feat(teams): add new check teams_meeting_chat_anonymous_users_disabled (#7579)

Co-authored-by: Andoni A <14891798+andoniaf@users.noreply.github.com>
Co-authored-by: MrCloudSec <hello@mistercloudsec.com>

prowler/CHANGELOG.md

@@ -30,6 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Add new check `teams_meeting_anonymous_user_start_disabled` [(#7567)](https://github.com/prowler-cloud/prowler/pull/7567)
 - Add new check `teams_meeting_external_lobby_bypass_disabled` [(#7568)](https://github.com/prowler-cloud/prowler/pull/7568)
 - Add new check `teams_meeting_dial_in_lobby_bypass_disabled` [(#7571)](https://github.com/prowler-cloud/prowler/pull/7571)
+- Add new check `teams_meeting_chat_anonymous_users_disabled` [(#7579)](https://github.com/prowler-cloud/prowler/pull/7579)
 
 ### Fixed
 

prowler/providers/m365/services/teams/teams_meeting_chat_anonymous_users_disabled/teams_meeting_chat_anonymous_users_disabled.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "m365",
+  "CheckID": "teams_meeting_chat_anonymous_users_disabled",
+  "CheckTitle": "Ensure meeting chat does not allow anonymous users",
+  "CheckType": [],
+  "ServiceName": "teams",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "critical",
+  "ResourceType": "Teams Global Meeting Policy",
+  "Description": "Ensure meeting chat does not allow anonymous users.",
+  "Risk": "Allowing anonymous users to participate in meeting chat can expose sensitive information and increase the risk of inappropriate content being shared by unverified participants.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy?view=teams-ps",
+  "Remediation": {
+    "Code": {
+      "CLI": "Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType 'EnabledExceptAnonymous'",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click to expand Meetings select Meeting policies. 3. Click Global (Org-wide default). 4. Under meeting engagement verify that Meeting chat is set to On for everyone but anonymous users.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Restrict chat access during meetings to only authenticated and authorized users. Disable chat capabilities for anonymous users to maintain confidentiality and prevent misuse.",
+      "Url": "https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy?view=teams-ps"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/m365/services/teams/teams_meeting_chat_anonymous_users_disabled/teams_meeting_chat_anonymous_users_disabled.py

@@ -0,0 +1,48 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.teams.teams_client import teams_client
+
+
+class teams_meeting_chat_anonymous_users_disabled(Check):
+    """Check if meeting chat does not allow anonymous users.
+
+    Attributes:
+        metadata: Metadata associated with the check (inherited from Check).
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        """Execute the check for meeting chat does not allow anonymous users.
+
+        This method checks if meeting chat does not allow anonymous users.
+
+        Returns:
+            List[CheckReportM365]: A list of reports containing the result of the check.
+        """
+        findings = []
+        global_meeting_policy = teams_client.global_meeting_policy
+        if global_meeting_policy:
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=global_meeting_policy if global_meeting_policy else {},
+                resource_name="Teams Meetings Global (Org-wide default) Policy",
+                resource_id="teamsMeetingsGlobalPolicy",
+            )
+            report.status = "FAIL"
+            report.status_extended = "Meeting chat allows anonymous users."
+
+            allowed_meeting_chat_settings = {
+                "EnabledExceptAnonymous",
+                "EnabledInMeetingOnlyForAllExceptAnonymous",
+            }
+
+            if (
+                global_meeting_policy.meeting_chat_enabled_type
+                in allowed_meeting_chat_settings
+            ):
+                report.status = "PASS"
+                report.status_extended = "Meeting chat does not allow anonymous users."
+
+            findings.append(report)
+
+        return findings

prowler/providers/m365/services/teams/teams_service.py

@@ -58,6 +58,9 @@ class Teams(M365Service):
                     allow_pstn_users_to_bypass_lobby=global_meeting_policy.get(
                         "AllowPSTNUsersToBypassLobby", True
                     ),
+                    meeting_chat_enabled_type=global_meeting_policy.get(
+                        "MeetingChatEnabledType", "EnabledForEveryone"
+                    ),
                 )
         except Exception as error:
             logger.error(
@@ -103,6 +106,7 @@ class GlobalMeetingPolicy(BaseModel):
     allow_anonymous_users_to_start_meeting: bool = True
     allow_external_users_to_bypass_lobby: str = "Everyone"
     allow_pstn_users_to_bypass_lobby: bool = True
+    meeting_chat_enabled_type: str = "EnabledForEveryone"
 
 
 class UserSettings(BaseModel):

tests/providers/m365/services/teams/teams_meeting_chat_anonymous_users_disabled/teams_meeting_chat_anonymous_users_disabled_test.py

@@ -0,0 +1,159 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_teams_meeting_chat_anonymous_users_disabled:
+    def test_no_global_meeting_policy(self):
+        teams_client = mock.MagicMock()
+        teams_client.global_meeting_policy = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled import (
+                teams_meeting_chat_anonymous_users_disabled,
+            )
+
+            check = teams_meeting_chat_anonymous_users_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_meeting_chat_allows_anonymous_users(self):
+        teams_client = mock.MagicMock()
+        teams_client.audited_tenant = "audited_tenant"
+        teams_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled import (
+                teams_meeting_chat_anonymous_users_disabled,
+            )
+            from prowler.providers.m365.services.teams.teams_service import (
+                GlobalMeetingPolicy,
+            )
+
+            teams_client.global_meeting_policy = GlobalMeetingPolicy(
+                meeting_chat_enabled_type="EnabledForEveryone"
+            )
+
+            check = teams_meeting_chat_anonymous_users_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "Meeting chat allows anonymous users."
+            assert result[0].resource == teams_client.global_meeting_policy.dict()
+            assert (
+                result[0].resource_name
+                == "Teams Meetings Global (Org-wide default) Policy"
+            )
+            assert result[0].resource_id == "teamsMeetingsGlobalPolicy"
+
+    def test_meeting_chat_does_not_allow_anonymous_users_enabled_except_anonymous(self):
+        teams_client = mock.MagicMock()
+        teams_client.audited_tenant = "audited_tenant"
+        teams_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled import (
+                teams_meeting_chat_anonymous_users_disabled,
+            )
+            from prowler.providers.m365.services.teams.teams_service import (
+                GlobalMeetingPolicy,
+            )
+
+            teams_client.global_meeting_policy = GlobalMeetingPolicy(
+                meeting_chat_enabled_type="EnabledExceptAnonymous"
+            )
+
+            check = teams_meeting_chat_anonymous_users_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Meeting chat does not allow anonymous users."
+            )
+            assert result[0].resource == teams_client.global_meeting_policy.dict()
+            assert (
+                result[0].resource_name
+                == "Teams Meetings Global (Org-wide default) Policy"
+            )
+            assert result[0].resource_id == "teamsMeetingsGlobalPolicy"
+
+    def test_meeting_chat_does_not_allow_anonymous_users_enabled_in_meeting_only(self):
+        teams_client = mock.MagicMock()
+        teams_client.audited_tenant = "audited_tenant"
+        teams_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_chat_anonymous_users_disabled.teams_meeting_chat_anonymous_users_disabled import (
+                teams_meeting_chat_anonymous_users_disabled,
+            )
+            from prowler.providers.m365.services.teams.teams_service import (
+                GlobalMeetingPolicy,
+            )
+
+            teams_client.global_meeting_policy = GlobalMeetingPolicy(
+                meeting_chat_enabled_type="EnabledInMeetingOnlyForAllExceptAnonymous"
+            )
+
+            check = teams_meeting_chat_anonymous_users_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Meeting chat does not allow anonymous users."
+            )
+            assert result[0].resource == teams_client.global_meeting_policy.dict()
+            assert (
+                result[0].resource_name
+                == "Teams Meetings Global (Org-wide default) Policy"
+            )
+            assert result[0].resource_id == "teamsMeetingsGlobalPolicy"

tests/providers/m365/services/teams/teams_service_test.py

@@ -30,6 +30,7 @@ def mock_get_global_meeting_policy(_):
         allow_anonymous_users_to_start_meeting=False,
         allow_external_users_to_bypass_lobby="EveryoneInCompanyExcludingGuests",
         allow_pstn_users_to_bypass_lobby=False,
+        meeting_chat_enabled_type="EnabledExceptAnonymous",
     )
 
 
@@ -126,5 +127,6 @@ class Test_Teams_Service:
                 allow_anonymous_users_to_start_meeting=False,
                 allow_external_users_to_bypass_lobby="EveryoneInCompanyExcludingGuests",
                 allow_pstn_users_to_bypass_lobby=False,
+                meeting_chat_enabled_type="EnabledExceptAnonymous",
             )
             teams_client.powershell.close()