Microsoft Teams adds admin controls to block external AI bots
A new meeting protection policy allows IT admins to automatically prevent unauthorized third-party recording and transcription tools from joining corporate calls.
Microsoft is introducing a new meeting protection policy for Teams that enables administrators to automatically block identified external bots from joining meetings. The update is designed to stop unauthorized AI tools and recording bots from entering corporate calls without explicit permission.
According to BleepingComputer, administrators can now implement a centralized policy to block all identified external bots. This control is managed through the 'Manage external bots and their access to meetings' section within the Teams admin center. For those preferring command-line management, the feature is also accessible via the Set-CsTeamsMeetingPolicy PowerShell cmdlet using the ExternalBotAccessMode attribute.
The rise of bot-bombing
This rollout comes as organizations struggle with the proliferation of AI meeting assistants and automated transcription tools. Many enterprises have faced challenges with "bot-bombing" or the unauthorized recording of private corporate discussions. Previously, managing these external entities often required manual intervention by meeting hosts or the configuration of complex, granular permission settings that were difficult to enforce at scale.
Closing the security gap
This update addresses a critical security gap where external AI tools could potentially scrape sensitive data or record meetings without the knowledge of all participants. By providing a centralized administrative toggle, Microsoft allows enterprises to enforce strict data governance and privacy standards across their entire tenant. This ensures that sensitive organizational communications remain private and that only sanctioned tools are permitted to process meeting data.
What to watch
While the policy targets external third-party bots, internal sanctioned AI tools, such as Microsoft Copilot, continue to function. Organizations will now need to decide whether to implement a blanket ban on external bots or maintain a more permissive environment for specific third-party integrations. It remains to be seen how bot developers will adapt their joining mechanisms to bypass these new administrative hurdles.