Microsoft Teams Now Lets US Admins Block External Bots from Meetings

Introduction

Microsoft has announced a powerful new Teams meeting protection policy that allows administrators to automatically block all identified external bots from joining Teams meetings. This feature is a game-changer for US businesses looking to strengthen their meeting security and protect against social engineering attacks.

Rolling out as part of a targeted release until the end of August, the policy should reach general availability worldwide by late September. For US organizations, this means enhanced control over who — and what — can join your Teams meetings.

What's New: Automatic Bot Blocking

In June 2026, Microsoft introduced smarter bot protection that tagged detected bots in the lobby and required organizer approval before joining. The new policy goes one step further — it automatically prevents external bots from joining Teams meetings without requiring explicit organizer confirmation.

This change ensures that third-party bots — which can have various uses, from note-taking and transcription to other automated tasks — and malicious apps controlled by threat actors cannot join Teams meetings without attendees and organizers realizing that a non-human participant has been added.

Why This Matters for US Businesses

US companies are prime targets for cyberattacks. Here's why this new Teams policy is critical for American organizations:

• Ransomware attacks are at an all-time high — US businesses are the #1 target for ransomware groups worldwide.
• Social engineering attacks are surging — threat actors are impersonating IT or helpdesk staff to contact employees via cross-tenant chats.
• Remote work is still the norm — many US companies operate hybrid or fully remote workforces, making Teams meetings a critical attack vector.
• Regulatory compliance — US industries like healthcare, finance, and government have strict security requirements that this policy helps address.
• Financial impact — the average cost of a data breach in the US is $9.48 million, the highest in the world.

How the New Teams Bot Policy Works

The new admin policy is available under the "Manage bots" meeting protection settings in the Teams admin center. Key details include:

• Off by default — requires admin activation and evaluation before deployment
• Granular assignment — can be assigned to specific users or groups through existing Teams meeting policy management
• Automatic blocking — all identified external meeting bots will be blocked from joining meetings governed by the newly assigned policy
• No organizer action required — unlike the previous policy that required organizer approval, this automatically blocks bots

The Growing Threat of Teams Social Engineering Attacks

Microsoft has been actively warning about the surge in Teams-based attacks. Here's what US businesses need to know:

• Threat actors are impersonating IT staff — attackers contact employees via cross-tenant chats, pretending to be helpdesk personnel.
• Social engineering tactics — attackers trick employees into granting remote access, sharing credentials, or approving MFA requests.
• Ransomware groups are involved — these attacks are not just opportunistic; they are orchestrated by sophisticated ransomware gangs.
• Lateral movement — once inside, attackers use Teams to move laterally across the enterprise network.

Since December 2025, admins have been able to block external Teams users via the Defender portal to thwart these attacks. The new bot-blocking policy adds another critical layer of defense.

How US Admins Can Enable This Policy

Here's a step-by-step guide for US IT administrators to enable the new Teams bot-blocking policy:

1. Access the Teams admin center at admin.teams.microsoft.com
2. Navigate to Meeting Policies under Meetings > Meeting Policies
3. Find "Manage bots" under the meeting protection settings
4. Enable the policy — toggle it on for your organization or specific user groups
5. Test and evaluate — Microsoft recommends testing the policy before broad deployment
6. Monitor audit logs — use admin reports and audit logs to track bot detection and policy effectiveness

Future Updates: More Bot Controls Coming

As announced in June 2026, Microsoft is planning to add additional admin controls, including:

• Policies to block external bots entirely — complete restriction of all external bots
• Allow lists for approved bots — whitelist specific third-party bots that your organization trusts
• Admin reports and audit logs — detailed visibility into bot detection and presence in meetings
• More granular controls — different security requirements for different user groups

US organizations should start planning now for these additional controls to ensure comprehensive Teams security.

Final Thoughts

Microsoft's new Teams policy to automatically block external bots is a critical security enhancement for US businesses. With attacks surging and threat actors increasingly targeting Teams as an entry point, this feature provides much-needed protection.

Key takeaways for US organizations:

• The new policy automatically blocks external bots without requiring organizer approval
• It's off by default — US admins must enable it to benefit from the protection
• Teams-based social engineering attacks are surging, especially targeting US companies
• The policy adds a critical layer of defense against unauthorized bot access
• Additional controls, including allow lists and audit logs, are coming soon
• US businesses must act now to secure their Teams environment

If you need help securing your Microsoft Teams environment or want to learn more about protecting your US business from cyber threats, contact SystemLogicIT for a free security assessment.