CIS.M365.8.5.2 - (L1) Ensure anonymous users and dial-in callers can't start a meeting
Overview
Anonymous users are people who join a meeting without signing in to Microsoft Teams, and dial-in callers join by phone. If either can start a meeting, it can begin without anyone from the organization present, so nobody who is responsible for the meeting is there to control it.
When the setting is off, anonymous users and dial-in callers wait in the lobby until someone from your organization, a guest, or a user from a trusted organization starts the meeting. The setting only has an effect when anonymous users can join meetings and Who can bypass the lobby is set to Everyone.
Remediation action
- Sign in to the Microsoft Teams admin center.
- Go to Meetings > Meeting policies.
- Open the Global (Org-wide default) policy.
- Under Anonymous users and dial-in callers can start a meeting, select Off.
- Select Save.
PowerShell
- Connect to Teams PowerShell using
Connect-MicrosoftTeams. - Run the following command:
Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false
Related links
- Microsoft Teams admin center
- Manage meeting policies in Microsoft Teams
- Set-CsTeamsMeetingPolicy
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.8.5.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Teams |
| Feature | Meetings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:8.5.2, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisTeamsAnonymousStartMeeting |
| Services | Teams |
Source
- Test:
tests/cis/Test.CIS.M365.8.5.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.8.5.2.md