{
  "id": "CB-M365-COLLAB-023",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-023",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-023.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-023.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-023",
    "title": "Prevent anonymous participants from joining Teams meetings",
    "finding": {
      "title": "Anonymous participants can join Teams meetings",
      "description": "People who are not signed in, or who come from untrusted organizations, can join meetings with any display name."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "meetings",
      "anonymous-access"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "Meetings organized by users of the organization do not admit anonymous participants\n(`AllowAnonymousUsersToJoinMeeting` = `False` in the Global meeting policy and in every custom\npolicy). Anonymous participants include people who are not signed in and users of organizations that\nare not trusted in external access. Guests, users from trusted organizations and dial-in callers can\nstill join.\n",
    "rationale": "Anonymous participants choose their own display name, so they can impersonate a colleague or a\npartner, and nothing ties their presence to an identity in the audit trail. In sensitive\nenvironments, requiring an authenticated identity for every participant removes meeting\neavesdropping and impersonation through forwarded or guessed meeting links.\n",
    "impact": "People without a Microsoft 365 work account in a trusted organization, a guest account or a phone\nline cannot join meetings: customers, candidates and the public need a guest invitation or a\ndedicated policy for the organizers who meet them. Webinars and town halls with public attendance\nneed a separate policy. The organization-wide **Anonymous users can join a meeting** setting in\n**Meetings** > **Meeting settings** is being retired; use the meeting policy.\n",
    "setting": {
      "location": "Teams admin center > Meetings > Meeting policies > Meeting join & lobby > Anonymous users can join a meeting",
      "default_value": "On",
      "recommended_value": "Off (AllowAnonymousUsersToJoinMeeting = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,\n   then every custom policy assigned to users.\n3. In the **Meeting join & lobby** section, check that **Anonymous users can join a meeting** is\n   **Off**.\n4. With Microsoft Teams PowerShell (Global Reader is enough):\n   `Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToJoinMeeting`.\n5. Fail if the Global policy or a custom policy assigned to users other than a documented exception\n   allows anonymous join.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global\n   (Org-wide default)** policy.\n2. In the **Meeting join & lobby** section, set **Anonymous users can join a meeting** to **Off**\n   and **Save**. Role: Teams Administrator.\n3. Repeat for each custom policy, unless a documented exception applies to its users.\n4. PowerShell equivalent:\n   `Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false` (repeat with\n   `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.\n5. Create a custom policy with anonymous join on for the organizers who must meet the public, and\n   assign it to them.\n"
    },
    "references": [
      {
        "title": "Manage anonymous participant access to Teams meetings",
        "url": "https://learn.microsoft.com/microsoftteams/anonymous-users-in-meetings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMeetingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Teams settings and policies reference",
        "url": "https://learn.microsoft.com/microsoftteams/settings-policies-reference",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-14",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-8",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-024",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-025",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-027",
        "type": "related",
        "note": "When anonymous join is blocked, the chat restriction only matters for policy exceptions."
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}