Block Meeting Chats for Non-Trusted Tenants

In July 2023, Microsoft introduced a new meeting policy setting to control the ability of users to participate in meeting chats for meetings hosted in other non-trusted Microsoft 365 tenants. The change addresses a potential issue where people might reveal confidential information in a meeting chat that their home tenant knows nothing about. Of course, users can also reveal confidential information orally and that information can be captured in a meeting transcript that’s under the control of the host tenant, but that’s a more difficult problem to crack.

The update is covered in message center notification MC561186 (26 May 2023) and Microsoft 365 roadmap item 123975 and the setting should now be available in all tenants, including DOD and GCC-High.

Trusted and Non-Trusted Tenants

A trusted Microsoft 365 tenant is one which the external access settings for Teams allow users to connect to for chats and meetings. By default, Teams allows external access to all other Microsoft 365 organizations (Figure 1), meaning that all other tenants are trusted.

Last year, a proof of concept for an attack called GIFshell exposed a downside in the default setting where an attacker could set up a chat with an unsuspecting victim and transmit a modified GIF file containing malware. The easy answer to stopping this kind of attack is to change the external access setting to restrict incoming connections to an allow list of specified tenants.

The need for ongoing maintenance is the downside of using an allow list. In a follow-up article, I discussed how to use PowerShell to populate an allow list based on the home tenants for guest accounts. This helps, but creating an allow list from guest accounts is unlikely to discover every external tenant that users need to communicate with for business purposes. Some other arrangement is therefore necessary to allow users to request the addition of a domain to the allow list. The Teams Approvals app might be one way to handle the issue. Power Automate might be another.

Blocking Access to Meeting Chat in Non-Trusted External Tenants

The new control is in the Meeting engagement section of Meeting policies in the Teams admin center (Figure 2). By default, the setting is enabled, meaning that users can participate in chats in meetings hosted by any external Microsoft 365 tenant.

Updating the setting to Off blocks the Chat app in meetings hosted by untrusted external tenants.

You can also manage the setting through PowerShell. First, to see the value of the AllowExternalNonTrustedMeetingChat setting in the meeting policies defined for the tenant, run the Get-CsTeamsMeetingPolicy cmdlet:

Get-CsTeamsMeetingPolicy | Format-Table identity, AllowExternalNonTrustedMeetingChat

Identity                           AllowExternalNonTrustedMeetingChat
--------                           ----------------------------------
Global                                                           True
Tag:AllOn                                                        True
Tag:RestrictedAnonymousAccess                                    True

To block access to chat in external meetings, run the Set-CsTeamsMeetingPolicy cmdlet to update the value of AllowExternalNonTrustedMeetingChat for a meeting policy.

Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $False

An hour or so after updating the meeting policy, the accounts assigned the policy will lose access to chat in external meetings hosted by non-trusted tenants.

Keep External Access Open or Apply Restrictions

If you’re not worried about what people might chat about in external meetings, leave the setting alone and Teams will behave as before. This control is for organizations that have reason to want to stop people from chatting when participating in meetings hosted by non-trusted tenants. Of course, the question of deciding which tenants to trust comes into play here. That’s a difficult question to answer in a generic sense, and it’s definitely worthwhile for a Microsoft 365 tenant to consider if they want to operate external access on an open or closed basis.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Feature Eventually Rolling Out After Long Delay

Last November, Microsoft published message center notification MC296205 about the ability to create multi-language Teams meeting invitations. Updated on June 2, Microsoft now says that the feature will roll out to tenants in mid-June with deployment due for completion by the end of the month. GCC roll-out will happen in July. This is Microsoft 365 roadmap item 81521.

Languages Controlled by Meeting Policy

In a nutshell, the new feature allows Teams administrators to define up to two languages for meeting invitations through the MeetingInviteLanguages setting in the Teams meeting policy. Selecting a single language works. If set, the defined languages override user preference. This makes sense in large organizations where consistency in meeting invitations is a good thing. It’s also good in situations where local regulations dictate that written communications should be in two languages. Irish government departments, for instance, usually generate text in both Irish and English. In this instance, they’ll be disappointed to discover that Irish is not one of the supported languages (see below).

Policy-driven language selection takes precedence over the language selected by the user creating a Teams meeting. For example, someone who uses Teams in Spain usually generates meeting invitations in Spanish unless the meeting policy applied to their account dictates what the language(s) should be. Let’s say that the policy mandates English and French. With this policy in place, any system-generated text in subsequent meeting invitations generated by the user will be in English and French. The change is very noticeable and underlines the need to tell users before introducing a new policy that affects the invitations that they send.

System-generated text includes the joining instructions for the meeting and the links for Help, meeting options, and legal. Some elements of Teams meeting invitations are customizable. Teams changes the link names to match the selected languages, but the custom footer text remains as is.

Setting Corporate Languages

Currently, the only way to select corporate languages for meeting invitations is via PowerShell. Make sure that you have the latest version of the Teams PowerShell module (I used version 4.4.1).

For example, here’s how to use the Set-CsTeamsMeetingPolicy cmdlet to define US English and Danish as the two languages used by any account assigned the HQ Users meeting policy:

Set-CsTeamsMeetingPolicy -Identity "HQ Users" -MeetingInviteLanguages "en-US,da-DK"

Figure 1 is an example of a Teams meeting invitation sent after the policy became effective. Like any change to a Teams policy, expect that it will take several hours before clients pick up the new policy settings. You can see that Teams generates the joining instructions in the order set for the languages in the policy (U.S. English first followed by Danish).

In this instance, the custom settings for Teams meetings include a corporate logo, and Teams inserts the logo for each language. You can’t specify different logos for each language.

Because Teams generates the joining instructions for meeting invitations on the server, the policy-selected languages apply to all Teams clients, no matter what platform or language a client uses, including meetings created from Outlook using the Teams meeting add-in.

Supported Languages

According to MC296205, the following language codes can be used:

• ar-SA.
• az-Latn-AZ.
• bg-BG.
• ca-ES.
• cs-Cz.
• cy-GB.
• da-DK.
• de-DE.
• el-GR.
• en-GB.
• en-US.
• es-ES
• es-MX.
• et-EE.
• eu-ES.
• fi-FI.
• fil-PH.
• fr-CA.
• fr-FR.
• gl-ES.
• he-ILhi-IN
• hr-HR.
• hu-HU.
• id-ID.
• is-IS.
• it-IT.
• ja-JP.
• ka-GE.
• kk-KZ.
• ko-KR.
• lt-LT.
• lv-LV.
• mk-MK.
• ms-MY.
• nb-NO.
• nl-NL.
• nn-NO.
• pl-PL.
• pt-BR.
• pt-PT.
• ro-RO.
• ru-RU.
• sk-SK.
• sl-SL.
• sq-AL.
• sr-Latn-RS.
• sv-SE.
• th-TH.
• tr-TR.
• uk-UA.
• vi-VN.
• zh-CN.
• zh-TW.

To surprise users, you could select two languages at random just to see if anyone pays attention to meeting details when invitations arrive. It’s entirely possible that they don’t ever see meeting invitations if their mailbox settings allow automatic acceptance. But they’ll see the details when the time of the meeting comes around. What would users do if they received meeting invitations like the one shown in Figure 2? It might be a nice April Fool’s Day joke…

Make sure that you’re not surprised about changes that appear inside Teams and the other Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Limit Automatic Meeting Joins

Office 365 Notification MC219629 updated on August 5, 2020, announces the delivery of the ability to update meeting policies so that all meetings limit automatic joining (aka lobby bypass) to the meeting organizers. In other words, everyone except the organizer, including other users from the home tenant, must wait in the lobby to be admitted to the meeting. The change is linked to Microsoft 365 roadmap item 66463.

Restrictive Meetings

I’m unsure that imposing strict limits on who joins a meeting without going through the lobby will be popular in enterprise environments (but could absolutely be wrong on this point). Only a small number of meetings are so confidential that automatic joining needs to be prohibited until the organizer is ready for the meeting to begin. In a physical sense, the equivalent is when participants turn up for a meeting to find the door to the conference room locked and must wait outside until someone turns up with the key.

The need for restrictive control on join for individual meetings is met by the “Only me” meeting option which allows organizers to block participants from joining meetings (Figure 1), which Microsoft rolled out to Teams in May 2020.

The update for Teams meeting policies now being enabled has the same restrictive effect on joining as “Only me” for all meetings organized by people assigned a policy with the new control set. I would be slow to set up a meeting policy with this control in a corporate tenant and believe that its most likely use case is in education environments where teachers might want to control student admittance to sessions.

Change Soon Available in the Teams Admin Center

Microsoft says that they will roll out the change in late August and expect to complete the deployment in early September, just in time for the new school year. It will be possible to apply the new setting by editing a meeting policy through the Teams admin center or PowerShell (already possible in some tenants) by running the Set-CsTeamsMeetingPolicy cmdlet. The cmdlet is available in the Skype for Business Online module or the preview version of the Teams PowerShell module.

The new setting only applies to new meetings created after the policy change. If necessary, meeting organizers can update meetings and apply a different setting after meetings are created.

Updating a Meeting Policy with PowerShell

The AutoAdmittedUsers control in a Teams meeting policy controls who can enter a meeting automatically (without being forced to wait in the lobby). Up to now, the accepted values were:

• EveryoneInCompany: All accounts in the same tenant can join automatically. This includes guest users from the tenant directory.
• EveryoneInSameAndFederatedCompany: Accounts in the same tenant and accounts in other federated tenants can join automatically.
• Everyone: Any participant can join automatically.

MC219629 introduces OrganizerOnly as a valid setting for AutoAdmittedUsers. Once the update is active in your tenant, you’ll be able to use this value for AutoAdmittedUsers in a meeting policy using the latest Teams PowerShell module (I used version 1.1.4 dated 6 July).

Here’s an example of updating a meeting policy to restrict automatic join to organizers only:

Set-CsTeamsMeetingPolicy -Identity RestrictedFunctionality -AutoAdmittedUsers OrganizerOnly

Need to keep up to date with changes in Office 365? Subscribe to the Office 365 for IT Pros eBook and receive monthly updates to track what’s happening across the entire suite.

Refining Teams Meeting Policies

Microsoft issued Office 365 notification MC209349 on 14 April to advertise a bunch of changes to how Teams meetings work. One of those changes is to force external meeting participants to go through the meeting lobby (no automatic join). Another now available is to ability to limit who can present in Teams meetings (Microsoft 365 roadmap item 63206). The presenter role allows a participant to do anything an organizer can, including share content and record the meeting.

Selecting Presenters for Teams Meetings

By default, anyone (including guests) can present in a Teams meeting unless the meeting organizer changes the meeting options to define one or more presenters. Assigning presenters is an oddly convoluted process before the meeting, as you need to:

• Create and send the meeting. Sending the meeting adds the necessary properties to make the meeting an online event.
• Edit the meeting options (in the Teams calendar app). This invokes a web page to display the current meeting settings. You can now change the presenters setting from “Everyone in the meeting” to specific people (Figure 1).

You can also make a participant into a presenter after the meeting starts by selecting their name from the participant list and make them a presenter (Figure 2).

When you schedule a Teams meeting, the default tenant setting for presenter roles taken from the Teams meeting policy assigned to your account is used.

Changing Who Can be a Presenter

You can’t update the setting through the Teams admin center yet (coming soon), but you can in PowerShell by running the Set-CsTeamsMeetingPolicy cmdlet. The value of the DesignatedPresenterRoleMode setting can be:

• EveryoneUserOverride: Everyone can be a presenter.
• EveryoneInCompanyUserOverride: Only authenticated users can present. This includes tenant and guest users.
• OrganizerOnlyUserOverride: Only the organizer can present.

In all cases, the organizer can override the default setting by assigning specific presenters for a meeting.

To see what the setting is in the meeting policies defined in a tenant, run:

Get-CsTeamsMeetingPolicy | Format-Table Identity, DesignatedPresenterRoleMode

Identity                           DesignatedPresenterRoleMode
--------                           ---------------------------
Global                             EveryoneUserOverride
Tag:RestrictedFunctionality        EveryoneUserOverride

For example, to change the setting in a Teams meeting policy so that only tenant users can be presenters, we’d run a command like:

Set-CsTeamsMeetingPolicy -Identity RestrictedFunctionality -DesignatedPresenterRoleMode EveryoneInCompanyUserOverride

This is an example of the kind of change that we see on an ongoing basis. We analyze changes in applications like Teams and update the Office 365 for IT Pros eBook if the change is important enough to warrant inclusion.

Teams Meeting Policy Setting Controls What Effects are Available to Users

Updated: June 28, 2021

Background blur for Teams meetings has been available since September 2018. Teams background effects, better known as the ability for users to choose blurring or background images to use during Teams meetings (Figure 1) appeared in early April 2019. The availability of background effects created some issues for Office 365 tenants, such as making sure that people select appropriate images. Microsoft didn’t have an answer at the time, so they went with the solution of providing a set of curated images for people to choose from. However, it’s easy to upload custom images and use those images instead.

Policy Control for Teams Background Effects

In Office 365 notification MC212361, Microsoft explains how tenant administrators can control Teams background effects on a per-user basis. Two changes are needed. First, a new setting (VideoFiltersMode) can be updated in Teams meeting policies to control which (if any) video effects are available to users. Policies can be updated now in preparation for a future update for the Teams client that will respect the setting. All current Teams clients support video filters.

Updating the VideoFiltersMode Setting

The available values for the VideoFiltersMode setting are:

• NoFilters: No filters are available.
• BlurOnly: Background blur is available (but only if certain hardware conditions are met).
• BlurAndDefaultBackgrounds: Background blur and the set of curated background images selected by Microsoft can be used (essentially, what happens today).
• AllFilters: All filters are available, and the user can upload custom images. This is the default value for meeting policies.

Some will doubt the need to control how people use background effects and say that they trust people to do the right thing. The default value of AllFilters means that people can continue to use background images without any restriction. Others will welcome the opportunity to exert control. For example, these organizations can set VideoFiltersMode to BlurAndDefaultBackgrounds to allow users to use blur and effects but not be able to upload new images through the GUI. Figure 2 shows what happens when the meeting policy applied to an account only allows background blur to be chosen.

Teams meeting policies are updated through the Teams admin center. In this case, the video filters setting is in the Content sharing section of a meeting policy (Figure 3).

Updating Teams Meeting Policies with PowerShell

You can also update the value for the video filters setting with PowerShell. Like all Teams policies, the PowerShell cmdlets to manipulate meeting policies are available in the Teams PowerShell module. After running the Connect-MicrosoftTeams cmdlet to connect to the Teams endpoint, to list the existing policies and the assigned value for VideoFiltersMode, run the Get-CsTeamsMeetingPolicy cmdlet:

Get-CsTeamsMeetingPolicy | Format-Table Identity, VideoFiltersMode

Identity                           VideoFiltersMode
--------                           ----------------
Global                             AllFilters
Tag:RestrictedFunctionality        NoFilters
Tag:Allow Meeting Recording        AllFilters

To update a policy, run the Set-CsTeamsMeetingPolicy cmdlet:

Set-CsTeamsMeetingPolicy -Identity RestrictedFunctionality -VideoFiltersMode NoFilters

Once the meeting policy is updated, it can be assigned to users as normal through the Teams Admin Center (Figure 4). It can take up to 24 hours before a change made to a policy is picked up and applied by clients.

Things keep on changing. Stay on top of change by subscribing to the Office 365 for IT Pros eBook and receive monthly updates with new information integrated and outdated content removed.

The Lobby’s the First Stop for External Meeting Participants

In Office 365 notification MC209349 published on April 14, Microsoft announced a change to the default meeting policy to enforce lobby entry for external users. Roadmap item 63388 says:

“We are updating the default meeting policy to automatically enforce lobby for all external users who join a Teams meeting, including attendees joining via Audio Conferencing. This policy change will only impact those tenants who have not modified the default meetings policy.”

The change is rolling out to tenants now.

Teams Lobby

The “lobby” referred to in the notification is a temporary holding place for people waiting to join a meeting. Authenticated users can allow people waiting in the lobby to join a meeting. Control over who can enter a meeting without going through the lobby is set by the meeting policy assigned to the organizer’s account. If they want, the organizer can override the policy for specific meetings.

Changes Made to the Default Meeting Policy

Technically, Microsoft is updating two settings affecting participants and guests in the default meeting policy. Figure 1 shows where the changes are made in the Teams Admin Center.

Behind the Scenes

MC209349 refers to the changes in PowerShell terms, where the edits are made with the Set-CSTeamsMeetingPolicy cmdlet:

• AutoAdmittedUsers is set to everyoneInCompany. This means that internal users can join Teams meetings without going through the lobby. However, external users – including those from federated organizations – must wait for admittance.
• AllowPSTNUsersToBypassLobby is set to False. This makes sure that dial-in users cannot bypass the lobby.

To check the values of the default meeting policy afterwards, run:

Get-CSTeamsMeetingPolicy -Identity Default | Format-List

See this page for more information about settings in Teams meetings policies.

Federated Organizations

Teams external access dictates the federation between your tenant and other organizations. This could be through open federation, where you allow communications from any other tenant or closed federation, where you allow federation with tenants based on an allow or block list (but not both).

Customized Default Meeting Policies Unaffected

If you customized the default meeting policy for your tenant in the past, this change won’t overwrite or otherwise affect those customizations. Default Teams policies remain under Microsoft’s control unless a tenant wants to change a default policy. At that point, the policy is copied to the tenant and the change is applied to the copy. A tenant-customized version of a default policy always takes precedence over Microsoft’s version, which is why this change only impacts tenants who have never changed the default meeting policy.

The Office 365 for IT Pros eBook has lots of information about Teams meetings. And best of all, as things change, we update the book and make new versions available to our subscribers.

Create On-Demand Private Meetings Without Scheduling

Office 365 Notification MC189276 (30 August 2019) tells us that the new Teams Calendar App will get the ability to host private on-demand video or audio meetings from the desktop or browser client. The feature is also documented in Office 365 roadmap item 54208, which promises meetings with “no calendar, no scheduling, no fuss.”

The Meet Now feature is rolling out worldwide in mid-September with GCC tenants getting it in mid-October. Microsoft says that every Office 365 tenant will have the feature by the end of November.

How Meet Now Works

To create a new on-demand meeting, click the Meet now button in the Calendar app (Figure 1).

Teams then starts a meeting. You can choose what settings you want to use , join it as the organizer and then add whoever else you want to meet with (Figure 2), including both tenant and guest users.

The meeting is private because no trace exists of it in the user’s calendar or a Teams channel.

Teams Meeting Policy Setting for Allow Meet Now

All users are allowed to run on-demand meeting unless they’re barred by the Teams meeting policy assigned to their account. To stop users, open the meeting policy in the Teams Admin Center and set the “Allow Meet now in Private meetings” slider from On to Off (Figure 3).

Updating Allow Meet Now with PowerShell

You can also do this in PowerShell by updating the AllowPrivateMeetNow setting from True to False. First, let’s find out what meeting policies allow the Meet Now feature:

# Find out what Teams meeting policies allow Meet Now
Get-CsTeamsMeetingPolicy | Format-Table Identity, AllowPrivateMeetNow

Identity                           AllowPrivateMeetNow
--------                           -------------------
Global                                            True
Tag:AllOn                                         True
Tag:RestrictedAnonymousAccess                     True
Tag:AllOff                                        False
Tag:RestrictedFunctionality                       True
Tag:Default                                       True
Tag:Kiosk                                         True

Let’s say that we don’t want users assigned the RestrictedFunctionality policy to use Meet Now. To update the policy, run the Set-CSTeamsMeetingPolicy cmdlet to update the setting to False.

# Update Teams meeting policy to block user access to Meet Now feature in Calendar app
Set-CsTeamsMeetingPolicy -Identity "RestrictedFunctionality" -AllowPrivateMeetNow $False

Need to know more about Teams? Read the several chapters covering all aspects of this topic in the Office 365 for IT Pros eBook.