(L1) Ensure users dialing in can't bypass the lobby

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · Meetings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.5.4

Overview

When a caller dials in by phone, the call is a PSTN (phone network) participant. If that caller can bypass the lobby, they join the meeting without an organizer or a presenter approving them first. A caller who has the dial-in number and conference ID could then join a meeting directly.

Requiring dial-in callers to wait in the lobby means the organizer or a presenter sees who is calling and can admit only the expected people.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Meetings > Meeting policies.
3. Open the Global (Org-wide default) policy.
4. Under People dialing in can bypass the lobby, select Off.
5. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false

Related links

• Microsoft Teams admin center
• Manage meeting policies in Microsoft Teams
• Set-CsTeamsMeetingPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.4

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.5.4
Severity	Medium
Suite	CIS
Product	Teams
Feature	Meetings
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.4
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:8.5.4, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisTeamsDialInLobbyBypass
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.5.4.ps1
• Documentation: tests/cis/Test.CIS.M365.8.5.4.md