Microsoft Teams: External presenters can manage event production controls

🚨 The Signal: Microsoft Teams now allows external federated (B2B) and guest users to manage event production controls. This shifts event management capabilities outside the organisation, increasing the attack surface if not properly governed.

The Impact

Event organizers and security teams are affected, facing increased risk from external users gaining control over event content and attendee experience.

• Event Organizers: Risk of misconfiguration by external parties leading to inappropriate content display.
• Security Teams: Increased attack surface from external users with elevated permissions.
• External Presenters: Gain significant control, requiring clear policy and trust frameworks.
• Attendees: Potential exposure to unapproved content if external controls are compromised.

The Action

1. Review existing Teams event policies for external presenter permissions.
2. Update internal documentation and training for event organizers on granting external production controls.
3. Implement a strict approval process for assigning production control to external users.
4. Monitor audit logs for 'Who has control of production tools' setting changes involving external users.
5. Regularly review B2B and guest user access to ensure least privilege is maintained for event roles.

Domain: Teams · Impact: high · Workload: Teams · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898