Back to Checks
m365

Anonymous users cannot start Teams meetings

teams_meeting_anonymous_user_start_disabled
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 Teams meeting policies disable AllowAnonymousUsersToStartMeeting so anonymous users and dial-in callers cannot start meetings and must wait in the lobby until an authenticated participant joins

Prowler logoProwlerprowler-provider-m365

Risk

Without this control, outsiders can launch hostless meetings, enabling:

  • social engineering before staff join
  • malicious link sharing and meeting hijack It also allows PSTN toll abuse by dial-in callers. Impacts: confidentiality, integrity, and availability/cost.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_anonymous_user_start_disabled

Recommendation

Keep AllowAnonymousUsersToStartMeeting disabled. Require an authenticated organizer to start meetings and enforce the lobby so anonymous and dial-in participants wait. Limit lobby bypass to internal or invited users, disable anonymous join if unnecessary, and apply least-privilege and zero-trust principles to meeting access.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false

Other

1Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com)
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4Under Meeting join & lobby, set "Anonymous users and dial-in callers can start a meeting" to Off
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_anonymous_user_start_disabled(Check):
    """Check if anonymous users are not able to start meetings.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for anonymous users are not able to start meetings.

        This method checks if anonymous users and dial-in callers are not able to start meetings.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = "Anonymous Teams users can start meetings."

            if not global_meeting_policy.allow_anonymous_users_to_start_meeting:
                report.status = "PASS"
                report.status_extended = "Anonymous Teams users can not start meetings."

            findings.append(report)

        return findings

References