Prevent anonymous participants from joining Teams meetings

Description

Meetings organized by users of the organization do not admit anonymous participants (AllowAnonymousUsersToJoinMeeting = False in the Global meeting policy and in every custom policy). Anonymous participants include people who are not signed in and users of organizations that are not trusted in external access. Guests, users from trusted organizations and dial-in callers can still join.

Rationale

Anonymous participants choose their own display name, so they can impersonate a colleague or a partner, and nothing ties their presence to an identity in the audit trail. In sensitive environments, requiring an authenticated identity for every participant removes meeting eavesdropping and impersonation through forwarded or guessed meeting links.

Impact

People without a Microsoft 365 work account in a trusted organization, a guest account or a phone line cannot join meetings: customers, candidates and the public need a guest invitation or a dedicated policy for the organizers who meet them. Webinars and town halls with public attendance need a separate policy. The organization-wide Anonymous users can join a meeting setting in Meetings > Meeting settings is being retired; use the meeting policy.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
3. In the Meeting join & lobby section, check that Anonymous users can join a meeting is Off.
4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToJoinMeeting.
5. Fail if the Global policy or a custom policy assigned to users other than a documented exception allows anonymous join.

Remediation

1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
2. In the Meeting join & lobby section, set Anonymous users can join a meeting to Off and Save. Role: Teams Administrator.
3. Repeat for each custom policy, unless a documented exception applies to its users.
4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.
5. Create a custom policy with anonymous join on for the organizers who must meet the public, and assign it to them.

References

• Manage anonymous participant access to Teams meetings Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMeetingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Teams settings and policies reference Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-COLLAB-024 Prevent anonymous users and dial-in callers from starting Teams meetings
• related CB-M365-COLLAB-025 Let only people in the organization bypass the Teams meeting lobby
• related CB-M365-COLLAB-027 Turn off meeting chat for anonymous participants When anonymous join is blocked, the chat restriction only matters for policy exceptions.

People and lifecycle