(Updated) Co-organizer experience updates in Teams Webinars and Townhalls

🚨 The Signal: Teams webinar and town hall co-organizers now have full control parity with organizers, including editing event details, publishing, and cancelling. This increases the blast radius of compromised or malicious co-organizer accounts.

The Impact

Teams administrators and event organizers are affected, facing increased risk of unauthorized event changes due to expanded co-organizer permissions.

  • Event Organizers: Increased risk of unauthorized event changes or cancellations.
  • Teams Administrators: Need to review and enforce stricter co-organizer assignment policies.
  • Security Teams: Potential for social engineering or insider threat vectors via compromised co-organizer accounts.
  • End Users: Risk of attending illegitimate or cancelled events if co-organizer accounts are misused.

The Action

  1. Review existing Teams meeting policies for webinar and town hall organizer/co-organizer roles via Teams Admin Center > Meetings > Meeting policies.
  2. Implement or update a policy requiring explicit approval for co-organizer assignments to high-profile events.
  3. Educate event organizers on the expanded capabilities of co-organizers and the importance of careful delegation.
  4. Monitor audit logs for unusual event modifications or cancellations by co-organizers via Microsoft Purview compliance portal > Audit.

Domain: Teams · Impact: high · Workload: Teams · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898