{
  "id": "CB-M365-COLLAB-026",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-026",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-026.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-026.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-026",
    "title": "Keep dial-in callers in the Teams meeting lobby",
    "finding": {
      "title": "People dialing in by phone join Teams meetings without passing through the lobby",
      "description": "A caller with the dial-in number and conference ID enters the meeting directly, identified only by a phone number that can be spoofed."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "meetings",
      "lobby",
      "pstn"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "People who join a meeting by phone wait in the lobby until an organizer, co-organizer or presenter\nadmits them (`AllowPSTNUsersToBypassLobby` = `False` in every meeting policy).\n",
    "rationale": "Dial-in participants are not authenticated: their caller ID can be spoofed and conference IDs leak\nthrough forwarded invitations. Keeping them in the lobby lets the organizer decide before they hear\nthe meeting.\n",
    "impact": "Organizers must admit phone participants. The setting is a default that organizers can change in\n**Meeting options**. Off is the default.\n",
    "setting": {
      "location": "Teams admin center > Meetings > Meeting policies > Meeting join & lobby > People dialing in can bypass the lobby",
      "default_value": "Off",
      "recommended_value": "Off (AllowPSTNUsersToBypassLobby = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,\n   then every custom policy assigned to users.\n3. In the **Meeting join & lobby** section, check that **People dialing in can bypass the lobby** is\n   **Off**.\n4. With Microsoft Teams PowerShell (Global Reader is enough):\n   `Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowPSTNUsersToBypassLobby`.\n5. Fail if any policy returns `True`.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global\n   (Org-wide default)** policy.\n2. In the **Meeting join & lobby** section, set **People dialing in can bypass the lobby** to\n   **Off** and **Save**. Role: Teams Administrator.\n3. Repeat for each custom policy, unless a documented exception applies to its users.\n4. PowerShell equivalent:\n   `Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false` (repeat with\n   `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.\n"
    },
    "references": [
      {
        "title": "Manage lobby options in Microsoft Teams",
        "url": "https://learn.microsoft.com/microsoftteams/who-can-bypass-meeting-lobby",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMeetingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.1.5v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-8",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-025",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}