What this check looks at
Checks that people cannot chat in Teams meetings hosted by organisations that are not trusted (not on the external access allow list).
When your people join a meeting hosted by another organisation, whether they can use its chat depends partly on your own meeting policy. AllowExternalNonTrustedMeetingChat ("External meeting chat") decides whether your users can read and post in the chat of meetings hosted by organisations that are not trusted, meaning ones your Teams external access settings do not allow.
The check reads the Global meeting policy and fails when AllowExternalNonTrustedMeetingChat is true, also counting custom meeting policies with the same value. If Global is correct but a custom policy is not, it warns and names that policy.
In someone else’s meeting, the chat is run on the host’s terms and outside the protections you apply to your own meetings. In a meeting hosted by an organisation you have no relationship with, it is a channel for links and files that your own controls do not cover, and the host keeps everything your people post.
Why it matters
Chat in another organisation’s meeting is a channel for links and files that bypasses the checks applied to your own meetings. Limiting it to trusted organisations keeps that channel to known partners.
A typical case: a member of the finance team joins a "supplier onboarding" call set up by a company nobody has dealt with before. In the meeting chat they are asked to upload a VAT certificate and a bank letter on headed paper, and are sent a link to "the contract". The documents go straight to a fraudster, and the link installs malware.
Most legitimate meetings are with organisations you already work with, which the external access allow list (NL-TMS-103) makes trusted. Limiting chat to those keeps normal work going and removes the channel from strangers.
CIS Microsoft 365 Foundations Benchmark 8.5.8 asks that external meeting chat is off. Audio, video and screen sharing in other organisations’ meetings still work; only chat in meetings hosted by untrusted organisations stops.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Add the organisations people meet with regularly to the external access allow list, so chat in their meetings keeps working.
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
Step by step
- Make regular partners trusted first. Add the organisations your people meet with often to the Teams external access allow list (Users > External access > Allow domains, see NL-TMS-103), so chat in their meetings keeps working after the change.
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalNonTrustedMeetingChat. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "External meeting chat", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $false.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowExternalNonTrustedMeetingChat $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalNonTrustedMeetingChat again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then ask a colleague to join a meeting hosted by an organisation that is not on your allow list: they can hear and see it, but cannot use the chat.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $false
What users will notice
Your users cannot chat in meetings hosted by organisations that are not on the allow list; audio, video and sharing still work.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalNonTrustedMeetingChat shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 10 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transfer |
| CIS M365 | 8.5.8 Ensure external meeting chat is off |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Meeting policy settings (Microsoft Learn)