{
  "id": "CB-M365-COLLAB-025",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-025",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-025.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-025.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-025",
    "title": "Let only people in the organization bypass the Teams meeting lobby",
    "finding": {
      "title": "External participants are admitted to Teams meetings without passing through the lobby",
      "description": "Guests, federated users or anonymous participants enter meetings directly, so the organizer cannot check who joins."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "meetings",
      "lobby",
      "anonymous-access"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "By default only people in the organization (excluding guests), invited people, or only organizers\nand co-organizers join meetings directly; everyone else waits in the lobby until an organizer,\nco-organizer or presenter admits them. **Who can bypass the lobby** is **People in my org**,\n**People who were invited** or **Only organizers and co-organizers** (`AutoAdmittedUsers` =\n`EveryoneInCompanyExcludingGuests`, `InvitedUsers` or `OrganizerOnly`) in every meeting policy.\n",
    "rationale": "The lobby is the only point where an organizer sees who is about to join before they hear and see\nthe meeting. Admitting guests, federated users or anonymous participants automatically lets anyone\nwith a forwarded link or an impersonated identity into confidential discussions unnoticed.\n",
    "impact": "External participants wait to be admitted, which adds a step for meetings with partners. The policy\nsets the default of the **Meeting options**; organizers can change it per meeting. To enforce it for\nsensitive meetings, use a meeting template or sensitivity label (Teams Premium). The vendor default\n(**People in my org and guests**) admits guests directly and does not meet this control.\n",
    "setting": {
      "location": "Teams admin center > Meetings > Meeting policies > Meeting join & lobby > Who can bypass the lobby",
      "default_value": "People in my org and guests (EveryoneInCompany)",
      "recommended_value": "People in my org, People who were invited, or Only organizers and co-organizers"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,\n   then every custom policy assigned to users.\n3. In the **Meeting join & lobby** section, check that **Who can bypass the lobby** is **People in\n   my org**, **People who were invited** or **Only organizers and co-organizers**.\n4. With Microsoft Teams PowerShell (Global Reader is enough):\n   `Get-CsTeamsMeetingPolicy | Select-Object Identity, AutoAdmittedUsers`.\n5. Fail if any policy returns `Everyone`, `EveryoneInSameAndFederatedCompany` or\n   `EveryoneInCompany`.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global\n   (Org-wide default)** policy.\n2. In the **Meeting join & lobby** section, set **Who can bypass the lobby** to **People in my org**\n   and **Save**. Role: Teams Administrator.\n3. Repeat for each custom policy, unless a documented exception applies to its users.\n4. PowerShell equivalent:\n   `Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers EveryoneInCompanyExcludingGuests`\n   (repeat with `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.\n"
    },
    "references": [
      {
        "title": "Manage lobby options in Microsoft Teams",
        "url": "https://learn.microsoft.com/microsoftteams/who-can-bypass-meeting-lobby",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMeetingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.1.3v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.1.4v1",
        "relation": "partial",
        "note": "SCuBA wants people in the organization admitted automatically; this control also accepts stricter values (invited people, organizers only)."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-14",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-023",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-024",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-026",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}