rules/findings/m365/microsoft_teams/meetings/ms-teams-anonymous-users-and-dial-in-callers-not-restricted-start-meeting.json
|
{
"provider": "Microsoft365", "serviceType": "Microsoft Teams", "serviceName": "Microsoft 365", "displayName": "Ensure anonymous users and dial-in callers can\u0027t start a meeting", "description": "\r\n\t\tThis policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization. \r\n\t\tAnonymous participants are classified as: \r\n\t\t* Participants who are not logged in to Teams with a work or school account. \r\n\t\t* Participants from non-trusted organizations (as configured in external access). \r\n\t\t* Participants from organizations where there is not mutual trust. \r\n\t\t**Note** : This setting only applies when Who can bypass the lobby is set to Everyone. If the anonymous users can join a meeting organization-level setting or meeting policy is Off, this setting only applies to dial-in callers. \r\n ", "rationale": "Not allowing anonymous participants to automatically join a meeting reduces the risk of meeting spamming.", "impact": "Anonymous participants will not be able to start a Microsoft Teams meeting.", "remediation": { "text": "\r\n\t\t\t###### To remediate using the UI: \r\n\t\t\t1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. \r\n\t\t\t2. Click to expand Meetings select Meeting policies. \r\n\t\t\t3. Click Global (Org-wide default). \r\n\t\t\t4. Under meeting join \u0026 lobby set Anonymous users and dial-in callers can start a meeting to Off. \r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings", "https://learn.microsoft.com/en-US/microsoftteams/who-can-bypass-meeting-lobby?WT.mc_id=TeamsAdminCenterCSH#overview-of-lobby-settings-and-policies" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.0.1", "reference": "8.5.2", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "o365_teams_skype_meeting_policies", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "Identity", "eq", "Global" ], [ "AllowAnonymousUsersToStartMeeting", "eq", "true" ] ], "operator": "and" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "identity": "Identity", "description": "Description", "allowAnonymousUsersToJoinMeeting": "Allow Anonymous Users To Join Meeting", "allowAnonymousUsersToStartMeeting": "Anonymour Users Can Start a Meeting" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "Ensure anonymous users and dial-in callers can\u0027t start a meeting", "defaultMessage": null }, "properties": { "resourceName": "Description", "resourceId": "ConfigId", "resourceType": "TeamsMeetingPolicy" }, "onlyStatus": false } }, "idSuffix": "teams_anonymous_users_and_dialin_callers_not_restricted_start_meeting", "notes": [], "categories": [], "immutableProperties": [ "Description", "ConfigId", "Key.SchemaId.XName.name" ], "id": "microsoft365_2165" } |