CIS Microsoft Teams Benchmark

This setting ensures that external access is restricted to approved domains on the Microsoft Teams collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Teams collaboration platform is essential for defense in depth.

# Check external access policy:
Get-CsTenantFederationConfiguration | Format-List

# Check allowed domains:
Get-CsAllowedDomain | Format-Table Domain, Action

# Restrict external access:
Set-CsTenantFederationConfiguration \
  -AllowPublicUsers $false \
  -AllowFederatedUsers $true \
  -AllowedDomains @{AllowedDomain='partner.com'}

# Block Skype consumer access:
Set-CsTenantFederationConfiguration -AllowPublicUsers $false

This setting ensures that guest access permissions are minimized on the Microsoft Teams collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Teams collaboration platform is essential for defense in depth.

# Check guest access settings:
Get-CsTeamsGuestCallingConfiguration | Format-List
Get-CsTeamsGuestMeetingConfiguration | Format-List
Get-CsTeamsGuestMessagingConfiguration | Format-List

# Restrict guest access:
Set-CsTeamsGuestCallingConfiguration -AllowPrivateCalling $false

Set-CsTeamsGuestMeetingConfiguration \
  -AllowIPVideo $false \
  -ScreenSharingMode Disabled

Set-CsTeamsGuestMessagingConfiguration \
  -AllowUserEditMessage $false \
  -AllowUserDeleteMessage $false \
  -AllowGiphy $false

This recommendation verifies that meeting lobby and admission controls are configured on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check meeting policies:
Get-CsTeamsMeetingPolicy -Identity Global | Format-List

# Check lobby settings:
Get-CsTeamsMeetingPolicy | Select-Object Identity, AutoAdmittedUsers, AllowAnonymousUsersToJoinMeeting

# Configure secure meeting defaults:
Set-CsTeamsMeetingPolicy -Identity Global \
  -AutoAdmittedUsers 'EveryoneInCompanyExcludingGuests' \
  -AllowAnonymousUsersToJoinMeeting $false \
  -AllowAnonymousUsersToStartMeeting $false \
  -AllowPSTNUsersToBypassLobby $false \
  -DesignatedPresenterRoleMode 'OrganizerOnlyUserOverride'

This recommendation verifies that meeting recording and transcription policies are set on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check meeting recording policy:
Get-CsTeamsMeetingPolicy -Identity Global | \
  Select-Object AllowCloudRecording, AllowRecordingStorageOutsideRegion, \
  RecordingStorageMode

# Configure meeting recording:
Set-CsTeamsMeetingPolicy -Identity Global \
  -AllowCloudRecording $true \
  -AllowRecordingStorageOutsideRegion $false \
  -RecordingStorageMode 'OneDriveForBusiness' \
  -AllowTranscription $true \
  -LiveCaptionsEnabledType 'DisabledUserOverride'

This recommendation verifies that messaging policies restrict unsafe content on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check messaging policies:
Get-CsTeamsMessagingPolicy -Identity Global | Format-List

# Configure secure messaging:
Set-CsTeamsMessagingPolicy -Identity Global \
  -AllowUrlPreviews $true \
  -AllowOwnerDeleteMessage $true \
  -AllowUserEditMessage $true \
  -AllowUserDeleteMessage $true \
  -AllowUserChat $true \
  -AllowGiphy $false \
  -GiphyRatingType 'Strict' \
  -AllowMemes $false \
  -AllowStickers $false \
  -AllowUserTranslation $true

This recommendation verifies that channel moderation and creation policies are configured on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check channel moderation:
Get-CsTeamsChannelPolicy | Format-List

# Check per-team settings (Graph API):
# GET https://graph.microsoft.com/v1.0/teams/{team-id}/channels/{channel-id}
# Check moderationSettings

# Configure channel moderation:
# Via Graph API:
# PATCH https://graph.microsoft.com/v1.0/teams/{team-id}/channels/{channel-id}
# {
#   "moderationSettings": {
#     "userNewMessageRestriction": "moderators",
#     "replyRestriction": "everyone",
#     "allowNewMessageFromBots": false,
#     "allowNewMessageFromConnectors": false
#   }
# }

# Set channel creation policy:
Set-CsTeamsChannelPolicy -Identity Global \
  -AllowPrivateChannelCreation $false

This setting ensures that third-party app permissions are restricted on the Microsoft Teams collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Teams collaboration platform is essential for defense in depth.

# Check app permission policies:
Get-CsTeamsAppPermissionPolicy -Identity Global | Format-List

# List allowed apps:
Get-CsTeamsAppPermissionPolicy -Identity Global | \
  Select-Object -ExpandProperty DefaultCatalogApps

# Restrict app permissions:
Set-CsTeamsAppPermissionPolicy -Identity Global \
  -DefaultCatalogAppsType 'AllowedAppList' \
  -GlobalCatalogAppsType 'AllowedAppList' \
  -PrivateCatalogAppsType 'AllowedAppList'

# Block specific risky apps:
# Teams Admin Center > Teams apps > Permission policies
# Set Third-party apps to 'Block all apps'
# Selectively allow vetted apps

This recommendation verifies that app sideloading is disabled on the Microsoft Teams collaboration platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Microsoft Teams collaboration platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check app setup policies:
Get-CsTeamsAppSetupPolicy -Identity Global | Format-List

# Check sideloading:
Get-CsTeamsAppSetupPolicy | \
  Select-Object Identity, AllowSideLoading, AllowUserPinning

# Disable app sideloading:
Set-CsTeamsAppSetupPolicy -Identity Global \
  -AllowSideLoading $false \
  -AllowUserPinning $true

# Pin essential apps:
Set-CsTeamsAppSetupPolicy -Identity Global \
  -PinnedAppBarApps @(
    @{Id='com.microsoft.teamspace.tab.wiki'},
    @{Id='com.microsoft.teamspace.tab.planner'}
  )

This recommendation verifies that DLP policies cover Teams locations on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DLP policies (Security & Compliance Center):
Get-DlpCompliancePolicy | Format-List Name, Mode, Enabled

# Check DLP rules:
Get-DlpComplianceRule | Select-Object Name, ParentPolicyName, BlockAccess

# Create DLP policy for Teams:
New-DlpCompliancePolicy -Name 'Teams Sensitive Data' \
  -TeamsLocation All \
  -Mode Enable

New-DlpComplianceRule -Name 'Block SSN sharing' \
  -Policy 'Teams Sensitive Data' \
  -ContentContainsSensitiveInformation @(
    @{Name='U.S. Social Security Number (SSN)'; minCount='1'}
  ) \
  -BlockAccess $true \
  -NotifyUser 'SiteAdmin'

This recommendation verifies that retention policies are applied to Teams on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check retention policies:
Get-RetentionCompliancePolicy | Where-Object {$_.TeamsChannelLocation} | \
  Format-List Name, Enabled, TeamsChannelLocation

Get-RetentionComplianceRule | Format-List Name, RetentionDuration

# Create retention policy for Teams:
New-RetentionCompliancePolicy -Name 'Teams 1 Year Retention' \
  -TeamsChannelLocation All \
  -TeamsChatLocation All \
  -Enabled $true

New-RetentionComplianceRule -Name 'Teams 1 Year Rule' \
  -Policy 'Teams 1 Year Retention' \
  -RetentionDuration 365 \
  -RetentionComplianceAction KeepAndDelete

This recommendation verifies that conditional access policies enforce MFA for Teams on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check conditional access policies:
Get-AzureADMSConditionalAccessPolicy | \
  Where-Object {$_.Conditions.ClientAppTypes -contains 'All'} | \
  Format-List DisplayName, State, GrantControls

# Check MFA status:
Get-MsolUser -All | Select-Object DisplayName, StrongAuthenticationMethods

# Create conditional access policy for Teams:
# Azure AD > Security > Conditional Access > New Policy
# Name: Require MFA for Teams
# Users: All users
# Cloud apps: Microsoft Teams
# Conditions: All client apps
# Grant: Require MFA, Require compliant device
# Session: Sign-in frequency 12 hours

# Via PowerShell:
New-AzureADMSConditionalAccessPolicy \
  -DisplayName 'Secure Teams Access' \
  -State 'Enabled' \
  -Conditions @{
    ClientAppTypes = @('All')
    Applications = @{IncludeApplications = @('cc15fd57-2c6c-4117-a88c-83b1d56b4bbe')}
  } \
  -GrantControls @{
    BuiltInControls = @('mfa', 'compliantDevice')
    Operator = 'AND'
  }

This recommendation verifies that sensitivity labels are applied to Teams on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check sensitivity labels:
Get-Label | Select-Object DisplayName, Priority, ContentType | Format-Table

# Check label policies:
Get-LabelPolicy | Format-List Name, Labels, Settings

# Create and apply sensitivity labels:
New-Label -Name 'Confidential-Teams' \
  -DisplayName 'Confidential' \
  -Tooltip 'For internal use only' \
  -ContentType 'File, Email, Site, UnifiedGroup, Teamwork'

# Create label policy:
New-LabelPolicy -Name 'Teams Classification' \
  -Labels 'Confidential-Teams' \
  -ExchangeLocation All \
  -Settings @{
    mandatory=$true;
    defaultlabel='Confidential-Teams'
  }

This recommendation verifies that unified audit logging captures Teams events on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit log search:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) \
  -EndDate (Get-Date) -RecordType MicrosoftTeams | \
  Select-Object -First 10 CreationDate, UserIds, Operations

# Enable unified audit logging:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

# Search Teams-specific events:
Search-UnifiedAuditLog \
  -StartDate (Get-Date).AddDays(-30) \
  -EndDate (Get-Date) \
  -RecordType MicrosoftTeams \
  -Operations 'TeamCreated','MemberAdded','MemberRemoved','ChannelAdded' \
  -ResultSize 5000 | Export-Csv teams-audit.csv

This recommendation verifies that communication compliance policies are configured on the Microsoft Teams collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Microsoft Teams collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check communication compliance:
Get-SupervisoryReviewPolicyV2 | Format-List Name, IsActive

# Check eDiscovery cases:
Get-ComplianceCase | Format-List Name, Status

# Configure communication compliance:
# Microsoft 365 Compliance > Communication Compliance > Policies
# Create policy to monitor:
# - Offensive language
# - Sensitive information sharing
# - Regulatory compliance keywords

# Enable eDiscovery for Teams:
New-ComplianceCase -Name 'Teams Investigation'
New-CaseHoldPolicy -Case 'Teams Investigation' \
  -Name 'Teams Hold' \
  -ExchangeLocation user@example.com