Block chat in external meetings hosted by untrusted organizations

Description

Users of the organization cannot read or write chat messages in Teams meetings hosted by organizations that are not trusted in external access (AllowExternalNonTrustedMeetingChat = False in every meeting policy). They can still join those meetings with audio, video and screen sharing.

Rationale

A meeting hosted by an untrusted tenant is an easy pretext for phishing: the attacker invites the victim, then drops links or files in the meeting chat, outside the organization's chat protections. The same chat is a channel to paste internal content to an unknown party. Blocking chat in those meetings narrows both.

Impact

Users attending meetings of customers or suppliers that are not in the trusted list cannot use the meeting chat. Add frequent partners to external access (CB-M365-COLLAB-018) to restore it.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
3. In the Meeting engagement section, check that External meeting chat is Off.
4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalNonTrustedMeetingChat.
5. Fail if any policy returns True.

Remediation

1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
2. In the Meeting engagement section, set External meeting chat to Off and Save. Role: Teams Administrator.
3. Repeat for each custom policy, unless a documented exception applies to its users.
4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $false (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.

References

• Set-CsTeamsMeetingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Teams settings and policies reference Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-018 Limit Teams external access to approved domains
• related CB-M365-COLLAB-027 Turn off meeting chat for anonymous participants

People and lifecycle