Back to Checks
m365

Meetings global policy prevents external participants from giving or requesting control

teams_meeting_external_control_disabled
Service: teamsSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 Teams meeting policies govern whether external participants can give, be given, or request control during screen sharing via allowExternalParticipantGiveRequestControl.

Evaluation targets the org-wide default policy to confirm external control actions are blocked.

Prowler logoProwlerprowler-provider-m365

Risk

External control during sharing enables remote input on the presenter's device, impacting:

  • Confidentiality: viewing/copying sensitive data
  • Integrity: unauthorized changes, keystroke injection, malware launch
  • Availability: session disruption or app termination

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_external_control_disabled

Recommendation

Apply least privilege: disable external give/request control by setting allowExternalParticipantGiveRequestControl=false in the org-wide policy.

If business-justified, restrict presenters to trusted users, limit sharing to SingleApplication, use lobby/presenter roles, and monitor for misuse.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false

Other

1Open Microsoft Teams admin center: https://admin.teams.microsoft.com
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4In Content sharing, set "External participants can give or request control" to Off
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_external_control_disabled(Check):
    """Check if external participants can't give or request control in meetings.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for external participants' control permissions in meetings.

        This method checks if external participants are prevented from giving or requesting control in meetings.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = (
                "External participants can give or request control."
            )

            if (
                not global_meeting_policy.allow_external_participant_give_request_control
            ):
                report.status = "PASS"
                report.status_extended = (
                    "External participants cannot give or request control."
                )

            findings.append(report)

        return findings

References