Back to Checks
m365

Anonymous users cannot join Teams meetings

teams_meeting_anonymous_user_join_disabled
Service: teamsSeverity: critical
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 Teams org-wide meeting policy is evaluated to ensure anonymous meeting join is disabled, preventing non-authenticated participants from joining.

Prowler logoProwlerprowler-provider-m365

Risk

Anonymous meeting access allows unaccountable attendees to join, eavesdrop, capture shared content, and impersonate others.

This undermines confidentiality and integrity, and threatens availability via meeting hijacking, spam, and disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_anonymous_user_join_disabled

Recommendation

Disable anonymous meeting join tenant-wide and require authenticated users or managed guests.

Use lobby admission for externals, limit presenter rights per least privilege, and enforce conditional access or registration to control who enters.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false

Other

1Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com)
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4Set "Anonymous users can join a meeting" to Off
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_anonymous_user_join_disabled(Check):
    """Check if anonymous users are not able to join meetings.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for anonymous users are not able to join meetings.

        This method checks if anonymous users are not able to join meetings.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = "Anonymous Teams users can join meetings."

            if not global_meeting_policy.allow_anonymous_users_to_join_meeting:
                report.status = "PASS"
                report.status_extended = "Anonymous Teams users can not join meetings."

            findings.append(report)

        return findings

References