Prevent external participants from giving or requesting control of shared screens

Description

External participants, guests and anonymous users can neither request nor be given control of a screen or window shared by a user of the organization (AllowExternalParticipantGiveRequestControl = False in every meeting policy). Control can still be passed between internal participants.

Rationale

Remote control turns a meeting into a remote access session on the user's device. Attackers posing as IT support ask victims to share their screen and grant control, then install tools or read data. Keeping control internal removes this path without affecting screen sharing itself.

Impact

External support providers who used Teams to take control of user screens need another remote assistance tool under its own access control. Off is the default.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
3. In the Content sharing section, check that External participants can give or request control is Off.
4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalParticipantGiveRequestControl.
5. Fail if any policy returns True.

Remediation

1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
2. In the Content sharing section, set External participants can give or request control to Off and Save. Role: Teams Administrator.
3. Repeat for each custom policy, unless a documented exception applies to its users.
4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.

References

• Manage who can present and request control in Teams meetings Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMeetingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-028 Make only organizers and co-organizers presenters by default

People and lifecycle