What this check looks at
Checks whether people who are not signed in can join Teams meetings.
An anonymous participant is someone who joins a Teams meeting without signing in to any Microsoft account: they open the link in a browser, type whatever name they like and join or wait in the lobby. Whether that is possible in meetings your users organise is set per organiser by AllowAnonymousUsersToJoinMeeting in the meeting policy ("Anonymous users can join a meeting"), and Microsoft’s Global policy allows it.
The check reads the Global meeting policy and fails when AllowAnonymousUsersToJoinMeeting is true, also counting any custom meeting policies with the same value. If Global is correct but a custom policy still allows anonymous join, it warns and names that policy, because the people assigned it are not covered.
Meeting links are forwarded, pasted into shared calendars and sit in mailboxes an attacker may already be reading. With anonymous join on, anyone holding a link can attend under any name. Organisers often admit a half-familiar name from the lobby, and once in, the participant hears everything said and sees everything shared.
Why it matters
An anonymous participant could be anyone holding the link. Meetings about customers, finances or staff are then open to whoever the invitation was forwarded to, with no name or organisation to hold to account.
A typical case: a finance director holds a recurring Teams call with the bank and the auditors. The invitation sits in a mailbox that was later compromised. Weeks later an attacker joins anonymously as "Mark (Audit)", listens to the discussion of a large payment due next week, and uses what they heard to make a payment-diversion email entirely convincing.
Signed-in participants carry a verified name and organisation the organiser can see; anonymous ones carry nothing. Where meetings discuss personal data, such as HR cases or client matters, an unknown listener is a confidentiality breach the organisation may have to assess under UK GDPR.
CIS Microsoft 365 Foundations Benchmark 8.5.1 asks that anonymous users cannot join meetings. For the few people who genuinely meet anyone without an account (job candidates, members of the public), give a custom meeting policy to those organisers only, or use a town hall or webinar. That policy then shows as a warning on this check, naming it, which records the exception as deliberate.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Find out who meets regularly with people who join without an account (customers, candidates) and how: a guest account, or a webinar or town hall, may suit better.
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Decide who still needs anonymous join. Find out who meets people without any Microsoft account (recruiters, client-facing teams) and how often. Most can invite those people as guests or use a webinar or town hall. For any who cannot, give them a custom meeting policy that allows anonymous join, assigned to them only, and leave that one policy as it is in the steps below. Tell users when the change happens and what attendees will see.
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToJoinMeeting. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Anonymous users can join a meeting", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowAnonymousUsersToJoinMeeting $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Turn off the organisation-level switch too, if your tenant still shows it. In the Teams admin centre, check Meetings > Meeting settings > Participants. If "Anonymous users can join a meeting" is listed there, set it to Off and select Save. Microsoft is moving this control to the meeting policy, which is what this check reads, but while both exist either can allow anonymous join.
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToJoinMeeting again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then open a meeting link organised by someone on the Global policy in a private browser window and choose to join on the web: you should be asked to sign in rather than to type a name.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false
What users will notice
People who are not signed in can no longer join meetings organised by your users; they are asked to sign in with a work or personal Microsoft account.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowAnonymousUsersToJoinMeeting shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access control |
| CIS M365 | 8.5.1 Ensure anonymous users can't join a meeting |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage anonymous participant access to Teams meetings (Microsoft Learn)