How to stop external users controlling Teams screen shares

What this check looks at

Checks that people from outside the organisation cannot give or request control of a screen shared in a Teams meeting.

When someone shares their screen in a Teams meeting, another participant can request control, and if the presenter gives it they can click and type on the presenter’s computer. AllowExternalParticipantGiveRequestControl in the meeting policy ("External participants can give or request control") decides whether people from outside the organisation (guests, people in other organisations, anonymous participants) can do this in meetings your users organise.

The check reads the Global meeting policy and fails when AllowExternalParticipantGiveRequestControl is true, also counting custom meeting policies with the same value. If Global is correct but a custom policy is not, it warns and names that policy.

Remote control is the step that turns a social engineering call into a compromise. The attacker, posing as IT support or a software supplier, asks the user to share their screen "so I can fix it" and then requests control. With control they can open a browser, download and run a remote-access tool, or read whatever is open on the screen.

Why it matters

Remote control of a shared screen lets the other person click and type on the presenter’s computer. Attackers posing as IT support or a supplier use exactly this to install malware or open systems.

A typical case: an accounts assistant is called on Teams by "Microsoft Support" about a problem with their mailbox. They share their screen, approve the request for control, and watch the "engineer" install a tool. That tool is the attacker’s way into the network, and in the published Storm-1811 cases it ended in ransomware across the business.

For a small or medium business, ransomware typically means days without systems, rebuilding devices, a cyber insurance claim and difficult conversations with clients about their data. Removing the ability to hand control to an outsider closes off one of the simplest routes in.

CIS Microsoft 365 Foundations Benchmark 8.5.7 and CISA SCuBA MS.TEAMS.1.1v1 ask that external participants cannot give or request control. Support staff who need to control customers’ screens should use a dedicated remote support tool with its own controls.

How to fix it

Where: Teams admin centre → Meetings → Meeting policies

Before you start

• Check whether support staff take control of customers’ screens in Teams; a dedicated remote support tool is the safer route for that.
• Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.

Step by step

1. 1Check whether anyone relies on it. Ask support and customer-facing teams whether they take control of customers’ screens through Teams, or let suppliers take control of theirs. Move that work to a dedicated remote support tool before turning this off.
2. 2List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalParticipantGiveRequestControl. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
3. 3Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "External participants can give or request control", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false.
4. 4Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowExternalParticipantGiveRequestControl $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
5. 5Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalParticipantGiveRequestControl again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then in a test meeting with a guest, share your screen: the guest should not be offered Request control, and you should not be able to give control to them.

With PowerShell

Connect-MicrosoftTeams
Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false

What users will notice

People from outside the organisation can no longer request or be given control of a shared screen.

How to confirm it worked

In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowExternalParticipantGiveRequestControl shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.

Frameworks and controls

This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Manage who can present and request control in Teams meetings (Microsoft Learn)

Related checks

• Teams external access: who your staff can chat with
• How to restrict who can create shared Bookings pages
• SharePoint and OneDrive external sharing: the safe setting
• How to block Teams chat with personal Microsoft accounts

The full Microsoft 365 security checklist, worst first