What this check looks at
Checks that people who join a Teams meeting without signing in cannot use the meeting chat.
MeetingChatEnabledType in the meeting policy ("Meeting chat") controls the chat in meetings a user organises: on for everyone (Enabled), on for everyone except anonymous participants (EnabledExceptAnonymous), or off (Disabled). Microsoft’s default is on for everyone, so an anonymous participant can read the meeting chat and post into it.
The check passes EnabledExceptAnonymous and Disabled. It fails the Global policy on any other value and warns when Global is correct but a custom policy still lets anonymous people chat, naming it. Microsoft has added further chat values over time (such as chat during the meeting only); the check accepts only the two named here.
Meeting chat is where people drop links to documents, the dial-in details for the next session and sometimes passwords. An anonymous participant can collect all of that, and can post a link of their own ("slides here") that everyone in the meeting sees as part of the conversation: an easy way to put a fake sign-in page in front of a whole room at once.
Why it matters
Meeting chat is where links and files get shared. An anonymous participant in it can post a malicious link to everyone in the meeting, or read what others share.
A typical case: an open session for prospective clients is run as an ordinary Teams meeting. An anonymous attendee posts a link to "the full presentation pack" that leads to a convincing Microsoft sign-in page. Three members of staff enter their passwords, and one of those accounts is used the next day to send invoice-fraud emails to the firm’s clients.
Each compromised account means password resets, investigation and possibly telling clients and the ICO what the attacker could reach. Keeping anonymous people out of the chat costs nothing: they can still see and hear the meeting.
CIS Microsoft 365 Foundations Benchmark 8.5.5 asks that meeting chat does not allow anonymous users. Signed-in guests and people from other organisations can still chat.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
Step by step
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, MeetingChatEnabledType. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not EnabledExceptAnonymous or Disabled; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Meeting chat", set it to "On for everyone but anonymous users" and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType EnabledExceptAnonymous.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -MeetingChatEnabledType EnabledExceptAnonymous, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, MeetingChatEnabledType again: Global and every custom policy should show EnabledExceptAnonymous or Disabled, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then join a test meeting anonymously from a private browser window: the chat should not be available to that participant, while signed-in participants can still use it.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType EnabledExceptAnonymous
What users will notice
Anonymous participants can no longer read or post in meeting chat; everyone else is unaffected.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, MeetingChatEnabledType shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 10 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CIS M365 | 8.5.5 Ensure meeting chat does not allow anonymous users |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Meeting policy settings (Microsoft Learn)