Microsoft Teams Meetings Get Per-User Control Over Anonymous Joins

Increases Tenant Control Over Anonymous Users Joining Meetings

Up to now, the only control organizations have over the ability of anonymous users (people with a valid email address who don’t belong to another Office 365 tenant) to join Teams meetings is the tenant-level control available in the Meeting settings section of the Teams admin center (Figure 1). The control is either On or Off, the default being On.

New Per-User Control

Documented in MC297030 (updated November 18, Microsoft 365 roadmap item 87503), Microsoft is introducing a per-user level setting to control the ability of individual meeting organizers to allow anonymous users to join their meetings. The new setting is available in Teams meeting policies now and Microsoft plans to complete the roll-out of the feature to all tenants by the end of November.

Microsoft is taking a two-phase approach to the introduction of per-user control. In the first phase, tenant administrators can create and assign meeting policies to user accounts to allow or deny the accounts the ability to let anonymous users join their meetings. The existing tenant-wide setting remains in place. If the tenant-level setting prohibits anonymous join, it doesn’t matter what the per-user controls as the tenant-level setting takes precedence.

In phase two, Microsoft will remove the tenant-level setting and the only control over anonymous meeting joins will be the settings in meeting policies applied to users.

Managing Per-User Control

Microsoft will eventually update the policy management functionality in the Teams admin center to support management of the per-user setting. Until that happens, you can update the setting using the Set-CsTeamsMeetingPolicy cmdlet in V2.6.0 or above of the Microsoft Teams PowerShell module.

By default, all meeting organizers are allowed to have anonymous users join their meeting. To restrict this capability, either update the Global (default) policy or a custom meeting policy and assign the policy to accounts. Updating the Global policy is a big step when it comes to applying restrictions and it is preferable to use a custom policy for this purpose. My tenant has a meeting policy called RestrictedFunctionality for this reason. To stop people having anonymous users join their meetings, I updated the policy to set the AllowAnonymousUsersToJoinMeeting control to False:

Set-CsTeamsMeetingPolicy -Identity RestrictedFunctionality -AllowAnonymousUsersToJoinMeeting $False

After updating the policy, the new control is picked up and respected by accounts already assigned the policy. To assign the restricted policy to a new account, run the Grant-CsTeamsMeetingPolicy cmdlet:

Grant-CsTeamsMeetingPolicy -Identity Chris.Bishop@office365itpros.com -PolicyName RestrictedFunctionality

Like any change made to a Teams policy, it might take a few hours before the new settings are effective. You’ll know that the block exists by doing this simple test.

1. Create a Teams meeting.
2. Copy the meeting link from the meeting invitation.
3. Open a private browser session and paste the link into it.
4. Attempt to join the meeting. Because your connection is unauthenticated, Teams prompts you for a name. Add anything you like and then join.
5. If the policy block is effective, you’ll see an error like that shown in Figure 2.

Per-User Always Better Than Tenant-Wide

Per-user control over features is better than employing tenant-wide settings. If you want to use tenant-wide settings for anonymous join, don’t change the global meeting policy to allow anonymous join or set AllowAnonymousUsersToJoinMeeting to False to disable anonymous join for all meetings. Later, you can introduce more granular control using extra meeting policies. It’s your choice.

---

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.