Back to Checks
m365

Meetings global policy allows only people in the organization to bypass the lobby

teams_meeting_external_lobby_bypass_disabled
Service: teamsSeverity: critical
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundariese3
Resource Type:NotDefined

Teams Meetings global policy restricts lobby bypass so only EveryoneInCompanyExcludingGuests, OrganizerOnly, or InvitedUsers are auto-admitted; all others wait in the lobby.

Prowler logoProwlerprowler-provider-m365

Risk

Auto-admitting external or anonymous users undermines confidentiality via covert listening and access to chat/files, and integrity through meeting hijacks, malicious screen sharing, and phishing. It also impacts availability by enabling disruptions and unsanctioned sessions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_external_lobby_bypass_disabled

Recommendation

Apply least privilege to lobby admission: set auto-admit to internal-only or to organizer/invitees, and require approval for guests, federated, anonymous, and PSTN. Enforce authentication and conditional access, and default to limited presenters for defense in depth.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers 'EveryoneInCompanyExcludingGuests'

Other

1Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com)
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4Under Meeting join & lobby, set Who can bypass the lobby to People in my org
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_external_lobby_bypass_disabled(Check):
    """Check if only people in the organization can bypass the lobby.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for only people in the organization can bypass the lobby.

        This method checks if only people in the organization can bypass the lobby.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = (
                "People outside the organization can bypass the lobby."
            )

            allowed_bypass_settings = {
                "EveryoneInCompanyExcludingGuests",
                "OrganizerOnly",
                "InvitedUsers",
            }
            if (
                global_meeting_policy.allow_external_users_to_bypass_lobby
                in allowed_bypass_settings
            ):
                report.status = "PASS"
                report.status_extended = (
                    "Only people in the organization can bypass the lobby."
                )

            findings.append(report)

        return findings

References