What this check looks at
Checks that people who dial in to a Teams meeting by phone wait in the lobby.
People who join a Teams meeting by phone, through its dial-in number and conference ID, are identified only by their phone number, or by nothing if the number is withheld. AllowPSTNUsersToBypassLobby in the meeting policy ("People dialling in can bypass the lobby") decides whether they go straight in or wait in the lobby like other outside participants. It matters wherever meetings have dial-in numbers, which come with Teams audio conferencing.
The check reads the Global meeting policy and fails when AllowPSTNUsersToBypassLobby is true, also counting custom meeting policies with the same value. If Global is correct but a custom policy is not, it warns and names that policy.
The dial-in number and conference ID are printed in every invitation, and a recurring meeting keeps the same ones for months. Anyone with an old invitation can phone in and listen, and the participant list shows only a partly hidden number that few organisers question.
Why it matters
A phone number tells the organiser nothing about who is calling. Dial-in callers who skip the lobby can listen in without anyone deciding to let them.
A typical case: a monthly board meeting has used the same Teams invitation for two years. A former director, or anyone who saw the invitation in a forwarded email, can dial in and listen to discussions of results, disputes and staff matters. With dial-in callers held in the lobby, the organiser would at least see an unknown number waiting and decide.
Board, HR and client discussions are exactly the meetings where an unseen listener does most damage, and a phone caller leaves the least trace of who they were.
CIS Microsoft 365 Foundations Benchmark 8.5.4 and CISA SCuBA MS.TEAMS.1.5v1 ask that dial-in users cannot bypass the lobby, and MS.TEAMS.1.3v1 asks that dial-in callers are not admitted automatically. Callers wait a moment until admitted; nothing else changes.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
Step by step
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowPSTNUsersToBypassLobby. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "People dialling in can bypass the lobby", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowPSTNUsersToBypassLobby $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowPSTNUsersToBypassLobby again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then dial in to a test meeting by phone: you should hear that you are waiting in the lobby until someone in the meeting admits you.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false
What users will notice
People dialling in by phone wait in the lobby until admitted.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowPSTNUsersToBypassLobby shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access control |
| CISA SCuBA | MS.TEAMS.1.3v1 Anonymous users and dial-in callers not admitted automaticallyMS.TEAMS.1.5v1 Dial-in users cannot bypass the lobby |
| CIS M365 | 8.5.4 Ensure users dialing in can't bypass the lobby |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Control who can bypass the meeting lobby (Microsoft Learn)