# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-COLLAB-026
title: Keep dial-in callers in the Teams meeting lobby
finding:
  title: People dialing in by phone join Teams meetings without passing through the lobby
  description: A caller with the dial-in number and conference ID enters the meeting directly, identified only by a phone number that can be spoofed.
status: active
profiles: [baseline]
risk:
  severity: low
assessment: manual
tags: [teams, meetings, lobby, pstn]

applicability:
  requires:
    - Microsoft Teams

description: |
  People who join a meeting by phone wait in the lobby until an organizer, co-organizer or presenter
  admits them (`AllowPSTNUsersToBypassLobby` = `False` in every meeting policy).
rationale: |
  Dial-in participants are not authenticated: their caller ID can be spoofed and conference IDs leak
  through forwarded invitations. Keeping them in the lobby lets the organizer decide before they hear
  the meeting.
impact: |
  Organizers must admit phone participants. The setting is a default that organizers can change in
  **Meeting options**. Off is the default.

setting:
  location: Teams admin center > Meetings > Meeting policies > Meeting join & lobby > People dialing in can bypass the lobby
  default_value: "Off"
  recommended_value: Off (AllowPSTNUsersToBypassLobby = False)

audit:
  manual: |
    1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a
       Global Reader.
    2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,
       then every custom policy assigned to users.
    3. In the **Meeting join & lobby** section, check that **People dialing in can bypass the lobby** is
       **Off**.
    4. With Microsoft Teams PowerShell (Global Reader is enough):
       `Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowPSTNUsersToBypassLobby`.
    5. Fail if any policy returns `True`.

remediation:
  manual: |
    1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global
       (Org-wide default)** policy.
    2. In the **Meeting join & lobby** section, set **People dialing in can bypass the lobby** to
       **Off** and **Save**. Role: Teams Administrator.
    3. Repeat for each custom policy, unless a documented exception applies to its users.
    4. PowerShell equivalent:
       `Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false` (repeat with
       `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.

references:
  - title: Manage lobby options in Microsoft Teams
    url: https://learn.microsoft.com/microsoftteams/who-can-bypass-meeting-lobby
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Set-CsTeamsMeetingPolicy
    url: https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Microsoft Teams baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "8.5.4"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.TEAMS.1.5v1
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-3
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-8
    relation: related
related_controls:
  - id: CB-M365-COLLAB-025
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24