Teams Meetings with External People

[networkmangler]

We had an incident with an online lesson where students were leaving the lesson and then joining as a (guest). The name they used for the guest was inappropriate and they used the chat facility in the meeting to mess around

 

The setting which allowed this was under Meetings > Meeting settings > Participants > Anonymous users can join a meeting

 

I turned this off and this stopped the issue but..

 

Now when we try to have a meeting with an external person they get the following message: Only people with access to this org can join its meetings

 

Is there a way we can have meetings with specific external people? but still stop the anonymous joining issue?

 

I looked at guest access but this talks about Teams channels and not Teams meetings specifically

[foofighterjim]

This is a needle I am currently trying to thread, but I don't think there is a silver bullet to this.

 

I read 100s of documents on Teams and settings during lockdown, but only came to these conclusions:

 

1. Your global meeting settings will probably need to be the same as your student settings, anticipating some students somehow manage to join as a guest.
   
2. You should still have a dedicated student policy (despite the above) and a dedicated staff policy.
   
3. All guests (if allowed) will join using the global policy.
   
4. Guests are defined as anyone with the meeting link who can't authenticate against your tenant.
   

 

Unfortunately, it looks like your are facing some challenges with your students. This would have to be dealt with in line with your schools behaviour policy, there is no technical way around this if you want to allow guest access.

 

Our problem is that we disable the cameras for the students, so currently, if we invite guests we only have audio, which is a bit of a let down. In this event we do actually tend to use our Zoom subscription for external meetings at the moment.

[steveg]

In your meeting policy, under participants and guests, automatically admit people, is it set to everyone in your organisation? I think this should mean that guests are placed in a lobby and you have to admit them, which if you aren't expecting them (in a lesson for example) you can just ignore them.

[TechMonkey]

In your meeting policy, under participants and guests, automatically admit people, is it set to everyone in your organisation? I think this should mean that guests are placed in a lobby and you have to admit them, which if you aren't expecting them (in a lesson for example) you can just ignore them.

 

This. Lobby should be used for any guests, one to stop randoms getting in and two to screen names.

[networkmangler]

In your meeting policy, under participants and guests, automatically admit people, is it set to everyone in your organisation? I think this should mean that guests are placed in a lobby and you have to admit them, which if you aren't expecting them (in a lesson for example) you can just ignore them.

 

The meeting settings didn't help the situation but I have changed them now

 

They were set to auto admit people in my organisation into meetings but it was also set to add attendees as presenters. So the students had access to add people from the lobby not just the teacher

 

I have changed it now so that by default only the organizer automatically gets admitted to the meeting and everyone gets added to the meeting with attendee access rights. So only the teacher can add people from the lobby

 

This obviously puts the responsibility on staff checking who they are allowing into the meeting rather than it being a policy enforcement (Which I would prefer). If the teacher is mid way through teaching and doesn't double check they could still add a guest so doesn't take the issue away totally

 

edit

 

Just re read your comment, in theory I have made it too restrictive and should set it too admit only people in your organisation and tell staff not to admit anyone from the lobby. This will make it easier

Edited October 14, 2020 by networkmangler

[smarties11]

The reason students can join as guests is because you are scheduling the meeting, which sends an invite with a link to join - which they can follow and choose the guest option.

 

In our policy, we instruct teachers to use 'meet now' instead. This sends no invite, and the students can only join the meeting by being signed in to their Teams account, browsing to the correct Team, seeing the ongoing meeting and clicking join.

 

This is the method we established in our pilot back in June, and successfully used for a fortnight just recently when we had a year group isolating at home, for all of their live lessons. It helps that we use Salamander to publish their timetable to their mailbox calendar, which shows in Teams calendar. So they knew where to be and when.

 

This way you can still host your external meetings too.

[ronnoco]

This is a needle I am currently trying to thread, but I don't think there is a silver bullet to this.

 

I read 100s of documents on Teams and settings during lockdown, but only came to these conclusions:

 

1. Your global meeting settings will probably need to be the same as your student settings, anticipating some students somehow manage to join as a guest.
   
2. You should still have a dedicated student policy (despite the above) and a dedicated staff policy.
   
3. All guests (if allowed) will join using the global policy.
   
4. Guests are defined as anyone with the meeting link who can't authenticate against your tenant.
   

 

Unfortunately, it looks like your are facing some challenges with your students. This would have to be dealt with in line with your schools behaviour policy, there is no technical way around this if you want to allow guest access.

 

Our problem is that we disable the cameras for the students, so currently, if we invite guests we only have audio, which is a bit of a let down. In this event we do actually tend to use our Zoom subscription for external meetings at the moment.

 

Hi,

 

I'm currently battling a similar problem where by we want staff to be able to meet with external but sometimes have students signing in as Guests which is causing a problem. Did you turn off 'Allow IP Video' under Org-wide settings, Guest Access? is this what you mean when you say All guests (if allowed) will join using the global policy?

 

Many Thanks

 

Gary

[foofighterjim]

Hi,

 

I'm currently battling a similar problem where by we want staff to be able to meet with external but sometimes have students signing in as Guests which is causing a problem. Did you turn off 'Allow IP Video' under Org-wide settings, Guest Access? is this what you mean when you say All guests (if allowed) will join using the global policy?

 

Many Thanks

 

Gary

 

We actually used @steveg recommendation and forced the lobby on for guests, allowing us to enable the setting for Allow IP Video for the global settings. Staff are now under instruction to never allow a Student into a meeting from the lobby, they must follow the instructions and authenticate properly. Caused a few complaints at first but the staff stuck to the rule and things have settled down now.

[Danp]

Previous school I had settings set to organisation only. But, if an external was invited via Outlook 'New Teams Meeting' then they could join any meeting. This worked.

[ronnoco]

We actually used @steveg recommendation and forced the lobby on for guests, allowing us to enable the setting for Allow IP Video for the global settings. Staff are now under instruction to never allow a Student into a meeting from the lobby, they must follow the instructions and authenticate properly. Caused a few complaints at first but the staff stuck to the rule and things have settled down now.

 

Will Guests pick up settings from the Global Meeting & Messaging policies? This is what we are currently using for students (but I can soon create another) and it looks like we have that setting correct?

 

Also, It says these settings are for people dialing in with a phone? - am I looking in the wrong place.

 

[foofighterjim]

Will Guests pick up settings from the Global Meeting & Messaging policies? This is what we are currently using for students (but I can soon create another) and it looks like we have that setting correct?

 

Also, It says these settings are for people dialing in with a phone? - am I looking in the wrong place.

 

Yes, guests will have the global settings applied. You should have a separate policy for your students even if it is the same as the default policy, it gives you better flexibility going forwards.

 

The key setting is the automatically admit people option, you have this correctly set to everyone in your organisation. So now, if an external user connects they will be placed in the lobby and have access to whatever you have set in the global meeting policy. Remember that if you have changed any of these settings today, they can take up to 24 hours to apply.

[ronnoco]

Yes, guests will have the global settings applied. You should have a separate policy for your students even if it is the same as the default policy, it gives you better flexibility going forwards.

 

The key setting is the automatically admit people option, you have this correctly set to everyone in your organisation. So now, if an external user connects they will be placed in the lobby and have access to whatever you have set in the global meeting policy. Remember that if you have changed any of these settings today, they can take up to 24 hours to apply.

 

Thanks for confirming, much appreciated. Those settings have always been set that way so I suspect our problem is simply a case of Teachers admitting anyone in the lobby. As you say, this can be addressed with training but how do you get round the issue that many students will join as guests by pure accident because they are using a parent laptop signed into a Microsoft account of Chrome browser signed into a Gmail account? That happened to us lots on staff training sessions over lockdown and we all know what kids are like. I can imagine trying to explain how to sign in correctly being a nightmare. We get those sorts of problems now when students are using shared computers and just trying to sign into heir school account.

 

Also, can students definitely not admit guests, only teachers?

Edited November 23, 2020 by ronnoco

[foofighterjim]

I would say get the Students to attend the meeting from an incognito window in Chrome or Edge, where they are only signed into their school account. The last time I tested this (back in the summer) it created some sort of loop and wouldn't connect to the meeting, worth a test run though as YMMV.

 

Re students admitting Guests, it's not something I am aware of but would suspect it would depend on the meeting policy applied to the students. This article may be of more assistance: https://docs.microsoft.com/en-us/microsoftteams/meeting-policies-in-teams

[ronnoco]

What settings are needed for 'Roles that have presenter rights in meetings' and 'Automatically admit people' and are these the same for both the global AND staff policy?

 

Many Thanks!

[foofighterjim]

We have the former set to "Everyone, but users can override" the latter to "Everyone in your Organisation"

 

Just a point of reference, I believe it is mentioned in the previously linked article. These settings are for any meeting that the user creates, i.e. if your students can't create a meeting then these settings are pretty much irrelevant in your student policy, you'll need to ensure they are set correctly for your staff policy.

[rapid_f1]

Hi has anyone been able to sort this from the Teams admin center? The 2 settings that are relevant are "Allow Guest access" and "Allow anonymous access".

 

We still want to be able to have external meetings but with those 2 settings turned on, students are trying to join lessons they are not timetabled for using the link and trying to login as guest. They tried logging on as Bill gates in the username ! We have the lobby turned on but students ar egettign clever and using staff members names in the Guest username box and trying to join.

Edited January 14, 2021 by rapid_f1

[Ex-MGSTech]

I've just turned Guest access off but allowed external access....

[smarties11]

Hi has anyone been able to sort this from the Teams admin center? The 2 settings that are relevant are "Allow Guest access" and "Allow anonymous access".

 

We still want to be able to have external meetings but with those 2 settings turned on, students are trying to join lessons they are not timetabled for using the link and trying to login as guest. They tried logging on as Bill gates in the username ! We have the lobby turned on but students ar egettign clever and using staff members names in the Guest username box and trying to join.

 

You only need external access turned on to have meetings with externals. You don't need guest access on. That is for when you want externals to be actual members in your teams and see all the posts and files.

 

I mentioned earlier in this thread but the way to avoid students joining random meetings etc is NOT to schedule the lesson. This creates an e-mail invitation with a link, and this link can be passed on to anyone (and allows them to join as guests). I know of lots of Schools locally using this method and it's creating an unnecessary classroom control burden on their teachers, who are facing the same issues as you.

 

Instead, ask your teachers to 'meet now' within the relevant class team & channel 5 mins before the start of the lesson. Students then just browse to the team & channel at the correct time, see the meeting running, hit join. They are never in possession of the meeting join link so can't mess about. It makes it impossible for them to join meetings for which they are not a Team member.

 

Scheduling the lesson also allows students to join it before (and after!) it has finished. With meet now, once the meeting is ended, it's gone.

 

We've been using this method successfully since June throughout various bubble closures and now a full lockdown. We're teaching a full timetable to every student with over 90% attendance. It works!

[rapid_f1]

I definately will mention Meet Now. The one advantage of scheduling is that it allows the teacher to set meeting options so that lobby is turned on. With Meet Now they may forget.

 

So you have Anonymous access turned off, Guest access turned off, and External access turned on (all domains allowed). Is that correct?

[smarties11]

You don't need the lobby if you don't have guests. To meet now, students must have already logged in with their O365 credentials, so the lobby is bypassed.

 

The only other setting they might want to change is to make themselves the only presenter. But you can change the default policy (via PowerShell) so that this is the default setting anyway, so that any meeting initiated by a Teacher will always start such that any students joining are attendees only.

[rapid_f1]

Yes we have Presenter set to Only Me. We dont want students to join without the teacher lettign them in.

 

Well I enabled external access, disabled anonymous access and disabled guess access, and external users cant join the meeting, it says only people in this organisation can attend meetings. So that doesnt work.

 

Meet now may be the way we have to go. I like the scheduling feature its allows you to schedule a whole days or weeks worth of lessons and its there a s areminder.

[smarties11]

It works for us as long as they are invited using their external email address.

 

We publish student timetables to mailbox calendars (which show in Teams too) using Salamander which tells the student where to be.

 

With meet now, students can only join once a teacher has started the lesson, which makes the lobby redundant in my view.

 

I can only speak from our own experiences. We tested both ways and using scheduled lessons we ran into all the issues you describe. With meet now, it has been very successful, plus it means your teachers / admin staff don't need to schedule the lessons. We've had fantastic engagement and attendance from pupils, far in excess of what other local Schools have managed. Ultimately its your choice but IMO teachers should be using the technology to teach, rather than the technology create the additional classroom and behaviour management burden you describe.

[rapid_f1]

Totally agree with you. As techs, I am trying to streamline things as much as possible, I dont want the tech to be burdensome, yet of course we always have to have our safeguarding hats on.

 

It works for us as long as they are invited using their external email address.

 

So as a member of staff, you schedule a meeting, under Invite attendees you just put the email address of the external user, the external user clicks link in the email, and its workign for you? Doesnt work here. Il check settings again.

[smarties11]

So as a member of staff, you schedule a meeting, under Invite attendees you just put the email address of the external user, the external user clicks link in the email, and its workign for you? Doesnt work here. Il check settings again.

 

Yes, when we type an external email address with these settings, it turns into an invite link which we click. They then receive the invite.

 

Again, IMO meet now wins on safeguarding too. The only possible way a student can connect to a meeting is by signing in with their valid O365 credentials, and being a member of the class team. Using scheduled meetings, the invite URL can be shared with anyone. Some randomer could join one of your lessons simply by entering a valid student name in the lobby, and then get admitted by the teacher. This actually happened in a local School, students shared the invite with their mates in other Schools, they then joined the lesson and starting taking the p!ss out of the teacher!

[rapid_f1]

Yes, when we type an external email address with these settings, it turns into an invite link which we click. They then receive the invite.

 

Yep we get this far. But when the xternal user clicks on the link in their email, it opens the Teams app and says "Only people with access to this org can join its meetings".

 

Again, IMO meet now wins on safeguarding too. The only possible way a student can connect to a meeting is by signing in with their valid O365 credentials, and being a member of the class team. Using scheduled meetings, the invite URL can be shared with anyone. Some randomer could join one of your lessons simply by entering a valid student name in the lobby, and then get admitted by the teacher. This actually happened in a local School, students shared the invite with their mates in other Schools, they then joined the lesson and starting taking the p!ss out of the teacher!

 

Thats exactly what is happening here. Students are sharing their link. I have posed the question to Senior about using Meet Now only.

 

EDIT - I have just noticed that when a student is in the meeting, they click on Particpants or they click on Meetign details, they can copy the join info. And paste this into an email. So they will still be able to get the link to the meeting even with Meet Now.

Edited January 14, 2021 by rapid_f1