(L1) Ensure anonymous users and dial-in callers can't start a meeting

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · Meetings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.5.2

Overview

Anonymous users are people who join a meeting without signing in to Microsoft Teams, and dial-in callers join by phone. If either can start a meeting, it can begin without anyone from the organization present, so nobody who is responsible for the meeting is there to control it.

When the setting is off, anonymous users and dial-in callers wait in the lobby until someone from your organization, a guest, or a user from a trusted organization starts the meeting. The setting only has an effect when anonymous users can join meetings and Who can bypass the lobby is set to Everyone.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Meetings > Meeting policies.
3. Open the Global (Org-wide default) policy.
4. Under Anonymous users and dial-in callers can start a meeting, select Off.
5. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false

Related links

• Microsoft Teams admin center
• Manage meeting policies in Microsoft Teams
• Set-CsTeamsMeetingPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.2

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.5.2
Severity	Medium
Suite	CIS
Product	Teams
Feature	Meetings
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.2
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:8.5.2, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisTeamsAnonymousStartMeeting
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.5.2.ps1
• Documentation: tests/cis/Test.CIS.M365.8.5.2.md