(L2) Ensure anonymous users can't join a meeting

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · Meetings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.5.1

Overview

Anonymous users are people who join a meeting without signing in to Microsoft Teams. If anonymous users can join, anyone who has the meeting link, or who finds it forwarded or posted in public, can attend and listen to or take part in confidential discussions.

Turning off anonymous join keeps meetings limited to people who have signed in. Users who must attend without an account can still be invited through a supported path, such as a guest account.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Meetings > Meeting policies.
3. Open the Global (Org-wide default) policy.
4. Under Anonymous users can join a meeting, select Off.
5. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false

Related links

• Microsoft Teams admin center
• Manage meeting policies in Microsoft Teams
• Set-CsTeamsMeetingPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.1

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.5.1
Severity	Medium
Suite	CIS
Product	Teams
Feature	Meetings
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.1
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:8.5.1, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisTeamsAnonymousJoin
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.5.1.ps1
• Documentation: tests/cis/Test.CIS.M365.8.5.1.md