Rules: Microsoft Teams Guest Access Enabled
Microsoft Teams Guest Access has been enabled globally, this settings allows any users that are external to your Teams/Office organization to be invited into your Teams/Office organization. If this setting change is unplanned or unexpected it is recommended that this activity be reviewed. MIcrosoft Teams provides administrators the ability to allow only specific guest actions to take place within the Teams/Office organization.
| Detail | Value |
|---|---|
| Type | Templated Match |
| Category | Initial Access |
| Apply Risk to Entities | device_ip |
| Signal Name | Microsoft Teams Guest Access Enabled by {{user_userId}} |
| Summary Expression | Microsoft Team Guest Access has been enabled by {{user_userId}} |
| Score/Severity | Static: 4 |
| Enabled by Default | True |
| Prototype | False |
| Tags | _mitreAttackTactic:TA0001, _mitreAttackTechnique:T1566 |
| Origin | Field |
|---|---|
| Normalized Schema | action |
| Normalized Schema | device_ip |
| Direct from Record | fields["ModifiedProperties.1.Name"] |
| Direct from Record | fields["ModifiedProperties.1.NewValue"] |
| Normalized Schema | metadata_product |
| Normalized Schema | user_userId |