Back to Checks
m365

Meetings global policy does not allow anonymous users in meeting chat

teams_meeting_chat_anonymous_users_disabled
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 Teams meeting policies restrict chat so anonymous participants cannot send or read messages.

Accepted configurations include EnabledExceptAnonymous or EnabledInMeetingOnlyForAllExceptAnonymous.

Prowler logoProwlerprowler-provider-m365

Risk

Anonymous chat enables unverified users to leak sensitive content, post phishing/malware links, and impersonate others.

This undermines confidentiality and accountability, and can disrupt meetings through spam, affecting availability and auditability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_chat_anonymous_users_disabled

Recommendation

Enforce chat for authenticated users only following least privilege.

  • Block chat for anonymous users
  • Use guest access with identity verification and lobby controls
  • Apply DLP and link/file protection to chat
  • Monitor audit logs and set retention to ensure traceability

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType EnabledExceptAnonymous

Other

1Sign in to the Microsoft Teams admin center: https://admin.teams.microsoft.com
2Go to Meetings > Meeting policies
3Open Global (Org-wide default)
4Under Meeting engagement, set Meeting chat to "On for everyone but anonymous users"
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_chat_anonymous_users_disabled(Check):
    """Check if meeting chat does not allow anonymous users.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for meeting chat does not allow anonymous users.

        This method checks if meeting chat does not allow anonymous users.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = "Meeting chat allows anonymous users."

            allowed_meeting_chat_settings = {
                "EnabledExceptAnonymous",
                "EnabledInMeetingOnlyForAllExceptAnonymous",
            }

            if (
                global_meeting_policy.meeting_chat_enabled_type
                in allowed_meeting_chat_settings
            ):
                report.status = "PASS"
                report.status_extended = "Meeting chat does not allow anonymous users."

            findings.append(report)

        return findings

References