feat(teams): add new check teams_meeting_dial_in_lobby_bypass_disabled (#7571)

Co-authored-by: Andoni A <14891798+andoniaf@users.noreply.github.com> Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>
2026-07-24 13:01:56 +00:00 · 2025-04-24 19:05:52 +02:00
parent d9782c7b8a
commit d071dea7f7
7 changed files with 189 additions and 0 deletions
@@ -0,0 +1,112 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_teams_meeting_dial_in_lobby_bypass_disabled:
+    def test_no_global_meeting_policy(self):
+        teams_client = mock.MagicMock()
+        teams_client.global_meeting_policy = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_dial_in_lobby_bypass_disabled.teams_meeting_dial_in_lobby_bypass_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_dial_in_lobby_bypass_disabled.teams_meeting_dial_in_lobby_bypass_disabled import (
+                teams_meeting_dial_in_lobby_bypass_disabled,
+            )
+
+            check = teams_meeting_dial_in_lobby_bypass_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_dial_in_users_can_bypass_lobby(self):
+        teams_client = mock.MagicMock()
+        teams_client.audited_tenant = "audited_tenant"
+        teams_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_dial_in_lobby_bypass_disabled.teams_meeting_dial_in_lobby_bypass_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_dial_in_lobby_bypass_disabled.teams_meeting_dial_in_lobby_bypass_disabled import (
+                teams_meeting_dial_in_lobby_bypass_disabled,
+            )
+            from prowler.providers.m365.services.teams.teams_service import (
+                GlobalMeetingPolicy,
+            )
+
+            teams_client.global_meeting_policy = GlobalMeetingPolicy(
+                allow_pstn_users_to_bypass_lobby=True
+            )
+
+            check = teams_meeting_dial_in_lobby_bypass_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "Dial-in users can bypass the lobby."
+            assert result[0].resource == teams_client.global_meeting_policy.dict()
+            assert (
+                result[0].resource_name
+                == "Teams Meetings Global (Org-wide default) Policy"
+            )
+            assert result[0].resource_id == "teamsMeetingsGlobalPolicy"
+
+    def test_dial_in_users_cannot_bypass_lobby(self):
+        teams_client = mock.MagicMock()
+        teams_client.audited_tenant = "audited_tenant"
+        teams_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_microsoft_teams"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.teams.teams_meeting_dial_in_lobby_bypass_disabled.teams_meeting_dial_in_lobby_bypass_disabled.teams_client",
+                new=teams_client,
+            ),
+        ):
+            from prowler.providers.m365.services.teams.teams_meeting_dial_in_lobby_bypass_disabled.teams_meeting_dial_in_lobby_bypass_disabled import (
+                teams_meeting_dial_in_lobby_bypass_disabled,
+            )
+            from prowler.providers.m365.services.teams.teams_service import (
+                GlobalMeetingPolicy,
+            )
+
+            teams_client.global_meeting_policy = GlobalMeetingPolicy(
+                allow_pstn_users_to_bypass_lobby=False
+            )
+
+            check = teams_meeting_dial_in_lobby_bypass_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == "Dial-in users cannot bypass the lobby."
+            assert result[0].resource == teams_client.global_meeting_policy.dict()
+            assert (
+                result[0].resource_name
+                == "Teams Meetings Global (Org-wide default) Policy"
+            )
+            assert result[0].resource_id == "teamsMeetingsGlobalPolicy"
@@ -29,6 +29,7 @@ def mock_get_global_meeting_policy(_):
        allow_anonymous_users_to_join_meeting=False,
        allow_anonymous_users_to_start_meeting=False,
        allow_external_users_to_bypass_lobby="EveryoneInCompanyExcludingGuests",
+        allow_pstn_users_to_bypass_lobby=False,
    )


@@ -124,5 +125,6 @@ class Test_Teams_Service:
                allow_anonymous_users_to_join_meeting=False,
                allow_anonymous_users_to_start_meeting=False,
                allow_external_users_to_bypass_lobby="EveryoneInCompanyExcludingGuests",
+                allow_pstn_users_to_bypass_lobby=False,
            )
            teams_client.powershell.close()