CreativeTechsBaseline
tenant security posture
CTB-30 · Tier 2 · Runway · M365

Teams meeting and external access hygiene

CIS M365 8.5.3 · L1Huntress Teams category · Low–MediumMaester MT.1042 / 1046 / 10472 authorities
0
Tenants failing
0
Tenants meeting
0
Measured
UNDECIDED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
Meeting policy: Who can bypass the lobby = People who were invited (or more restrictive). Anonymous users can start a meeting = Off. External participants can give or request control = Off. Chat with unmanaged Teams users = Off.
Benchmark position
CIS M365 8.5.3 (L1) — recommended state 'People who were invited' or more restrictive. Our minimum is exactly the CIS figure.
Where the switch is
Teams admin centre → Meetings → Meeting policies → Global (Org-wide default) → Participants & guests.
https://admin.teams.microsoft.com
How to verify
Get-CsTeamsMeetingPolicy -Identity Global | fl AutoAdmittedUsers,AllowAnonymousUsersToStartMeeting,AllowExternalParticipantGiveRequestControl
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
Lobby bypass, anonymous meeting starts and unmanaged external chat are the Teams-side equivalent of anonymous sharing links — an open door that doesn't look like one.
How we check
Huntress carries a dozen of these across the Teams category. CIS.M365.8.5.3 · L1, Maester MT.1042 / 1046 / 1047.
Fix — M365
Teams admin → meeting policies: only org members bypass the lobby, anonymous users can't start meetings, external participants can't request control; restrict chat with unmanaged Teams users.
Fix — Google
Meet host management settings.
User notices
External guests wait in a lobby until admitted.
Expected pushback
Moderate at agencies running client calls all day — the lobby is the friction point. Consider letting trusted federated domains through rather than switching it off.