{
  "id": "CB-M365-COLLAB-029",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-029",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-029.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-029.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-029",
    "title": "Prevent external participants from giving or requesting control of shared screens",
    "finding": {
      "title": "External participants can take control of screens shared in Teams meetings",
      "description": "A guest, federated or anonymous participant can request keyboard and mouse control of a user's shared desktop."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "meetings",
      "screen-sharing",
      "social-engineering"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "External participants, guests and anonymous users can neither request nor be given control of a\nscreen or window shared by a user of the organization (`AllowExternalParticipantGiveRequestControl`\n= `False` in every meeting policy). Control can still be passed between internal participants.\n",
    "rationale": "Remote control turns a meeting into a remote access session on the user's device. Attackers posing\nas IT support ask victims to share their screen and grant control, then install tools or read data.\nKeeping control internal removes this path without affecting screen sharing itself.\n",
    "impact": "External support providers who used Teams to take control of user screens need another remote\nassistance tool under its own access control. Off is the default.\n",
    "setting": {
      "location": "Teams admin center > Meetings > Meeting policies > Content sharing > External participants can give or request control",
      "default_value": "Off",
      "recommended_value": "Off (AllowExternalParticipantGiveRequestControl = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,\n   then every custom policy assigned to users.\n3. In the **Content sharing** section, check that **External participants can give or request\n   control** is **Off**.\n4. With Microsoft Teams PowerShell (Global Reader is enough):\n   `Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalParticipantGiveRequestControl`.\n5. Fail if any policy returns `True`.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global\n   (Org-wide default)** policy.\n2. In the **Content sharing** section, set **External participants can give or request control** to\n   **Off** and **Save**. Role: Teams Administrator.\n3. Repeat for each custom policy, unless a documented exception applies to its users.\n4. PowerShell equivalent:\n   `Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false`\n   (repeat with `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.\n"
    },
    "references": [
      {
        "title": "Manage who can present and request control in Teams meetings",
        "url": "https://learn.microsoft.com/microsoftteams/meeting-who-present-request-control",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMeetingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.1.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-17",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1219"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-028",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}