rules/findings/m365/microsoft_teams/meetings/ms-teams-anonymous-users-and-dial-in-callers-not-restricted-start-meeting.json

{
    "args": [
         
    ],
    "provider": "Microsoft365",
    "serviceType": "Microsoft Teams",
    "serviceName": "Microsoft 365",
    "displayName": "Ensure anonymous users and dial-in callers can\u0027t start a meeting",
    "description": "\r\n\t\tThis policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization. \r\n\t\tAnonymous participants are classified as: \r\n\t\t* Participants who are not logged in to Teams with a work or school account. \r\n\t\t* Participants from non-trusted organizations (as configured in external access). \r\n\t\t* Participants from organizations where there is not mutual trust. \r\n\t\t**Note** : This setting only applies when Who can bypass the lobby is set to Everyone. If the anonymous users can join a meeting organization-level setting or meeting policy is Off, this setting only applies to dial-in callers. \r\n ",
    "rationale": "Not allowing anonymous participants to automatically join a meeting reduces the risk of meeting spamming.",
    "impact": "Anonymous participants will not be able to start a Microsoft Teams meeting.",
    "remediation": {
        "text": "\r\n\t\t\t###### To remediate using the UI: \r\n\t\t\t1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. \r\n\t\t\t2. Click to expand Meetings select Meeting policies. \r\n\t\t\t3. Click Global (Org-wide default). \r\n\t\t\t4. Under meeting join \u0026 lobby set Anonymous users and dial-in callers can start a meeting to Off. \r\n\t",
        "code": {
            "powerShell": null,
            "iac": null,
            "terraform": null,
            "other": null
        }
    },
    "recommendation": null,
    "references": [
        "https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings",
        "https://learn.microsoft.com/en-US/microsoftteams/who-can-bypass-meeting-lobby?WT.mc_id=TeamsAdminCenterCSH#overview-of-lobby-settings-and-policies"
    ],
    "compliance": [
        {
            "name": "CIS Microsoft 365 Foundations Benchmark",
            "version": "6.0.1",
            "reference": "8.5.2",
            "profile": [
                "E3 Level 1",
                "E5 Level 1"
            ]
        }
    ],
    "level": "medium",
    "tags": [
         
    ],
    "rule": {
        "path": "o365_teams_skype_meeting_policies",
        "subPath": null,
        "selectCondition": {
             
        },
        "query": [
            {
                "filter": [
                    {
                        "conditions": [
                            [
                                "Identity",
                                "eq",
                                "Global"
                            ],
                            [
                                "AllowAnonymousUsersToStartMeeting",
                                "eq",
                                "true"
                            ]
                        ],
                        "operator": "and"
                    }
                ]
            }
        ],
        "shouldExist": null,
        "returnObject": null,
        "removeIfNotExists": null
    },
    "output": {
        "html": {
            "data": {
                "properties": {
                    "Identity": "Identity",
                    "Description": "Description",
                    "AllowAnonymousUsersToJoinMeeting": "Allow Anonymous Users To Join Meeting",
                    "AllowAnonymousUsersToStartMeeting": "Anonymour Users Can Start a Meeting"
                },
                "expandObject": null
            },
            "table": "default",
            "decorate": [
                 
            ],
            "emphasis": [
                 
            ],
            "actions": {
                "objectData": {
                    "properties": [
                        "*"
                    ],
                    "expandObject": null,
                    "limit": null
                },
                "showGoToButton": "True",
                "showModalButton": "True",
                "directLink": null
            }
        },
        "text": {
            "data": {
                "properties": {
                     
                },
                "expandObject": null
            },
            "status": {
                "keyName": [
                     
                ],
                "message": "Ensure anonymous users and dial-in callers can\u0027t start a meeting",
                "defaultMessage": null
            },
            "properties": {
                "resourceName": "Description",
                "resourceId": "ConfigId",
                "resourceType": "TeamsMeetingPolicy"
            },
            "onlyStatus": false
        }
    },
    "idSuffix": "teams_anonymous_users_and_dialin_callers_not_restricted_start_meeting",
    "notes": [
         
    ],
    "categories": [
         
    ],
    "immutable_properties": [
        "Description",
        "ConfigId",
        "Key.SchemaId.XName.name"
    ],
    "id": "microsoft365_2165"
}