{
  "id": "CB-M365-COLLAB-027",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-027",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-027.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-027.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-027",
    "title": "Turn off meeting chat for anonymous participants",
    "finding": {
      "title": "Anonymous participants can read and post in Teams meeting chat",
      "description": "Unauthenticated participants see the files and links shared in the meeting chat and can post links of their own to attendees."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "meetings",
      "anonymous-access",
      "chat"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "Meeting chat is on for everyone except anonymous participants (`MeetingChatEnabledType` =\n`EnabledExceptAnonymous`), or off (`Disabled`), in every meeting policy. Anonymous participants who\nare admitted cannot read or post chat messages.\n",
    "rationale": "Meeting chat often carries documents, links and decisions that outlive the meeting. An anonymous\nparticipant has no accountable identity and can use the chat to post phishing links that look like\npart of the meeting. Removing chat for anonymous participants limits both exposure and abuse while\nkeeping audio, video and screen sharing.\n",
    "impact": "Anonymous participants (for example customers without an account) cannot use the chat, including to\nask questions; use Q&A or invite them as guests. None known for authenticated participants.\n",
    "setting": {
      "location": "Teams admin center > Meetings > Meeting policies > Meeting engagement > Meeting chat",
      "default_value": "On for everyone (Enabled)",
      "recommended_value": "On for everyone but anonymous users (EnabledExceptAnonymous), or Off"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,\n   then every custom policy assigned to users.\n3. In the **Meeting engagement** section, check that **Meeting chat** is **On for everyone but\n   anonymous users** or **Off**.\n4. With Microsoft Teams PowerShell (Global Reader is enough):\n   `Get-CsTeamsMeetingPolicy | Select-Object Identity, MeetingChatEnabledType`.\n5. Fail if any policy returns `Enabled`.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global\n   (Org-wide default)** policy.\n2. In the **Meeting engagement** section, set **Meeting chat** to **On for everyone but anonymous\n   users** and **Save**. Role: Teams Administrator.\n3. Repeat for each custom policy, unless a documented exception applies to its users.\n4. PowerShell equivalent:\n   `Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType EnabledExceptAnonymous`\n   (repeat with `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.\n"
    },
    "references": [
      {
        "title": "Set-CsTeamsMeetingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Teams settings and policies reference",
        "url": "https://learn.microsoft.com/microsoftteams/settings-policies-reference",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-14",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-023",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-030",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}