What this check looks at
Checks whether people who are not signed in, or who dial in by phone, can start a Teams meeting before anyone from the organisation joins.
AllowAnonymousUsersToStartMeeting in the meeting policy ("Anonymous users and dial-in callers can start a meeting") decides whether anonymous participants and people dialling in by phone can start a meeting before anyone from your organisation has joined. With it on, they are let in as soon as they arrive; with it off, they wait in the lobby until the organiser or another person from the organisation is there.
The check reads the Global meeting policy and fails when AllowAnonymousUsersToStartMeeting is true, also counting custom meeting policies with the same value. If Global is correct but a custom policy is not, it warns and names that policy.
An outsider who can start the meeting gets it to themselves on your organisation’s account. They can be there, under a plausible name, before your staff arrive, present to whoever joins early, or use a recurring meeting as a free conference line, including your organisation’s dial-in numbers.
Why it matters
A meeting that outsiders can start runs on the organisation’s account with nobody from it present. It can be used to host calls the organisation never agreed to, and to wait in a meeting for the people it invites.
A typical case: a contractor who left months ago still has the link and dial-in details for a weekly client call. They use the meeting to hold their own calls, on your organisation’s dial-in numbers, and on one occasion are already in the meeting when the client joins early, introducing themselves as the account manager.
The cost is partly direct (dial-in minutes the organisation pays for) and partly trust: clients who meet an impostor in your meeting room assume the organisation let them in. It also weakens the lobby, because an outsider who starts the meeting is effectively the host until someone from the organisation arrives.
CIS Microsoft 365 Foundations Benchmark 8.5.2 and CISA SCuBA MS.TEAMS.1.2v2 ask that anonymous users and dial-in callers cannot start a meeting. Users notice very little: outside participants wait a moment in the lobby until someone from the organisation joins.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
Step by step
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToStartMeeting. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Anonymous users and dial-in callers can start a meeting", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowAnonymousUsersToStartMeeting $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToStartMeeting again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then start a test meeting from an account on the Global policy and, before the organiser joins, join it anonymously from a private browser window or by phone: you should be held in the lobby until the organiser arrives.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false
What users will notice
Anonymous participants and dial-in callers wait until someone from the organisation joins before the meeting starts.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToStartMeeting shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access control |
| CISA SCuBA | MS.TEAMS.1.2v2 Anonymous users cannot start meetings |
| CIS M365 | 8.5.2 Ensure anonymous users and dial-in callers can't start a meeting |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Meeting policy settings (Microsoft Learn)