This section helps reduce security risks posed by the external participants during meetings. In this instance, the term “external participants” includes external users, B2B guest users, unmanaged users, and anonymous users.

This section helps reduce security risks related to the user permissions for recording Teams meetings and events. These policies and user permissions apply to meetings hosted by a user, as well as during one-on-one calls and group calls started by a user. Agencies should comply with any other applicable policies or legislation in addition to this guidance.

• Rationale: An external participant with control of a shared screen could potentially perform unauthorized actions on the shared screen. This policy reduces that risk by removing an external participant’s ability to request control. However, if an agency has a legitimate use case to grant this control, it may be done on a case-by-case basis.
• Last modified: July 2023
• Note: This policy applies to the Global (Org-wide default) meeting policy, as well as custom meeting policies.
• MITRE ATT&CK TTP Mapping:
  
  • None

• Rationale: For agencies that implemented custom policies providing more flexibility to some users to automatically admit “everyone” to a meeting – this policy provides protection from anonymous users starting meeting to scrape internal contacts.
• Last modified: July 2023
• Note: This policy applies to the Global (Org-wide default) meeting policy, and custom meeting policies if they exist.
• MITRE ATT&CK TTP Mapping:
  
  • T1078: Valid Accounts
    
    • T1078.001: Default Accounts

• Rationale: Automatically allowing admittance to anonymous and dial-in users diminishes control of meeting participation and invites potential data breach. This policy reduces that risk by requiring all anonymous and dial-in users to wait in a lobby until admitted by an authorized meeting participant. If the agency has a use case to admit members of specific trusted organizations and/or B2B guests automatically, custom policies may be created and assigned to authorized meeting organizers.
• Last modified: July 2023
• Note: This policy applies to the Global (Org-wide default) meeting policy. Custom meeting policies MAY be created to allow specific users more flexibility. For example, B2B guest users and trusted partner members may be admitted automatically into meetings organized by authorized users.
• MITRE ATT&CK TTP Mapping:
  
  • None

• Rationale: Requiring internal users to wait in the lobby for explicit admission can lead to admission fatigue. This policy enables internal users to be automatically admitted to the meeting through global policy.
• Last modified: July 2023
• Note: This policy applies to the Global (Org-wide default) meeting policy. Custom meeting policies MAY be created to allow specific users more flexibility.
• MITRE ATT&CK TTP Mapping:
  
  • None

• Rationale: Automatically admitting dial-in users reduces control over who can participate in a meeting and increases potential for data breaches. This policy reduces the risk by requiring all dial-in users to wait in a lobby until they are admitted by an authorized meeting participant.
• Last modified: July 2023
• Note: This policy applies to the Global (Org-wide default) meeting policy, as well as custom meeting policies.
• MITRE ATT&CK TTP Mapping:
  
  • None

• Rationale: Allowing any user to record a Teams meeting or group call may lead to unauthorized disclosure of shared information, including audio, video, and shared screens. By disabling the meeting recording setting in the Global (Org-wide default) meeting policy, an agency limits information exposure.
• Last modified: March 2025
• Note: This policy applies to the Global (Org-wide default) meeting policy. Custom policies MAY be created to allow more flexibility for specific users.
• MITRE ATT&CK TTP Mapping:
  
  • None

• Rationale: Allowing to always record Live Events can pose data leakage and other security risks. Limiting recording permissions to only the organizer minimizes the security risk to the organizer’s discretion for these Live Events. Administrators can also disable recording for all live events.
• Last modified: March 2025
• Note: This policy applies to the Global (Org-wide default) meeting policy. Custom policies MAY be created to allow more flexibility for specific users.
• MITRE ATT&CK TTP Mapping:
  
  • None

• Manage who can present and request control in Microsoft Teams | Microsoft Learn

• Meeting policy settings | Microsoft Learn

• Teams cloud meeting recording | Microsoft Learn

• Assign policies in Teams – getting started | Microsoft Learn

• Live Event Recording Policies | Microsoft Learn

• N/A