Detections
Analytics

8.5.8 (L2) Ensure external meeting chat is off

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This meeting policy setting controls whether users can read or write messages in external meeting chats with untrusted organizations. If an external organization is on the list of trusted organizations this setting will be ignored.

Restricting access to chat in meetings hosted by external organizations limits the opportunity for an exploit like GIFShell or DarkGate malware from being delivered to users.

Solution

To remediate using the UI:

 - Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com.
 - Select Settings & policies > Global (Org-wide default) settings.
 - Select Meetings to open the meeting settings section.
 - Under meeting engagement set External meeting chat to Off.

 To remediate using PowerShell:

 - Connect to Teams PowerShell using Connect-MicrosoftTeams.
 - Run the following command to set the recommended state:
Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $false

Impact:

When joining external meetings users will be unable to read or write chat messages in Teams meetings with organizations that they don't have a trust relationship with. This will completely remove the chat functionality in meetings. From an I.T. perspective both the upkeep of adding new organizations to the trusted list and the decision-making process behind whether to trust or not trust an external partner will increase time expenditure.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: PLANNING, SYSTEM AND SERVICES ACQUISITION

References: 800-53|PL-8, 800-53|SA-8

Plugin: microsoft_azure

Control ID: 6e5412ba48fd216680a39fc02692cb7dd32112886faf8f8c2bd887c388e2dc84