What this check looks at
Checks that only people in the organisation (or fewer) join Teams meetings straight away, and everyone else waits in the lobby until admitted.
The lobby holds people outside a meeting until the organiser or a presenter admits them. Who skips it is the meeting policy’s AutoAdmittedUsers value, shown in the Teams admin centre as "Who can bypass the lobby". The choices run from Everyone, through people in your organisation plus guests or trusted organisations, to People in my organisation, People who were invited, and Only organisers and co-organisers.
The check passes People in my organisation (EveryoneInCompanyExcludingGuests), People who were invited (InvitedUsers) and Only organisers and co-organisers (OrganizerOnly). It fails the Global policy on anything wider, such as Everyone, which lets anonymous people straight in, or a value that admits guests or people from other organisations without a check. It warns when Global is correct but a custom policy is not.
With a wide setting, outside participants appear in the meeting without anyone deciding to let them in. In a large meeting nobody watches the participant list, so an uninvited person can listen to an all-staff briefing or a client review from start to finish.
Why it matters
The lobby is where the organiser sees who is joining. When guests, partners or anyone with the link go straight in, an unexpected participant is only noticed once they have already heard the discussion.
A typical case: an all-staff meeting sets out a restructuring before individual conversations have happened. The invitation was forwarded to a former employee, who joins straight in as a guest and posts the details on social media within the hour. The organisation is left handling a public story and an employee relations problem it had planned to manage carefully.
For client meetings the risk is confidentiality: anyone admitted without a check hears commercially sensitive or personal information, and the organiser only notices afterwards, if at all.
CIS Microsoft 365 Foundations Benchmark 8.5.3 asks that only people inside the organisation can bypass the lobby, and CISA SCuBA MS.TEAMS.1.3v1 and MS.TEAMS.1.4v1 ask that anonymous users and dial-in callers are not admitted automatically while internal users are. Organisers can still change it for a single meeting in Meeting options.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Tell organisers they will need to admit guests and partners from the lobby, and how to change it for a single meeting in Meeting options.
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
Step by step
- Tell organisers how the lobby will work. Let meeting organisers know that guests, partners and anonymous participants will wait in the lobby, how to admit them from the participant list, and how to change who bypasses the lobby for a single meeting in Meeting options.
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AutoAdmittedUsers. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not EveryoneInCompanyExcludingGuests, InvitedUsers or OrganizerOnly; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Who can bypass the lobby", set it to "People in my organisation" (or "People who were invited", or "Only organisers and co-organisers") and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers EveryoneInCompanyExcludingGuests.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AutoAdmittedUsers EveryoneInCompanyExcludingGuests, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AutoAdmittedUsers again: Global and every custom policy should show EveryoneInCompanyExcludingGuests, InvitedUsers or OrganizerOnly, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then join a test meeting with a guest or anonymous account: it should wait in the lobby until the organiser admits it, while a colleague signed in to your organisation goes straight in.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers EveryoneInCompanyExcludingGuests
What users will notice
Guests, partners and anonymous participants wait in the lobby until the organiser or a presenter admits them.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AutoAdmittedUsers shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access control |
| CISA SCuBA | MS.TEAMS.1.3v1 Anonymous users and dial-in callers not admitted automaticallyMS.TEAMS.1.4v1 Internal users admitted automatically |
| CIS M365 | 8.5.3 Ensure only people inside the organisation can bypass the lobby |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Control who can bypass the meeting lobby (Microsoft Learn)