Microsoft adds new checks to stop uninvited bots joining Teams meetings

Microsoft is rolling out a new mechanism in Teams designed to reduce the chance of automated services entering meetings without permission.

The company said the change was prompted by situations in which bots connected through third-party services kept showing up in later meetings after a user had linked them once. Microsoft warned that this can create privacy and security concerns, especially when meetings involve confidential or sensitive topics.

How the new system works

Under the updated approach, a bot will not be allowed straight into a meeting. Instead, it will be held in the lobby first, where a human participant can review the request and decide whether to admit it. Microsoft said the process is meant to make bot admission intentional rather than automatic.

To improve detection, the company said Teams now uses a mix of behavioral and infrastructure-based signals to better tell human users apart from automated participants. Microsoft acknowledged that this will not identify every bot with complete certainty, but said it should make unauthorized entry more difficult.

At the same time, Microsoft plans to create a registration process for independent software vendors that build meeting-related experiences for Teams. Vendors that register will be able to add a self-identification marker to their join requests, allowing Teams to recognize approved bots as known participants.

What it means for developers and users

Microsoft said it is testing the feature with a limited set of software partners before making it more widely available. Further details about the registration process are expected later.

• Bots will be routed through the lobby instead of joining automatically.
• A person will need to approve the bot before it enters the meeting.
• Teams will use additional signals to identify bot activity.
• Registered vendors will be able to mark approved bots for easier recognition.
• Microsoft said it will eventually phase out the CAPTCHA-based checks it currently uses for this purpose.

The change gives Microsoft greater control over which automated tools can join Teams meetings, while also creating a clearer path for legitimate third-party services that need access.