CIS.M365.8.5.4 - (L1) Ensure users dialing in can't bypass the lobby
Overview
When a caller dials in by phone, the call is a PSTN (phone network) participant. If that caller can bypass the lobby, they join the meeting without an organizer or a presenter approving them first. A caller who has the dial-in number and conference ID could then join a meeting directly.
Requiring dial-in callers to wait in the lobby means the organizer or a presenter sees who is calling and can admit only the expected people.
Remediation action
- Sign in to the Microsoft Teams admin center.
- Go to Meetings > Meeting policies.
- Open the Global (Org-wide default) policy.
- Under People dialing in can bypass the lobby, select Off.
- Select Save.
PowerShell
- Connect to Teams PowerShell using
Connect-MicrosoftTeams. - Run the following command:
Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false
Related links
- Microsoft Teams admin center
- Manage meeting policies in Microsoft Teams
- Set-CsTeamsMeetingPolicy
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.4
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.8.5.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Teams |
| Feature | Meetings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:8.5.4, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisTeamsDialInLobbyBypass |
| Services | Teams |
Source
- Test:
tests/cis/Test.CIS.M365.8.5.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.8.5.4.md