(L2) Ensure meeting chat does not allow anonymous users

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · Meetings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.5.5

Overview

Meeting chat is open to everyone who is in the meeting. If anonymous users can use it, a person who has joined without signing in can post messages and links to all participants, which is a route for phishing and social engineering during a meeting.

Limiting meeting chat to signed-in participants keeps the chat to people whose identity is known. Anonymous participants can still listen and watch the meeting.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Meetings > Meeting policies.
3. Open the Global (Org-wide default) policy.
4. Under Meeting chat, select On for everyone but anonymous users or Off.
5. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType EnabledExceptAnonymous

Related links

• Microsoft Teams admin center
• Manage meeting policies in Microsoft Teams
• Set-CsTeamsMeetingPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.5

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.5.5
Severity	Medium
Suite	CIS
Product	Teams
Feature	Meetings
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.5
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:8.5.5, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisTeamsMeetingChatAnonymous
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.5.5.ps1
• Documentation: tests/cis/Test.CIS.M365.8.5.5.md