# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-COLLAB-029
title: Prevent external participants from giving or requesting control of shared screens
finding:
  title: External participants can take control of screens shared in Teams meetings
  description: A guest, federated or anonymous participant can request keyboard and mouse control of a user's shared desktop.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [teams, meetings, screen-sharing, social-engineering]

applicability:
  requires:
    - Microsoft Teams

description: |
  External participants, guests and anonymous users can neither request nor be given control of a
  screen or window shared by a user of the organization (`AllowExternalParticipantGiveRequestControl`
  = `False` in every meeting policy). Control can still be passed between internal participants.
rationale: |
  Remote control turns a meeting into a remote access session on the user's device. Attackers posing
  as IT support ask victims to share their screen and grant control, then install tools or read data.
  Keeping control internal removes this path without affecting screen sharing itself.
impact: |
  External support providers who used Teams to take control of user screens need another remote
  assistance tool under its own access control. Off is the default.

setting:
  location: Teams admin center > Meetings > Meeting policies > Content sharing > External participants can give or request control
  default_value: "Off"
  recommended_value: Off (AllowExternalParticipantGiveRequestControl = False)

audit:
  manual: |
    1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a
       Global Reader.
    2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,
       then every custom policy assigned to users.
    3. In the **Content sharing** section, check that **External participants can give or request
       control** is **Off**.
    4. With Microsoft Teams PowerShell (Global Reader is enough):
       `Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalParticipantGiveRequestControl`.
    5. Fail if any policy returns `True`.

remediation:
  manual: |
    1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global
       (Org-wide default)** policy.
    2. In the **Content sharing** section, set **External participants can give or request control** to
       **Off** and **Save**. Role: Teams Administrator.
    3. Repeat for each custom policy, unless a documented exception applies to its users.
    4. PowerShell equivalent:
       `Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false`
       (repeat with `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.

references:
  - title: Manage who can present and request control in Teams meetings
    url: https://learn.microsoft.com/microsoftteams/meeting-who-present-request-control
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Set-CsTeamsMeetingPolicy
    url: https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Microsoft Teams baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "8.5.7"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.TEAMS.1.1v1
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-17
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-3
    relation: related
threats:
  - framework: mitre-attack
    id: T1219
related_controls:
  - id: CB-M365-COLLAB-028
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24