Keep dial-in callers in the Teams meeting lobby

Description

People who join a meeting by phone wait in the lobby until an organizer, co-organizer or presenter admits them (AllowPSTNUsersToBypassLobby = False in every meeting policy).

Rationale

Dial-in participants are not authenticated: their caller ID can be spoofed and conference IDs leak through forwarded invitations. Keeping them in the lobby lets the organizer decide before they hear the meeting.

Impact

Organizers must admit phone participants. The setting is a default that organizers can change in Meeting options. Off is the default.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
3. In the Meeting join & lobby section, check that People dialing in can bypass the lobby is Off.
4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowPSTNUsersToBypassLobby.
5. Fail if any policy returns True.

Remediation

1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
2. In the Meeting join & lobby section, set People dialing in can bypass the lobby to Off and Save. Role: Teams Administrator.
3. Repeat for each custom policy, unless a documented exception applies to its users.
4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.

References

• Manage lobby options in Microsoft Teams Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMeetingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-COLLAB-025 Let only people in the organization bypass the Teams meeting lobby

People and lifecycle