Teams Anonymous access & guest users

[Bennn]

Hi

We're using MS Teams to deliver live lessons within school which is working somewhat well.

 

I've recently disabled Anonymous access within the Teams admin center to prevent anonymous users joining meetings using the meeting URLs - There were some students joining with offensive names.

 

Having done this any external users our SLT or teachers invite to a meeting are struggling to join. The process I am using is as follows;

 

1. Create a guest user in Azure Active Directory.

2. Guest user accepts the invite to join the Org via the email invitation.

3. Ask the user to create their meeting using the New Meeting button within Teams, selecting the guest user created in Azure.

4. Guest clicks the Join meeting button within the meeting invitation email.

 

However, when the guest user clicks Join meeting and enters their name they are greeted by a message that says they aren't part of the org

 

Does anyone know how to prevent this? If you press the Dismiss button it just closes the screen and does nothing.

 

However if you create a meeting without inviting a guest user and paste the meeting link into a browser you see the same message, if you press dismiss it then asks you to sign in.

 

I am assuming it's displaying this message as it doesn't know what Org the user is part of.

 

Does anyone have any ideas?

[Tefters]

I believe from what I have played around with it works as follows:

 

External user has to have a microsoft account and/or office365 account linked to their external email.

You then add them to Azure AD.

They then join via the invite link making sure they are logged into the office365/microsoft account first.

 

 

The account is was testing with had a microsoft account registered to the email and has never signed up for Office365 but if I went to http://www.office.com and logged in with the microsoft account i had a "freebie lite" version of Office365 which I think is used to authenticate with your Azure AD guest account.

Edited January 21, 2021 by Tefters

[Jaymate]

Seems a bit hit and miss who can access when anonymous users is disabled.

 

If you need to use it for both education and the operational side of the school then you need to re-enable it and make sure lobby and meeting settings are secure and that teachers only admit authenticated students and only send invites via teams/channels etc. so students aren't as inclined to share the links (although they will but teachers don't have to admit guests/anonymous users).

 

There is a few user voice on the teams forum you can vote for.

[Tefters]

Seems a bit hit and miss who can access when anonymous users is disabled.

 

If you need to use it for both education and the operational side of the school then you need to re-enable it and make sure lobby and meeting settings are secure and that teachers only admit authenticated students and only send invites via teams/channels etc. so students aren't as inclined to share the links (although they will but teachers don't have to admit guests/anonymous users).

 

There is a few user voice on the teams forum you can vote for.

Tried this approach first, failed miserably...

[maxrebo]

Did this today, thought this was the solution to my problems with the pupils sharing invitations! [emoji22]

Come on MS get the meeting options updated!

[maxrebo]

Turned off Anonymous access and now I`m getting no end of hassle from Staff who have meetings with other school that they cant join.

I`ve got a ticket open with MS to see if there is a way round this, otherwise we will have to turn this back on and T+L will have to suffer again!

[psydii]

Anonymous off; Guest On.

 

This should allow anyone from a Microsoft 365 or Google Workspace organisation to join meetings pretty seemlessly.

 

...including (unfortunately) students from other orgs wanting to zoom-bomb the lesson. Though this does produce a lovely audit trail.

 

You can also create guest who authenticate by responding to an emailed code - this for us *always* works - provided we hold the hand of the guest as they go through the process - on this I am too technically competant to grasp how people can be failing to follow the step-by-step instructions. If we don't help people on it really is 50:50

 

For now, we still have anon on because for now we (The Head) hold(s) out hope that teachers appreciate the benefits (Parent engagement - particularly Parents Evening is widely considered to be much better over Teams), and therfore the hassle of setting and using the lobby correctly is in their own interests. It does help that our Head has a 10yr background in being a DSL, so they are able to hold their line against doomsayers in the staff/unions crying "but what about safeguarding!"

[psydii]

...also I have had more contact with more DSLs and fellow IT bods in the last three weeks than I've had in the last ten years! This is bringing us all together!

[maxrebo]

Anonymous off; Guest On.

 

This should allow anyone from a Microsoft 365 or Google Workspace organisation to join meetings pretty seemlessly.

 

...including (unfortunately) students from other orgs wanting to zoom-bomb the lesson. Though this does produce a lovely audit trail.

 

You can also create guest who authenticate by responding to an emailed code - this for us *always* works - provided we hold the hand of the guest as they go through the process - on this I am too technically competant to grasp how people can be failing to follow the step-by-step instructions. If we don't help people on it really is 50:50

 

For now, we still have anon on because for now we (The Head) hold(s) out hope that teachers appreciate the benefits (Parent engagement - particularly Parents Evening is widely considered to be much better over Teams), and therfore the hassle of setting and using the lobby correctly is in their own interests. It does help that our Head has a 10yr background in being a DSL, so they are able to hold their line against doomsayers in the staff/unions crying "but what about safeguarding!"

Thanks for this.

I think whats happening is the meetings that they had scheduled now pop up saying only people with access to this organisation can join its meetings

 

How do you go about authenticating them via email, as you suggested?

[psydii]

https://docs.microsoft.com/en-us/azure/active-directory/external-identities/one-time-passcode

[maxrebo]

https://docs.microsoft.com/en-us/azure/active-directory/external-identities/one-time-passcode

Thanks - Ive enabled that, does it take a while to take effect?

Attempting to test a Teams meeting between O365 account and Gmail account - but don`t get any OTP prompt?

Edited January 29, 2021 by maxrebo