CIS.M365.8.5.3: Ensure only people in my org can bypass the lobby

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.8.5.3
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Teams
Feature	Meetings
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 8.5.3 (L1, E3 Level 1)
Framework controls	cis-m365:8.5.3 nist-800-53-r5:AC-3 Access Enforcement
Reads from	Microsoft Teams

What this checks and how to fix it

8.5.3 (L1) Ensure only people in my org can bypass the lobby

This policy setting controls who can join a meeting directly and who must wait in the lobby until they’re admitted by an organizer, co-organizer, or presenter of the meeting.

The recommended state is People who were invited or more restrictive.

Rationale

For meetings that could contain sensitive information, it is best to allow the meeting organizer to vet anyone not directly sent an invite before admitting them to the meeting. This will also prevent the anonymous user from using the meeting link to have meetings at unscheduled times.

Impact

Individuals who are not part of the organization will have to wait in the lobby until they’re admitted by an organizer, co-organizer, or presenter of the meeting.

Any individual who dials into the meeting regardless of status will also have to wait in the lobby. This includes internal users who are considered unauthenticated when dialing in.

Remediation action

1. Navigate to Microsoft Teams Admin Center.
2. Select Settings & policies > Global (Org-wide default) settings.
3. Select Meetings to open the meeting settings section.
4. Under meeting join & lobby set Who can bypass the lobby to People who were invited or a more restrictive value: People in my org, Only organizers and co-organizers.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command to set the recommended state:

Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers "InvitedUsers"

Note: More restrictive values EveryoneInCompanyExcludingGuests or OrganizerOnly are also in compliance.

Related links

• Microsoft Teams Admin Center.
• Overview of lobby settings and policies
• Set-CsTeamsMeetingPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 535

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: HenrikPiecha; contributors: merill. Open-source licences.