Check ID:
Provider: Microsoft 365
Service:
Severity: CRITICAL
Categories:
Resource type:
teams_meeting_external_lobby_bypass_disabledProvider: Microsoft 365
Service:
teamsSeverity: CRITICAL
Categories:
identity-access, trust-boundaries, e3Resource type:
NotDefinedWhat this check verifies
Teams Meetings global policy restricts lobby bypass so onlyEveryoneInCompanyExcludingGuests, OrganizerOnly, or InvitedUsers are auto-admitted; all others wait in the lobby.
Risk
Auto-admitting external or anonymous users undermines confidentiality via covert listening and access to chat/files, and integrity through meeting hijacks, malicious screen sharing, and phishing. It also impacts availability by enabling disruptions and unsanctioned sessions.Recommendation
Apply least privilege to lobby admission: set auto-admit to internal-only or to organizer/invitees, and require approval for guests, federated, anonymous, and PSTN. Enforce authentication and conditional access, and default to limited presenters for defense in depth.Remediation
- CLI
- Dashboard steps
Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers ‘EveryoneInCompanyExcludingGuests’
References
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_meeting_external_lobby_bypass_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks