rules/findings/m365/microsoft_teams/users/ms-teams-external-users-can-initiate-conversations.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Microsoft Teams", "serviceName": "Microsoft 365", "displayName": "Ensure external Teams users cannot initiate conversations", "description": "\r\n\t\tThis setting prevents external users who are not managed by an organization from initiating contact with users in the protected organization. \r\n\t\tThe recommended state is to uncheck `External users with Teams accounts not managed by an organization can contact users in my organization`. \r\n\t\t**Note** : Disabling this setting is used as an additional stop gap for the previous setting which disables communication with unmanaged Teams users entirely. If an organization chooses to have an exception to (L1) Ensure communication with unmanaged Teams users is disabled they can do so while also disabling the ability for the same group of users to initiate contact. Disabling communication entirely will also disable the ability for unmanaged users to initiate contact. \r\n ", "rationale": "\r\n\t\tAllowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account. Some real-world attacks and exploits delivered via Teams over external access channels include: \r\n\t\t* DarkGate malware \r\n\t\t* Social engineering / Phishing attacks by `Midnight Blizzard` \r\n\t\t* GIFShell \r\n\t\t* Username enumeration\r\n ", "impact": "The impact of disabling this is very low.", "remediation": { "text": "\r\n\t\t\t###### To remediate using the UI: \r\n\t\t\t1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. \r\n\t\t\t2. Click to expand Users select External access. \r\n\t\t\t3. Scroll to Teams accounts not managed by an organization \r\n\t\t\t4. Uncheck External users with Teams accounts not managed by an organization can contact users in my organization. \r\n\t\t\t5. Click Save. \r\n\r\n\t\t\t**Note** : If People in my organization can communicate with Teams users whose accounts aren\u0027t managed by an organization is already set to Off then this setting will not be visible and can be considered to be in a passing state. \r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings", "https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response", "https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/", "https://www.bitdefender.com/blog/hotforsecurity/gifshell-attack-lets-hackers-create-reverse-shell-through-microsoft-teams-gifs/" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "7.0.0", "reference": "8.2.3", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "o365_teams_external_access_policies", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "Identity", "eq", "Global" ], [ "EnableTeamsConsumerInbound", "eq", "true" ] ], "operator": "and" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "ConfigId": "Config Id", "Identity": "Identity", "EnableTeamsConsumerInbound": "Users Can Initiate Conversations" }, "expandObject": null }, "table": "default", "decorate": [ { "itemName": "Users Can Initiate Conversations", "itemValue": "enabled", "className": "badge badge-danger badge-xl" } ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ ], "message": "Ensure external Teams users cannot initiate conversations", "defaultMessage": "Ensure external Teams users cannot initiate conversations" }, "properties": { "resourceName": "Identity", "resourceId": "ConfigId", "resourceType": "TeamsExternalAccessPolicy" }, "onlyStatus": false } }, "idSuffix": "teams_external_users_cannot_initiate_conversations", "notes": [ ], "categories": [ ], "immutable_properties": [ "ConfigId", "Identity" ], "id": "microsoft365_2180" } |