Prevent anonymous users and dial-in callers from starting Teams meetings

Description

Anonymous participants and people dialing in by phone wait in the lobby until an authenticated participant (someone from the organization, a guest or a trusted organization user) starts the meeting (AllowAnonymousUsersToStartMeeting = False in every meeting policy).

Rationale

Leaderless meetings let unverified people meet on the organization's bridge at unscheduled times, reuse old meeting links for their own purposes, and run up audio conferencing costs. Keeping them in the lobby until a verified participant arrives keeps control of the meeting with its organizer.

Impact

Recurring meetings where external dial-in participants used to start without the organizer must wait for an internal participant. None known otherwise; Off is the default.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
3. In the Meeting join & lobby section, check that Anonymous users and dial-in callers can start a meeting is Off.
4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToStartMeeting.
5. Fail if any policy returns True.

Remediation

1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
2. In the Meeting join & lobby section, set Anonymous users and dial-in callers can start a meeting to Off and Save. Role: Teams Administrator.
3. Repeat for each custom policy, unless a documented exception applies to its users.
4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.

References

• Manage lobby options in Microsoft Teams Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMeetingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-COLLAB-023 Prevent anonymous participants from joining Teams meetings
• related CB-M365-COLLAB-025 Let only people in the organization bypass the Teams meeting lobby

People and lifecycle