Detections
Analytics

8.5.2 Ensure anonymous users and dial-in callers can't start a meeting

Information

This policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization.

Anonymous participants are classified as:

 - Participants who are not logged in to Teams with a work or school account.
 - Participants from non-trusted organizations (as configured in external access).
 - Participants from organizations where there is not mutual trust.

Note: This setting only applies when Who can bypass the lobby is set to Everyone . If the anonymous users can join a meeting organization-level setting or meeting policy is Off, this setting only applies to dial-in callers.

Not allowing anonymous participants to automatically join a meeting reduces the risk of meeting spamming.

Solution

To remediate using the UI:

 - Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com.
 - Click Settings & policies and select the Global (Org-wide default) settings tab.
 - Select Meetings to open the meeting settings section.
 - Under meeting join & lobby set Anonymous users and dial-in callers can start a meeting to Off.

To remediate using PowerShell:

 - Connect to Teams PowerShell using Connect-MicrosoftTeams.
 - Run the following command to set the recommended state:

Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false

Impact:

Anonymous participants will not be able to start a Microsoft Teams meeting.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: microsoft_azure

Control ID: 2bfd93a41a205410ba66b973a8ad59777301a45ba3277c3e65ff81e6667a0cad