What this check looks at
Checks that by default only the organiser and co-organisers can present in Teams meetings.
DesignatedPresenterRoleMode in the meeting policy ("Who can present") sets who is a presenter by default in new meetings: Everyone (EveryoneUserOverride, Microsoft’s default), People in my organisation, People in my organisation and trusted organisations, or Only organisers and co-organisers (OrganizerOnlyUserOverride). Organisers can still change it for a single meeting in Meeting options.
The check passes only OrganizerOnlyUserOverride. It fails the Global policy on any other value and warns when Global is correct but a custom policy is not, naming it.
Presenters can share their screen, take over a shared PowerPoint, mute and remove other participants and admit people from the lobby. When everyone is a presenter by default, any participant, including an outside or anonymous one, can do all of that, often before the organiser notices.
Why it matters
When anyone can present, any participant, including one from outside, can take over the screen, show unwanted content or end up controlling what others see.
A typical case: an open training session for customers is run with the default settings. One attendee shares their screen with offensive images, another shares a fake "your Microsoft 365 password expires today" slide with a QR code. The organiser spends the meeting trying to regain control, and the recording and the complaints follow the organisation’s name around.
For schools, charities and anyone running public sessions this is also a safeguarding issue. For everyone else it is a reputational one, and an easy route for phishing content to appear with your organisation’s branding around it.
CIS Microsoft 365 Foundations Benchmark 8.5.6 asks that only organisers and co-organisers can present. Organisers make others presenters when needed, from Meeting options or the participant list.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Tell organisers how to make someone a presenter or co-organiser in Meeting options or from the participant list.
- Check the custom meeting policies named in the evidence and who they are assigned to (Teams admin centre → Users → the user → Policies), so the change reaches everyone.
Step by step
- Tell organisers how to add presenters. Let organisers know that new meetings will start with only them and their co-organisers as presenters, and show them how to make someone a presenter in Meeting options or from the participant list (More options > Make a presenter).
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, DesignatedPresenterRoleMode. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not OrganizerOnlyUserOverride; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Who can present", set it to "Only organisers and co-organisers" and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -DesignatedPresenterRoleMode OrganizerOnlyUserOverride.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -DesignatedPresenterRoleMode OrganizerOnlyUserOverride, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, DesignatedPresenterRoleMode again: Global and every custom policy should show OrganizerOnlyUserOverride, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then schedule a new meeting from an account on the Global policy and open Meeting options: "Who can present" should default to only organisers and co-organisers.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -DesignatedPresenterRoleMode OrganizerOnlyUserOverride
What users will notice
New meetings start with only the organiser and co-organisers as presenters; others need to be made presenters before they can share.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, DesignatedPresenterRoleMode shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 10 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.3 Role-based access and least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | AC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.5.15 Access control |
| CIS M365 | 8.5.6 Ensure only organisers and co-organisers can present |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage who can present and request control in Teams meetings (Microsoft Learn)