Detections
Analytics

8.5.4 (L1) Ensure users dialing in can't bypass the lobby

Information

This policy setting controls if users who dial in by phone can join the meeting directly or must wait in the lobby. Admittance to the meeting from the lobby is authorized by the meeting organizer, co-organizer, or presenter of the meeting.

For meetings that could contain sensitive information, it is best to allow the meeting organizer to vet anyone not directly from the organization.

Solution

To remediate using the UI:

 - Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com.
 - Select Settings & policies > Global (Org-wide default) settings.
 - Select Meetings to open the meeting settings section.
 - Under meeting join & lobby set People dialing in can bypass the lobby to Off.

To remediate using PowerShell:

 - Connect to Teams PowerShell using Connect-MicrosoftTeams.
 - Run the following command to set the recommended state:

Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false

Impact:

Individuals who are dialing in to the meeting must wait in the lobby until a meeting organizer, co-organizer, or presenter admits them.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: microsoft_azure

Control ID: a614363c4950b9e01f15f2629bfdac772ba1ea99fa8cc05dbe14b457b98d4e10