Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
teams_meeting_anonymous_user_start_disabledProvider: Microsoft 365
Service:
teamsSeverity: HIGH
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Teams meeting policies disableAllowAnonymousUsersToStartMeeting so anonymous users and dial-in callers cannot start meetings and must wait in the lobby until an authenticated participant joins
Risk
Without this control, outsiders can launch hostless meetings, enabling:- social engineering before staff join
- malicious link sharing and meeting hijack It also allows PSTN toll abuse by dial-in callers. Impacts: confidentiality, integrity, and availability/cost.
Recommendation
KeepAllowAnonymousUsersToStartMeeting disabled. Require an authenticated organizer to start meetings and enforce the lobby so anonymous and dial-in participants wait. Limit lobby bypass to internal or invited users, disable anonymous join if unnecessary, and apply least-privilege and zero-trust principles to meeting access.
Remediation
- CLI
- Dashboard steps
Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false
References
- https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference
- https://docs.tminus365.com/security/teams/anonymous-users-shall-not-be-enabled-to-start-meetings
- https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy?view=teams-ps
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_meeting_anonymous_user_start_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks