Microsoft Teams access control & privilege security checks
Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.
On Microsoft Teams, Black Cat runs 12 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Microsoft Teams connector needs.
Checks (12)
severity: medium Guest Members in Team fix difficulty: medium #
Review Teams guest members and remove those who no longer require access
- Navigate to Teams Admin Center > Teams > Manage teams
- Select the team and review the member list
- Identify guest members and verify their access is still required
- Remove guests who no longer need access
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Excessive Team Owners fix difficulty: easy #
Reduce Teams team owners to 2-3 by demoting unnecessary owners to member role
- Navigate to Teams Admin Center > Teams > Manage teams
- Select the team and review the owners list
- Demote unnecessary owners to member role
- Keep only 2-3 team owners for redundancy
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Anonymous Meeting Join Enabled fix difficulty: easy #
Disable anonymous meeting join in Teams meeting policies to prevent unauthorized attendees
- Navigate to Teams Admin Center > Meetings > Meeting policies
- Select the relevant meeting policy
- Set Let anonymous people join a meeting to Off
- Save the policy changes
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Lobby Bypass for Everyone fix difficulty: easy #
Restrict Teams meeting lobby bypass to organization members or organizer only
- Navigate to Teams Admin Center > Meetings > Meeting policies
- Select the relevant meeting policy
- Change Who can bypass the lobby to a more restrictive setting
- Consider setting to People in my org or Organizer only
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Guest Access Overly Permissive fix difficulty: easy #
Restrict Teams guest access permissions by disabling calling, screen sharing, and video for guests
- Navigate to Teams Admin Center > Guest access
- Review the current guest access permissions
- Restrict guest calling, meeting, and messaging capabilities
- Disable screen sharing and video for guests if not required
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Members Can Delete Channels fix difficulty: easy #
Restrict channel deletion to team owners to prevent accidental or malicious data loss
- Navigate to Teams Admin Center > Teams > Manage Teams
- Select the team and open its settings
- Under Member permissions, disable "Allow members to delete channels"
- Save the team settings
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Members Can Install Apps fix difficulty: easy #
Restrict app installation to team owners to maintain control over third-party integrations
- Navigate to Teams Admin Center > Teams > Manage Teams
- Select the team and open its settings
- Under Member permissions, disable "Allow members to add and remove apps"
- Save the team settings
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Guests Can Delete Channels fix difficulty: easy #
Disable guest channel deletion to prevent external users from removing team channels
- Navigate to Teams Admin Center > Teams > Manage Teams
- Select the team and open its settings
- Under Guest permissions, disable "Allow guests to delete channels"
- Save the team settings
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Guests Can Create and Update Channels fix difficulty: easy #
Disable guest channel creation and updates to limit external user impact on team structure
- Navigate to Teams Admin Center > Teams > Manage Teams
- Select the team and open its settings
- Under Guest permissions, disable "Allow guests to create and update channels"
- Save the team settings
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Single Team Owner fix difficulty: easy #
Add at least one additional owner to the team to ensure administrative redundancy
- Navigate to Teams Admin Center > Teams > Manage Teams
- Select the team with only one owner
- Click on Members and add at least one additional trusted member as an owner
- Verify the new owner can manage team settings
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Meeting Auto-Admits Everyone fix difficulty: easy #
Change the auto-admit setting to require lobby screening for external and anonymous participants
- Navigate to Teams Admin Center > Meetings > Meeting Policies
- Select the affected meeting policy
- Under "Participants and guests", change "Automatically admit people" from "Everyone" to "People in my organization" or "People in my organization and trusted organizations"
- Save the meeting policy
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium External Consumer Teams Access fix difficulty: easy #
Disable communication with personal Microsoft Teams consumer accounts to limit external exposure
- Navigate to Teams Admin Center > External Access
- Locate the "Teams accounts not managed by an organization" setting
- Toggle it to "Off" to block consumer account communication
- Save the external access settings
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2