If your team relies on an AI meeting assistant to transcribe, take notes, or record your video calls, you may soon find that bot waiting in the lobby—unable to join until a human lets it in. Microsoft has switched on a new default policy across Teams that detects and holds external bots for manual approval, retiring the old CAPTCHA-based gate. The change is already in effect; the window to adjust your workflows before legacy controls vanish entirely closes by late July 2026.
The New Bot Barrier in Plain English
Microsoft now gives administrators a simple binary switch for external meeting bots: RequireApprovalWhenDetected (the default) or AllowBots. Under the default, Teams actively identifies third-party meeting assistants—transcription services, AI notetakers, compliance capture tools, and similar bots—and routes them to the lobby, no matter how the meeting’s usual lobby rules are set. Even if your meetings normally let external guests bypass the lobby, a detected bot will still be held until an organizer or co-organizer explicitly admits it.
During admission, organizers see a reminder about the potential risks—data leakage, recording without consent, or storage outside compliance boundaries—before they click “admit.” If a human is misidentified as a bot, the meeting host can correct the classification with a “This is not a bot” option, which fixes the participant’s status for that meeting only.
Microsoft’s detection runs on a combination of infrastructural and behavioral signals collected during the join process. It is not a vendor allowlist; it’s an automated gate that catches what it can and lets the rest through under ordinary lobby rules. The company acknowledges the system is not perfect: some external bots may go unnoticed, and occasionally a legitimate human participant might be flagged.
Who’s Impacted and How
Everyday meeting organizers: You’ll notice new visuals in the lobby list—participants marked as detected bots. You must actively admit them, which adds a brief but deliberate security check. If you’re not the organizer or co-organizer, you may not have permission to admit anyone; Microsoft recommends that only those roles can do so to avoid accidental approvals.
Power users and department leads: Any unattended automation that depends on a bot joining a Teams meeting—say, your weekly board meeting automatically captured by a transcription service—will break unless someone is assigned to approve the bot. Bots that join without an organizer present, or late at night for a recorded call, will remain stuck in the lobby indefinitely.
IT administrators: The retirement of the legacy CAPTCHA policy isn’t just a cosmetic cleanup. It removes a familiar safety net. The PowerShell commands that control the old policy will stop working by late July 2026; the admin center toggle will disappear by late August, according to Microsoft’s advisory MC1262588, as first reported by WindowsForum. If your organization hasn’t migrated to the new bot policy by then, you could be left either with the default lobby hold or a rushed global AllowBots setting that disables detection entirely.
How We Got Here—and Why CAPTCHA Is Gone
For years, Teams used a CAPTCHA mechanism to gate external meeting joins. It was a blunt instrument designed to block bots and automated attack scripts, but it didn’t distinguish between a malicious bot and a legitimate third-party assistant. As meeting assistants grew in popularity, Microsoft added more nuanced controls, eventually landing on the current bot-detection framework.
The security rationale is straightforward: untrusted external bots can record meetings, siphon conversation data, and store it outside your organization’s compliance boundaries without the meeting organizer ever knowing. By forcing a human gate, Microsoft places awareness at the point of entry—no one accidentally lets in a bot they didn’t approve.
What Admins Should Do Right Now
Resist the temptation to flip the switch globally to AllowBots just because a few critical workflows rely on unattended joins. That restores seamless behavior but disables detection for every meeting governed by the policy, opening the door to unknown risks.
1. Inventory Your Bot Joins
List every workflow that causes an external process to enter a Teams meeting. Include:
- Third-party AI notetakers (Fireflies, Otter.ai, etc.)
- Transcription and recording services
- Compliance capture tools
- Automated support agents
- Meeting-room integrations that present as external participants
For each, note the typical meeting organizer population—the detective policy is tied to meeting hosts, so the same bot can be treated differently depending on who organized the call.
2. Test and Classify Each Workflow
Create a test meeting with a representative organizer and the external service. Determine:
- Is the bot detected and placed in the lobby?
- Is the workflow genuinely unattended, or is a human always available to admit it?
- Who, in practice, would be authorized to admit lobby participants? Microsoft recommends restricting this to organizers and co-organizers, which may require policy changes beyond the bot setting.
3. Choose a Path: Keep, Redesign, or Replace
If the bot is never detected and joins normally, you can leave it as is—but document this thoroughly and retest after service updates or Teams policy changes. Microsoft’s detection is not a guarantee of permanent immunity.
If the bot is detected but a human can reliably admit it, redesign the workflow to require a named approver at join time. This works well for scheduled meetings with a present organizer; it fails for overnight automation or events with rotating hosts. Write a runbook for missed approvals.
If the bot is detected and no human can consistently admit it, replace the bot with an authenticated, Teams-native alternative or refactor the business process. Many note-taking and transcription needs can be met without an external attendee-style bot—consider Graph APIs, Teams recording policies, or post-meeting AI processing that doesn’t require a live join.
Setting Up the Policy: Admin Center and PowerShell
Configure the new bot policy in the Teams admin center before touching the organization-wide default.
- Go to Meetings > Meeting policies.
- Select the policy assigned to a pilot group of organizers, or create a new targeted policy.
- Under Meeting Join and Lobby, find Manage external bots and their access to meetings.
- Choose When detected, require approval before joining (the default) or Do not detect bots (AllowBots).
- Assign the policy and run real-world meetings with the actual automation service and a designated approver.
The corresponding PowerShell attribute is ExternalBotAccessMode. However, Microsoft’s documentation currently shows conflicting cmdlets—Set-CsTeamsMeetingPolicy in one section and Set-CsTeamsEventsPolicy in an example. Before scripting any changes, verify the correct cmdlet with your installed Teams PowerShell module and Microsoft’s live documentation. The durable intent is to set the ExternalBotAccessMode parameter to RequireApprovalWhenDetected or AllowBots on the appropriate meeting policy object.
Don’t Rely on Bot Detection Alone
Detection is an imperfect gate, not a security boundary. Some bots will slip through; some people will be flagged. Treat the lobby approval as a human checkpoint that reduces risk but doesn’t eliminate it.
Also, there is no documented per-bot allowlist in the current policy model—only the binary choice. If you need to exempt a specific third-party assistant, your best option is a targeted meeting policy scoped to a minimal set of organizers whose workflows have been tested and accepted. That keeps the default approval requirement in place for everyone else.
What’s Next
Microsoft will retire the old CAPTCHA PowerShell controls by late July 2026 and remove the admin center toggle in August, making the new bot policy the only mechanism. The company continues to tune its detection algorithms, so behavior may shift. Admins should plan to revisit their bot inventory and policy assignments quarterly, especially after major Teams updates.
For organizations that act now, the transition is a chance to harden meeting security without losing legitimate automation. For those that wait until the CAPTCHA switch is gone, the day of reckoning will be the first meeting where a critical bot sits alone in the lobby with no one available to let it in.