cirsec Baselines
Esc
Microsoft 365 tenant · SharePoint, OneDrive & Teams

Let only people in the organization bypass the Teams meeting lobby

When it fails: External participants are admitted to Teams meetings without passing through the lobby. Guests, federated users or anonymous participants enter meetings directly, so the organizer cannot check who joins.

CB-M365-COLLAB-025mediumactivemanualprofile baseline

Description

By default only people in the organization (excluding guests), invited people, or only organizers and co-organizers join meetings directly; everyone else waits in the lobby until an organizer, co-organizer or presenter admits them. Who can bypass the lobby is People in my org, People who were invited or Only organizers and co-organizers (AutoAdmittedUsers = EveryoneInCompanyExcludingGuests, InvitedUsers or OrganizerOnly) in every meeting policy.

Rationale

The lobby is the only point where an organizer sees who is about to join before they hear and see the meeting. Admitting guests, federated users or anonymous participants automatically lets anyone with a forwarded link or an impersonated identity into confidential discussions unnoticed.

Impact

External participants wait to be admitted, which adds a step for meetings with partners. The policy sets the default of the Meeting options; organizers can change it per meeting. To enforce it for sensitive meetings, use a meeting template or sensitivity label (Teams Premium). The vendor default (People in my org and guests) admits guests directly and does not meet this control.

Applies when

Requires: Microsoft Teams

Setting

LocationTeams admin center > Meetings > Meeting policies > Meeting join & lobby > Who can bypass the lobby
DefaultPeople in my org and guests (EveryoneInCompany)
RecommendedPeople in my org, People who were invited, or Only organizers and co-organizers

Audit

  1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
  2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
  3. In the Meeting join & lobby section, check that Who can bypass the lobby is People in my org, People who were invited or Only organizers and co-organizers.
  4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AutoAdmittedUsers.
  5. Fail if any policy returns Everyone, EveryoneInSameAndFederatedCompany or EveryoneInCompany.

Remediation

  1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
  2. In the Meeting join & lobby section, set Who can bypass the lobby to People in my org and Save. Role: Teams Administrator.
  3. Repeat for each custom policy, unless a documented exception applies to its users.
  4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers EveryoneInCompanyExcludingGuests (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1AC-3related
NIST SP 800-53 Rev. 55.1.1AC-14related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.TEAMS.1.3v1equivalent
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.TEAMS.1.4v1partialSCuBA wants people in the organization admitted automatically; this control also accepts stricter values (invited people, organizers only).

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr