Create custom external access policies

Skype for Business Online allows you to create additional external access policies. Unlike client or conferencing policies, where you can have multiple combinations, there are three predefined external access policies that can cover most of the scenarios. These are:

  • No Federated or Skype Consumer Access (Tag:NoFederationAndPIC )

  • Federated Access Only (Tag:FederationOnly )

  • Federated and Consumer Access (FederationAndPICDefault)

Custom external policies allow you to create additional polices that aren't covered by the settings above. When the policy was created, you would be required to set all required parameters and you couldn't alter them later. Creating new custom policies allow you to control features such as Skype consumer access or a policy to disable public cloud audio/video, which is something that wasn't covered with predefined settings. Custom external access policies follow the same syntax as client, mobility, and conferencing policies. You can find out more about those settings here.

To make this work, the user must be using a supported version of 2016 Click-to-Run Skype for Business app that supports it. The following minimum version of Skype for Business 2016 Click-to-Run client is required:

Type Release date Version Build
First Release for Current Channel
Version 1611 (Build 7571.2006)
Current Channel
Version 1611 (Build 7571.2072)
Deferred Channel
Version 1609 (Build 7369.2118)


Users who are using older versions of Skype for Business Windows apps or Mac clients will still be able to transfer files.

Verify and start Windows PowerShell

  • Check that you are running Windows PowerShell version 3.0 or higher
  1. To verify that you are running version 3.0 or higher: Start Menu > Windows PowerShell.

  2. Check the version by typing Get-Host in the Windows PowerShell window.

  3. If you don't have version 3.0 or higher, you need to download and install updates to Windows PowerShell. See Windows Management Framework 4.0 to download and update Windows PowerShell to version 4.0. Restart your computer when you are prompted.

  4. You will also need to install the Windows PowerShell module for Skype for Business Online that enables you to create a remote Windows PowerShell session that connects to Skype for Business Online. This module, which is supported only on 64-bit computers, can be downloaded from the Microsoft Download Center at Windows PowerShell Module for Skype for Business Online. Restart your computer if you are prompted.

    If you need to know more, see Connect to all Office 365 services in a single Windows PowerShell window.

  • Start a Windows PowerShell session
  1. From the Start Menu > Windows PowerShell.

  2. In the Windows PowerShell window, connect to your Office 365 organization by running:


    You only have to run the Import-Module command the first time you use the Skype for Business Online Windows PowerShell module.

     Import-Module "C:\Program Files\Common Files\Skype for Business Online\Modules\SkypeOnlineConnector\SkypeOnlineConnector.psd1"
     $credential = Get-Credential
     $session = New-CsOnlineSession -Credential $credential
     Import-PSSession $session

    If you want more information about starting Windows PowerShell, see Connect to all Office 365 services in a single Windows PowerShell window or Connecting to Skype for Business Online by using Windows PowerShell.

Create a custom external access policy for a user

To do this, run:

New-CsExternalAccessPolicy -Identity BlockSkypeVideo -EnablePublicCloudAccess $True -EnablePublicCloudAudioVideoAccess $False -EnableFederationAccess $True -EnableOutsideAccess $True
Grant-CsExternalAccessPolicy -PolicyName BlockSkypeVideo -Identity

Want to know more about Windows PowerShell?

Block point-to-point file transfers

Set up client policies for your organization

Set up conferencing policies in your organization