# (L1) Ensure only people in my org can bypass the lobby

(L1) Ensure only people in my org can bypass the lobby. A Maester check for Teams, Meetings.

Source: https://maester.dev/docs/tests/CIS.M365.8.5.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/henrikpiecha" title="Henrik Piecha · Original author"><img src="https://github.com/HenrikPiecha.png" alt="Henrik Piecha" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/merill" title="Merill Fernando · Co-contributor"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/henrikpiecha">Henrik Piecha</a> with <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Teams · Meetings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.8.5.3
```

## Overview

8.5.3 (L1) Ensure only people in my org can bypass the lobby

This policy setting controls who can join a meeting directly and who must wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting.

The recommended state is **People who were invited** or more restrictive.

#### Rationale

For meetings that could contain sensitive information, it is best to allow the meeting organizer to vet anyone not directly sent an invite before admitting them to the meeting. This will also prevent the anonymous user from using the meeting link to have meetings at unscheduled times.

#### Impact

Individuals who are not part of the organization will have to wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting.

Any individual who dials into the meeting regardless of status will also have to wait in the lobby. This includes internal users who are considered unauthenticated when dialing in.

#### Remediation action

1. Navigate to [Microsoft Teams Admin Center](https://admin.teams.microsoft.com).
2. Select **Settings & policies** > **Global (Org-wide default) settings**.
3. Select **Meetings** to open the **meeting settings** section.
4. Under meeting join & lobby set **Who can bypass the lobby** to **People who were invited** or a more restrictive value: **People in my org, Only organizers and co-organizers**.

##### PowerShell

1. Connect to Teams PowerShell using `Connect-MicrosoftTeams`.
2. Run the following command to set the recommended state:

```powershell
Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers "InvitedUsers"
```

>Note: More restrictive values EveryoneInCompanyExcludingGuests or OrganizerOnly are also in compliance.

#### Related links

* [Microsoft Teams Admin Center](https://admin.teams.microsoft.com).
* [Overview of lobby settings and policies](https://learn.microsoft.com/microsoftteams/who-can-bypass-meeting-lobby#overview-of-lobby-settings-and-policies)
* [Set-CsTeamsMeetingPolicy](https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy?view=teams-ps&viewFallbackFrom=skype-ps)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 535](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.8.5.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Teams |
| Feature | Meetings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:8.5.3, nist-800-53-r5:AC-3 |
| PowerShell test | [Test-MtCisTeamsLobbyBypass](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.5.3.ps1) |
| Services | Teams |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.8.5.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.5.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.8.5.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.8.5.3.md)