Teams Meetings with External People

[mullet_man]

So we've just run into this today, students are sending out the meeting link to their mates at other schools and some teachers have admitting them (mistakingly)

 

The issue we have here is we want to be able to schedule the lessons via meeting invites as we are collapsing classes down so the teachers are teaching maybe 4 classes together so using the meet now wouldn't work as that is per class?

 

We make use of the lobby feature so I guess we need to make sure teachers are aware of the situation and not to invite any guests.

[smarties11]

So we've just run into this today, students are sending out the meeting link to their mates at other schools and some teachers have admitting them (mistakingly)

 

The issue we have here is we want to be able to schedule the lessons via meeting invites as we are collapsing classes down so the teachers are teaching maybe 4 classes together so using the meet now wouldn't work as that is per class?

 

We make use of the lobby feature so I guess we need to make sure teachers are aware of the situation and not to invite any guests.

 

You could still use meet now if you built new teams and channels to reflect your collapsed classes?

 

Even if you had a really basic structure, e.g. A team for the whole year group (all year group students are members) and then a channel for each subject, or teacher etc. And then just tell the students where they need to be, and when.

 

The other option is simply not to admit guests. Make sure students know that they will only get access to the lesson if they are logged in with the O365 credentials.

[smarties11]

Yes, when we type an external email address with these settings, it turns into an invite link which we click. They then receive the invite.

 

Yep we get this far. But when the xternal user clicks on the link in their email, it opens the Teams app and says "Only people with access to this org can join its meetings".

 

I'll check when I'm back at work but we've been able to do this lots of times with varies external people and agencies etc.

 

EDIT - I have just noticed that when a student is in the meeting, they click on Particpants or they click on Meetign details, they can copy the join info. And paste this into an email. So they will still be able to get the link to the meeting even with Meet Now.

 

I hadn't realised this, I've just checked and you are right. However, with meet now this still shouldn't matter - to get far enough to copy the link, your students are already signed in with their valid credentials. Therefore, teachers then just ignore anyone that comes in via the lobby.

[rapid_f1]

It got pretty bad at one point today so I have turned off the setting "Allow anonymous access". This is what allows external accounts to join any meeting. A pretty bad flaw from Microsoft I have to say. Settings need to be more granualr. Works in business but not in a school. So now weve just got to figure out how we can have external meetings for example for job interviews - one option is to have a bank of temp school accounts and tell the external user to log onto Teams with that temp account.

[rapid_f1]

We make use of the lobby feature so I guess we need to make sure teachers are aware of the situation and not to invite any guests.

 

Be careful with even this. Students are clockin gon - in the guest name they are typing in a proper teachers name to join the meeting. So the teacher delviering the live lesson sees Mr Pritchard wants to join, the teacher thinks thats fine, and admits Mr Pritchard, not realising its not Mr Pritchard at all. I would turn off Anonymous access in Teams admin center. I think its highly flawed for education.

[mullet_man]

If anonymous access turns off external people being able to join meetings then I can't turn it off, we have lots staff who meet with outside agencies and other schools etc.

 

Doesn't the name appear with Guest next to it? Staff will just need to ensure they don't invite guests into the lesson.

[robyholmes]

I've voted for the following uservoice, which would allow you to restrict the meeting to only those invited (Logged in users only) which to me makes perfect sense for our classes, plus a large majority of meetings in businesses too.

https://microsoftteams.uservoice.com/forums/555103-public/suggestions/35696926-prevent-users-from-joining-a-meeting

[bigjb]

Having the same issue - This maybe of some interest but not until Feb 21 - https://www.microsoft.com/en-us/microsoft-365/roadmap?featureid=68730

[reprised]

I have been following this thread as our school have had these issues too. We initially started allowing staff to use Teams for meetings; we allowed anonymous users so they can also meeting with outside people. Now that students have been added to the mix we have the same problem - we only use Teams for meetings and use Firefly to create the meeting link via their integration.

 

We can either disable anonymous access and staff will not be able to have meetings with external users or make sure staff only allow in users who don't have (Guest) next to their name. We have changed the following meeting policies for staff:

 

Who can bypass the lobby - Organizer only

Who can present - Only me

 

We have also advised to disable "Allow attendees to unmute" in meeting options. Students have to raise hand and the staff member can unmute them to speak. I think Microsoft may also be releasing a toggle to Disable chat in the meeting options in January 2021 but we don't see it yet.

 

We don't have our groups in Teams yet (we're just using the meeting function); does anyone know if having meeting with a class Team offers the ability to only allow authenticated members in while still leaving "allow anonymous users" enabled for meetings created outside of a team?

[robyholmes]

We don't have our groups in Teams yet (we're just using the meeting function); does anyone know if having meeting with a class Team offers the ability to only allow authenticated members in while still leaving "allow anonymous users" enabled for meetings created outside of a team?

 

No it doesn't offer that. Hence the uservoice above I linked too. Although it does look like Microsoft already have plans to put something in place for it using bigjb Roadmap link above.

[Jobos]

The only other setting they might want to change is to make themselves the only presenter. But you can change the default policy (via PowerShell) so that this is the default setting anyway, so that any meeting initiated by a Teacher will always start such that any students joining are attendees only.

 

Could you share the command to set this policy please? Being a primary we don’t get as much silliness but pupils have discovered they can mute the teacher unless this setting is changed.

[fordea]

Could you share the command to set this policy please? Being a primary we don’t get as much silliness but pupils have discovered they can mute the teacher unless this setting is changed.

 

You can do this in the teams admin center by altering your teams meeting policy that you apply to your teachers. The setting / value you need to change is:

 

Roles that have presenter rights in meetings: Organizers, but users can override

[robyholmes]

Could you share the command to set this policy please? Being a primary we don’t get as much silliness but pupils have discovered they can mute the teacher unless this setting is changed.

 

I used this guide the other day:

https://office365itpros.com/2020/05/26/limiting-who-can-present-teams-meetings/#:~:text=By%20default%2C%20anyone%20(including%20guests,define%20one%20or%20more%20presenters.

 

This is for the 'Who can present' option, for lobby you use:

 

Set-CsTeamsMeetingPolicy -Identity ###POLICYNAME#### -AutoAdmittedUsers OrganizerOnly

 

For more information see here: https://docs.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps

 

EDIT: Forget this, it's in the damn admin console now! I spent ages getting Powershell connected yesterday to do this! Why the heck didn't I check it was in the console! Doh

Edited January 15, 2021 by robyholmes

[psydii]

Regarding anonymous users appearing as legitimate users in classes/the lobby.

 

I have reason to believe there is some understanding of how this is happening, and that it shouldn't be. There is some inconsistent behaviour in Teams and a use case that can be reliably used to produce the effect described. The desired behaviour can be seen in other use cases.

 

For now the recommended way to keep anonymous users with arbitrary (and therefore potentially forged) names out of the Lobby or meeting is to disable anonymous access.

 

I recommend that anyone experiencing anonymous users gaining entry to meetings by forging their identity raise an urgent ticket with Microsoft via the admin portal https://admin.microsoft.com/ *and* the edu support site: https://aka.ms/Edusupport

[smarties11]

Regarding anonymous users appearing as legitimate users in classes/the lobby.

 

I have reason to believe there is some understanding of how this is happening, and that it shouldn't be. There is some inconsistent behaviour in Teams and a use case that can be reliably used to produce the effect described. The desired behaviour can be seen in other use cases.

 

For now the recommended way to keep anonymous users with arbitrary (and therefore potentially forged) names out of the Lobby or meeting is to disable anonymous access.

 

I recommend that anyone experiencing anonymous users gaining entry to meetings by forging their identity raise an urgent ticket with Microsoft via the admin portal https://admin.microsoft.com/ *and* the edu support site: https://aka.ms/Edusupport

 

This sounds very cryptic. Can you share more details?

[psydii]

Pretty sure posting how to hack such-and-such service is the sort of thing that is frowned on by the mods here.

 

*that sound more dramatic than necessary. The reason to raise the urgent tickets is to help MS get visibility of the issue, which is same reason I turned on full telemetry in Windows 7. This is just an identification (human to human) level bypass - social engineering if you will, that is made trivially easy by inconsistent behaviour of Teams.

Edited January 19, 2021 by psydii

[smarties11]

Pretty sure posting how to hack such-and-such service is the sort of thing that is frowned on by the mods here.

 

*that sound more dramatic than necessary. The reason to raise the urgent tickets is to help MS get visibility of the issue, which is same reason I turned on full telemetry in Windows 7. This is just an identification (human to human) level bypass - social engineering if you will, that is made trivially easy by inconsistent behaviour of Teams.

 

So are you saying that you've had students able to gain access to meetings either

 

- by bypassing imposed authentication or by forcibly getting through the lobby without a teacher admitting them (hacking)

OR

- that students are gaining access because a teacher allowed them in via the lobby and trusted they were who they said they were (not hacking)

 

You need to be clear on this because if you're suggesting there's a security vulnerability in Teams, there's 1,000s of Schools up and down the country that need to know about it in order to consider the safeguarding implications.

[psydii]

The latter. Edited January 19, 2021 by psydii

[smarties11]

The latter. But this is still a vulnerability, and social engineering is hacking.

 

I disagree. Any School that is allowing students to join a class without providing credentials, only asking them to type their name and taking their word for it, is asking for trouble. It's safeguarding basics. Likely these Schools have rushed into Teams / live lessons without a proper pilot and full evaluation.

 

I mean, would you set all of your students AD password to their name? Or would you think "oh, hang on a minute, it won't take them long to realise that they can sign in to all their mates accounts too"

 

The way to do it is to instruct students that they MUST sign in to Teams and join the meeting that way. Either via their calendar in the case of scheduled meetings, or via the Team itself if you are a 'meet now' School. And tell teachers not to admit ANYONE in via the lobby. Simples.

[psydii]

Some (many?) schools do all of the above good practice, but also need anonymous access enabled for parental meetings etc. The expected behaviour is that a teacher can see easily differentiate "anonymous" users in the lobby because they have GUEST as a suffix to their chosen name. Without the suffix staff struggle to spot malicious external users (unless they are choosing vulgar names).

 

There are a number of potential long term solutions (some have been linked to above). A quick win would be to ensure that all anonymous users are identified as such clearly to the meeting organiser. Now we can still see a risk there that vulgar names are chosen, but people will get bored doing that after a while.

 

Personally I long for a default option of "no anonymous attendees", and a global option to allow members of certain security groups to override that setting on a meeting-by-meeting basis. I also long for delegation of meeting owner rights to both the exchange and the s4b sides of things.

[smarties11]

Some (many?) schools do all of the above good practice, but also need anonymous access enabled for parental meetings etc. The expected behaviour is that a teacher can see easily differentiate "anonymous" users in the lobby because they have GUEST as a suffix to their chosen name. Without the suffix staff struggle to spot malicious external users (unless they are choosing vulgar names).

 

There are a number of potential long term solutions (some have been linked to above). A quick win would be to ensure that all anonymous users are identified as such clearly to the meeting organiser. Now we can still see a risk there that vulgar names are chosen, but people will get bored doing that after a while.

 

Personally I long for a default option of "no anonymous attendees", and a global option to allow members of certain security groups to override that setting on a meeting-by-meeting basis. I also long for delegation of meeting owner rights to both the exchange and the s4b sides of things.

 

I don't really see what you mean. From what you've written it seems like you are over complicating things and blending two completely different scenarios (live lessons and external meetings). This is what we do for each of those scenarios.

 

For live lessons....

- Anonymous access enabled, because as you say - it's required for external meetings

- Students always access their live lessons by signing in first, using the School issued M365 credentials and therefore bypass the lobby

- Staff know that they must never admit anyone in via the lobby

- We use 'meet now' rather than schedule lessons which means students don't get the join link by e-mail, they can get it once they have joined the meeting but as long as staff don't admit anyone through the lobby that is irrelevant

 

For other meetings...

- Parent meetings we encourage that these are done via the student account wherever possible - then again, signed in via student M365 account

- For others, staff create a schedule meeting and invite the external, they join via the lobby either as a guest using their own Teams account or anonymously if they have joined without signing in

- Staff admit via the lobby

- Much less likely to get a malicious user here as your external people are highly unlikely to forward the join link for giggles like the kids

 

With the above in place, we've never had anyone yet join one of our lessons or meetings that shouldn't be there, and we've been running this setup since June, through various bubble closures (at one point we had 5 of 7 bubbles closed) and now through full lockdown, teaching a full timetable to our students every day.

[robyholmes]

@smarties11

 

A lot of schools, us included set the lobby to 'Only Me'. Meaning students enter the lobby before being admitted to the lesson. Without this, students can join a live lesson without a teacher being present. This then means it's not recorded and they can do what they want without teacher supervision.

 

So with the lobby set to 'Only Me'. Staff are having to check the full class in lobby, admitting one by one in case one of those waiting is a guest.

 

We don't use the 'Meet Now' option as students don't get invited, we want all staff to plan live lessons ahead of time so students know to join. I can see that using the 'Meet Now' helps with them not being able to join ahead of time, meaning you don't need a lobby, but for us it meant students didn't know if the lesson was going ahead or not.

[smarties11]

@smarties11

 

A lot of schools, us included set the lobby to 'Only Me'. Meaning students enter the lobby before being admitted to the lesson. Without this, students can join a live lesson without a teacher being present. This then means it's not recorded and they can do what they want without teacher supervision.

 

So with the lobby set to 'Only Me'. Staff are having to check the full class in lobby, admitting one by one in case one of those waiting is a guest.

 

We don't use the 'Meet Now' option as students don't get invited, we want all staff to plan live lessons ahead of time so students know to join. I can see that using the 'Meet Now' helps with them not being able to join ahead of time, meaning you don't need a lobby, but for us it meant students didn't know if the lesson was going ahead or not.

 

Ah, I see. I hadn't considered from that perspective as we discounted scheduled lessons when we piloted Teams, for the reasons already mentioned! I can see why this would cause problems if you have gone down the scheduled lesson route. If this was my School, I'd be insisting that we disabled anonymous access. Talk to parents via student M365 account. And then externals with A another technology. Safeguarding trumps everything, afterall.

[reprised]

Some (many?) schools do all of the above good practice, but also need anonymous access enabled for parental meetings etc. The expected behaviour is that a teacher can see easily differentiate "anonymous" users in the lobby because they have GUEST as a suffix to their chosen name. Without the suffix staff struggle to spot malicious external users (unless they are choosing vulgar names).

 

There are a number of potential long term solutions (some have been linked to above). A quick win would be to ensure that all anonymous users are identified as such clearly to the meeting organiser. Now we can still see a risk there that vulgar names are chosen, but people will get bored doing that after a while.

 

Personally I long for a default option of "no anonymous attendees", and a global option to allow members of certain security groups to override that setting on a meeting-by-meeting basis. I also long for delegation of meeting owner rights to both the exchange and the s4b sides of things.

 

We have noticed the same (guest) issue too and i have reported it to MS but not heard back from them yet. I agree they need to add a no external users per meeting option when creating meetings and also the ability to temporarily disable chat when in the meeting.

[maxrebo]

Some of them seem to be able to get through without "(Guest)" on the end - Does anyone know why this is? In my testing it appended it with (Guest).

Thanks