Microsoft Teams blocks sneaky bots with new lobby policy

Meeting organizers now face a stricter security environment as Microsoft Teams introduces new mechanisms to detect and control external bots. This change matters because it shifts the burden of verification from automated guesswork to explicit human approval, reducing the risk of unauthorized software disrupting meetings. Users should expect more friction when bots attempt to join, but also greater confidence that the participants list contains only verified entities.

New policy places external bots in a lobby for manual approval

The core of this update is a new admin policy called 'Manage external bots and their access to meetings'. This policy gives meeting organizers direct control over how external bots interact with their sessions. Teams will use infrastructure signals to distinguish between human users and automated bots, allowing the system to apply specific rules based on the participant type.

By default, the new policy sets the bot admission mode to 'When detected, require approval before joining'. This places external bots in a lobby until an organizer explicitly allows them into the meeting. The interface changes to remove the one-click 'Admit' option for bots, requiring organizers to confirm each admission individually. Microsoft is also adding warnings when an organizer attempts to admit all participants at once to prevent accidental bulk approvals.

Microsoft plans to retire the current CAPTCHA verification implementation for bots in favor of these new infrastructure-based signals. The company intends to trial a registration system for Independent Software Vendors to mark bots as 'known' entities. Future updates will likely include allow-lists, organization-wide policies, and detailed admin reports to track bot activity. These measures aim to categorize bots as either 'trusted' or 'suspected threats' to help organizers make informed decisions.

We looked at the last microsoft teams update earlier while tracking efficiency improvements for low-spec devices. The current rollout focuses on security and bot management rather than performance optimization. Microsoft continues to refine the platform's access controls to address enterprise security concerns. The changes are now available as part of the standard software update cycle.