Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
teams_meeting_dial_in_lobby_bypass_disabledProvider: Microsoft 365
Service:
teamsSeverity: HIGH
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Teams meeting policies prevent PSTN dial-in callers from bypassing the lobby (AllowPSTNUsersToBypassLobby=false), requiring admission by organizers or presenters.
Risk
Direct admission of dial-in callers enables unauthenticated access, caller-ID spoofing, and meeting hijacking. Sensitive content can be overheard or recorded (confidentiality), discussions manipulated (integrity), and sessions disrupted (availability).Recommendation
Enforce the lobby for all PSTN dial-in callers. Restrict admission to organizers or presenters, and allow only authenticated or explicitly invited users to bypass. Standardize via org-wide meeting policies or templates to uphold least privilege and defense in depth.Remediation
- CLI
- Dashboard steps
Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false
References
- https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby
- https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy?view=teams-ps
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_meeting_dial_in_lobby_bypass_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks