Back to Checks
m365

Meetings org-wide default policy allows only organizers and co-organizers to present

teams_meeting_presenters_restricted
Service: teamsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Teams meeting policy sets the default Who can present to only organizers and co-organizers in the org-wide policy.

This evaluates whether attendees are limited to the attendee role by default rather than joining as presenters.

Prowler logoProwlerprowler-provider-m365

Risk

Allowing everyone to present enables unsolicited screen sharing and content uploads, causing data exposure (confidentiality), misleading or altered information during sessions (integrity), and meeting takeovers or disruptions (availability). External participants can exploit this to distribute phishing links or malware.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_presenters_restricted

Recommendation

Set Who can present to Only organizers and co-organizers by default.

Apply least privilege:

  • Grant presenter rights only to designated users per meeting
  • Keep others as attendees, especially externals
  • Use lobby/guest controls to limit elevation

Adopt defense in depth with monitoring and clear host procedures.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -DesignatedPresenterRoleMode "OrganizerOnlyUserOverride"

Other

1Sign in to the Teams admin center: https://admin.teams.microsoft.com
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4Under Content sharing, set Who can present to "Only organizers and co-organizers"
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_presenters_restricted(Check):
    """Check if only organizers and co-organizers can present.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for meeting presenter settings.

        This method checks if only organizers and co-organizers can present.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = (
                "Not only organizers and co-organizers can present."
            )

            if (
                global_meeting_policy.designated_presenter_role_mode
                == "OrganizerOnlyUserOverride"
            ):
                report.status = "PASS"
                report.status_extended = (
                    "Only organizers and co-organizers can present."
                )

            findings.append(report)

        return findings

References