How to Configure Teams Meeting Lobby Bypass Policies in PowerShell Using Set-CsTeamsMeetingPolicy

In enterprise collaboration environments, governing participant admission into corporate meetings is a fundamental security requirement. Without strict virtual lobby controls, confidential discussions—such as board meetings, financial earnings reviews, merger discussions, or HR consultations—are vulnerable to unauthorized attendees, external competitors, or accidental meeting-bombing intrusions. In Microsoft Teams, administrators control meeting entrance workflows through Meeting Policies. Using the Microsoft Teams PowerShell module and the Set-CsTeamsMeetingPolicy cmdlet, tenant administrators can configure granular lobby bypass rules, determine whether dial-in PSTN callers require manual admission, and enforce tenant-wide security boundaries across internal and external meetings.

Understanding Teams Meeting Lobby Admission Architecture

Meeting lobby policies determine whether a participant joins an active audio/video session directly or is routed to a virtual waiting room until admitted by an organizer, co-organizer, or presenter. Key policy attributes include:

• Auto-Admitted Users (AutoAdmittedUsers): Governs which category of participants bypass the lobby automatically:
  • Everyone: All participants, including external guests and anonymous web callers, join directly without waiting in the lobby. Recommended only for public open events.
  • EveryoneInCompany: Internal employees with directory accounts bypass the lobby, while all external attendees and anonymous users wait for admission.
  • EveryoneInCompanyAndFederatedOrganizations: Permits internal employees and authenticated users from federated external organizations to join directly.
  • InvitedUsers: Only participants explicitly listed in the meeting invitation join directly; uninvited attendees must wait in the lobby.
  • OrganizerOnly: Forces all attendees (internal and external) into the virtual lobby until the meeting organizer joins and admits them. Essential for sensitive executive consultations.
• PSTN Caller Bypass (AllowPSTNUsersToBypassLobby): Controls whether callers joining via standard telephone dial-in numbers bypass the virtual lobby. Because caller ID over PSTN can be spoofed, security best practices recommend requiring manual admission for phone callers in high-security environments.
• Dial-In Announcement Settings: Governs whether automated audio chimes or caller name recordings announce dial-in arrivals when participants enter or leave the lobby.

Prerequisites and PowerShell Session Initialisation

Managing Teams meeting policies requires the Microsoft Teams PowerShell module with the Teams Administrator or Global Administrator role assigned in Microsoft Entra ID.

Install or verify the latest Microsoft Teams module version:

Get-Module -ListAvailable -Name MicrosoftTeams
Install-Module -Name MicrosoftTeams -Scope CurrentUser -Repository PSGallery -Force

Establish an authenticated remote management session:

Connect-MicrosoftTeams

Confirm the connection by verifying cmdlet availability:

Get-Command *TeamsMeetingPolicy*

Inspecting Existing Meeting Lobby Bypass Configurations

Before applying custom policies, inspect the current lobby bypass settings configured on the default Global policy and existing custom policies.

Retrieve all defined meeting policies across the tenant:

Get-CsTeamsMeetingPolicy

Query specifically for lobby admission parameters on the tenant Global policy:

Get-CsTeamsMeetingPolicy -Identity Global | Select-Object Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby, EnableDialInBypass, LiveCaptionsEnabledType

In default tenant environments, AutoAdmittedUsers is typically configured to EveryoneInCompany, while PSTN bypass is disabled to prevent unverified phone callers from entering meetings unannounced.

Creating a High-Security Executive Meeting Policy

To enforce strict confidentiality for board members, finance directors, and legal counsel, create a dedicated high-security policy using New-CsTeamsMeetingPolicy.

Create a custom policy that forces all participants into the lobby until admitted by the organizer, and strictly blocks PSTN caller bypass:

New-CsTeamsMeetingPolicy -Identity "Executive-StrictLobby-Policy" -Description "Strict lobby enforcement: all attendees wait in lobby; PSTN callers require manual admission." -AutoAdmittedUsers "OrganizerOnly" -AllowPSTNUsersToBypassLobby $false

Confirm the creation of the new policy instance:

Get-CsTeamsMeetingPolicy -Identity "Executive-StrictLobby-Policy" | Format-List Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby

Modifying Lobby Bypass Settings on Existing Policies

To update existing departmental or global policies, use Set-CsTeamsMeetingPolicy to adjust operational parameters.

To update an existing sales collaboration policy to allow federated external business partners to bypass the lobby automatically while keeping anonymous callers waiting:

Set-CsTeamsMeetingPolicy -Identity "Sales-ExternalCollaboration" -AutoAdmittedUsers "EveryoneInCompanyAndFederatedOrganizations" -AllowPSTNUsersToBypassLobby $false

To update the tenant Global default policy to ensure all dial-in phone participants must be admitted manually by meeting hosts:

Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false

Verify that the updated lobby directives are committed to the tenant:

Get-CsTeamsMeetingPolicy -Identity "Sales-ExternalCollaboration" | Select-Object Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby

Assigning Meeting Policies to Users and Groups

Once custom lobby policies are defined, assign them to individual executives or deploy them across enterprise units using Microsoft Entra security groups.

To assign the strict executive policy directly to an individual user:

Grant-CsTeamsMeetingPolicy -Identity "[email protected]" -PolicyName "Executive-StrictLobby-Policy"

Verify that the policy was bound successfully to the user’s account:

Get-CsOnlineUser -Identity "[email protected]" | Select-Object UserPrincipalName, TeamsMeetingPolicy

To deploy the policy to all executive leadership accounts using Group Policy Assignment:

$GroupId = (Get-AzureADGroup -SearchString "Executive Leadership Group").ObjectId
New-CsGroupPolicyAssignment -GroupId $GroupId -PolicyType TeamsMeetingPolicy -PolicyName "Executive-StrictLobby-Policy" -Rank 1

To revert a user to the default tenant Global meeting policy:

Grant-CsTeamsMeetingPolicy -Identity "[email protected]" -PolicyName $null

Troubleshooting Policy Propagation and Meeting Overrides

When auditing meeting lobby behaviour across enterprise tenants, keep these diagnostic factors in mind:

• Client Replication Window: Meeting policy changes propagate through Microsoft 365 regional directory services within 2 to 4 hours. Prompting users to log out and restart Teams accelerates policy refreshes.
• Meeting-Level Organizer Overrides: Meeting policies establish the default template presented when scheduling a meeting. However, if AllowMeetingOptionsOverrides is enabled in the meeting policy, organizers can adjust lobby settings for individual calendar events inside the Teams client Meeting Options window.
• PSTN Caller Identification: When PSTN bypass is disabled, dial-in callers appear in the Teams roster as their masked phone number (e.g. “+1 415-***-0199”). Presenters must manually click “Admit” in the Participants pane to bring the phone caller into the meeting audio bridge.

By configuring lobby bypass policies in PowerShell with Set-CsTeamsMeetingPolicy, enterprise administrators safeguard corporate confidentiality, prevent uninvited meeting intrusions, and enforce rigorous governance across Microsoft Teams meetings.