Configuring meeting security in Microsoft Teams

With an increase in remote working, the security of workers and data is becoming even more important. Part of this is making sure only the right people can access your virtual meetings. Microsoft Teams provides both the Teams administrator and the meeting organizer several capabilities for securing meetings. This post will cover both aspects to make sure you can have the best meetings possible.

Author
Recent Posts

Jeff Brown

Jeff is a systems administrator and cloud engineer with over a decade of experience in server and application administration. He has managed a wide range of technologies in his career, including Windows Server, Microsoft 365. and Azure. Jeff has also created video-based training for Cybrary and PluralSight. You can follow Jeff on his blog at jeffbrown.tech, or feel free to contact him on Twitter at @jeffwbrown.

Meeting policies and settings for the administrator

To configure the following settings in the Teams admin center, you will need to be either a Global Administrator, a Teams Service Administrator, or a Teams Communication Admin. The Teams admin center can be accessed at the URL https://admin.teams.microsoft.com.

Meeting policies

Let's start with meeting policies. After navigating to the Team admin center, expand the Meetings menu item and select Meeting policies. There is a policy named Global (Org-wide default), which is applied to all users by default. Select this policy and choose Edit from the menu.

Navigating to the default meeting policy

There are lots of great settings in this policy for managing the meeting experience, but we are only going to focus on a few.

Under Content Sharing, there are two settings that control whether meeting participants and guests can give or request control:

Allow a participant to give or request control
Allow an external participant to give or request control

This can be important to make sure a participant, especially an external one, cannot request or take control of the desktop sharing session. While there is typically a handoff if the external participant requests control, this will prevent them from ever asking. Not only does this provide additional security, it also prevents disruptions in meetings.

The main security settings are in the Participants & guests section. This is primarily targeted at users dialing into meetings using a phone. Since the participants are dialing in, they are typically anonymous, so you need to treat them with extra care.

Participants & guests security settings

The first setting is a big one: Let anonymous people start a meeting. If this is enabled, an unauthenticated person can dial into your meeting and start it before anyone else joins. This also means they can dial into the meeting before or after it begins and sit on the conference bridge. My recommendation is to disable this setting.

The next setting is Automatically admit people. It has three options in the dropdown menu:

Everyone
Everyone in your organization
Everyone in your organization and federated organizations

The most secure option is Everyone in your organization. This means that only authenticated, internal users can automatically join the meeting; external or anonymous users cannot automatically join. Those users will wait in the lobby until admitted by the organizer or presenter. I recommend this option.

The next most secure option is Everyone in your organization and federated organizations. If you have open federation, this might be a problem, but if you have a select group of external organizations in your allow list, presumably you trust them to join your meetings automatically. This will still prevent anonymous people from joining automatically.

Finally, there is the Everyone option. If your users have a problem admitting people from the lobby or dislike the user experience, then use this option. Just understand this opens up the meeting for anonymous people to join automatically.

Lastly, we have Allow dial-in users to bypass the lobby. This can only be set if the previous setting is not set to Everyone, which makes sense. If you are allowing everyone to join meetings automatically, then there is no need for dial-in users to wait in the lobby.

If this is set to True, dial-in users will automatically join the meeting once an organizer joins the meeting. If this is set to False, then the dial-in users will wait in the lobby until a user from the organization joins the meeting and admits them. For the highest security, I would set this to False.

Meeting settings

Moving back to the Meetings menu, let's move over to Meeting settings. There's only one setting in here to worry about, and that is Anonymous users can join a meeting. If you are worried about anonymous users joining any meeting, then go ahead and disable this setting. This will require any participant joining your organization's meeting to have a Teams account. However, understand the implications of this for external people trying to join your meetings and potentially being blocked.

Disabling any anonymous user from joining a meeting

Audio conferencing

If you have audio conferencing licenses assigned to your users, then there is one final configuration we can perform. Audio conferencing enables a dial-in phone number to be attached to a meeting invitation. Back in the Teams admin center, navigate to Conference bridges under Meetings, then select Bridge settings. These settings are going to control the behavior for users dialing in by phone.

Navigating to the audio conference bridge settings

The first option is for meeting entry and exit notifications. This will alert people in the meeting when someone dialing in by phone joins or leaves the call. Note that this does not apply to people joining from a Teams client.

If meeting entry and exit notifications are enabled, the next setting configures the announcement type. Options include:

Names or phone numbers
Tones

If Names or phone numbers is selected, then this displays another option to have callers record their name before joining a meeting. If Tones is selected, then this option disappears, and a tone or ding is played when callers join or leave the meeting. While this is a great notification of people joining or leaving a meeting, it can be somewhat disruptive for tones or names to be announced in the middle of a meeting.

Last is the length of the PIN your users can use to authenticate themselves when dialing into the meeting. This can be 4 to 12 digits (4 seems appropriate, but check with your security team).

Meeting settings for the organizer

While the settings configured by the administrator may cover most meetings, the meeting organizer can configure their settings on a per-meeting basis. Perhaps you work in HR or finance and need to schedule a sensitive meeting with additional security options. Let's look at what options are available.

When scheduling a Teams meeting in Outlook, the meeting body text will have the Teams join meeting link. Below this link are some additional options, such as finding a local number or resetting your PIN. The link we're interested in is Meeting options.

Accessing meeting options from the invitation

Since the meeting invite is in draft mode, you may need to hold down the Ctrl key when clicking the link. For now, this link will open your web browser to configure the meeting options. Hopefully, in the future, these options will be included directly in the meeting invitation window, like Skype for Business used to be.

Here are the available options; some will look familiar:

Viewing meeting options available to the organizer

Here, the meeting organizer can configure who can bypass the lobby. If the administrator has set this to the less secure option of Everyone, then the meeting organizer can configure it to People in my organization if the meeting requires external people to wait in the lobby.

Next is letting callers bypass the lobby. The meeting organizer can decide whether to allow dial-in callers to bypass the lobby. Meeting organizers can also enable or disable the announcement feature we saw in the audio conferencing bridge settings earlier.

Finally, the big security setting is who can present during the meeting. Defining meeting participants as presenters and attendees does a couple of things. First, only meeting presenters can do things like:

Share content
Mute or remove other participants
Admin people from the lobby
Change the roles of other participants
Start or stop recording
End the meeting for everyone

For smaller meetings, having everyone as a presenter is probably going to be fine. However, for larger meetings, you will want to define meeting roles. Imagine having a few hundred people on a call where they are all presenters, and people are muting others, removing other participants from the meeting, or ending the meeting for everyone. This will cause some minor chaos.

The options for who can present include:

Everyone
People in my organization
Specific people
Only me

If you choose Specific people, then you can select other people who are on the meeting invite. You will need to send the invitation first, then navigate back to the meeting options page and select the specific presenters. If you are inviting a group (such as a distribution or Office 365 group) that contains the desired presenters, then you will need to add the presenters individually in the meeting invite. The ability to select specific presenters does not expand groups and only pulls individual names from the invite.

Upcoming road map options

There is an upcoming road map item related to meeting security that only allows the meeting organizer to join the meeting directly. This will add another Only me to the lobby bypass setting options. When this is selected, only the organizer will be able to join the meeting directly. Everyone else, including people in the same organization, must wait in the lobby. This is being targeted at the education sector to allow teachers to be the first to join meetings and then admit the students.