Back to Checks
m365

Meetings global policy does not allow dial-in users to bypass the lobby

teams_meeting_dial_in_lobby_bypass_disabled
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 Teams meeting policies prevent PSTN dial-in callers from bypassing the lobby (AllowPSTNUsersToBypassLobby=false), requiring admission by organizers or presenters.

Prowler logoProwlerprowler-provider-m365

Risk

Direct admission of dial-in callers enables unauthenticated access, caller-ID spoofing, and meeting hijacking. Sensitive content can be overheard or recorded (confidentiality), discussions manipulated (integrity), and sessions disrupted (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_dial_in_lobby_bypass_disabled

Recommendation

Enforce the lobby for all PSTN dial-in callers. Restrict admission to organizers or presenters, and allow only authenticated or explicitly invited users to bypass. Standardize via org-wide meeting policies or templates to uphold least privilege and defense in depth.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false

Other

1Sign in to the Microsoft Teams admin center: https://admin.teams.microsoft.com
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4In Meeting join & lobby, set "People dialing in can bypass the lobby" to Off
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_dial_in_lobby_bypass_disabled(Check):
    """Check if users dialing in can't bypass the lobby.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for users dialing in can't bypass the lobby.

        This method checks if users dialing in can't bypass the lobby.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = "Dial-in users can bypass the lobby."

            if not global_meeting_policy.allow_pstn_users_to_bypass_lobby:
                report.status = "PASS"
                report.status_extended = "Dial-in users cannot bypass the lobby."

            findings.append(report)

        return findings

References