The 25 Microsoft Teams security checks Black Cat runs
Black Cat SSPM evaluates 25 security policies against your Microsoft Teams configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Microsoft Teams — what access Black Cat needs, and why.
Access control & privilege
12 checks · highest severity: high
Data sharing & exposure
4 checks · highest severity: high
Governance & compliance
5 checks · highest severity: medium
Access control & privilege (12)
- Guest Members in Team severity: medium
- Excessive Team Owners severity: medium
- Anonymous Meeting Join Enabled severity: high
- Lobby Bypass for Everyone severity: medium
- Guest Access Overly Permissive severity: medium
- Members Can Delete Channels severity: medium
- Members Can Install Apps severity: medium
- Guests Can Delete Channels severity: high
- Guests Can Create and Update Channels severity: medium
- Single Team Owner severity: medium
- Meeting Auto-Admits Everyone severity: high
- External Consumer Teams Access severity: medium
Data sharing & exposure (4)
- Public Team severity: high
- External Messaging Enabled severity: medium
- Unrestricted External Federation severity: high
Governance & compliance (5)
- Team Without Description severity: low
- Large Team Without Moderation severity: medium
- Channel Without Moderation severity: medium
- Meeting Recording Disabled severity: low
- Message Edit Delete Unrestricted severity: low
Other checks (4)
severity: low Archived Team fix difficulty: easy #
Review archived Teams and delete them if no longer needed to reduce attack surface
- Navigate to Teams Admin Center > Teams > Manage Teams
- Filter for archived teams
- Review each archived team with its owner to determine if it is still needed
- If no longer needed, delete the team to remove associated data and permissions
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Skype for Business Interop Enabled fix difficulty: easy #
Disable Skype for Business interop if not required to reduce external communication surface
- Navigate to Teams Admin Center > External Access
- Locate the "Skype for Business" interoperability setting
- Toggle it to "Off" if Skype for Business communication is no longer needed
- Save the external access settings
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: high Unapproved Third-Party App fix difficulty: medium #
Block or submit unapproved third-party Teams apps for organizational review and approval
- Navigate to Teams Admin Center > Teams apps > Manage apps
- Locate the unapproved third-party app
- Review the app permissions and publisher details
- Block the app or submit it for organizational approval
Satisfies: ISO 27001:2022 A.5.23 CIS Controls v8 CIS-15.1 NIST CSF 2.0 GV.SC GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: medium Custom App Sideloading fix difficulty: easy #
Disable custom app sideloading in Teams app setup policies to prevent unauthorized apps
- Navigate to Teams Admin Center > Teams apps > Setup policies
- Select the relevant app setup policy
- Disable Upload custom apps (sideloading)
- Save the policy changes
Satisfies: ISO 27001:2022 A.5.23 CIS Controls v8 CIS-15.1 NIST CSF 2.0 GV.SC GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4