf

Inputs

Input types

None. The New-CsExternalAccessPolicy cmdlet does not accept pipelined input.

Outputs

Output types

Creates new instances of the Microsoft.Rtc.Management.WritableConfig.Policy.ExternalAccess.ExternalAccessPolicy object.

System.Object

Related Links

• Get-CsExternalAccessPolicy
• Grant-CsExternalAccessPolicy
• Remove-CsExternalAccessPolicy
• Set-CsExternalAccessPolicy