Turn off Teams meeting recording by default

Description

Cloud recording is off in the Global meeting policy (AllowCloudRecording = False); only users assigned a custom policy for a documented need can record. For live events, Record an event is not Always record (BroadcastRecordingMode is not AlwaysEnabled).

Rationale

A recording captures everything said and shown, including content shared by external participants, and is stored as a file that follows the recorder's sharing habits and retention. Limiting recording to named users who need it reduces copies of sensitive discussions and makes each recording an expected, governed artifact.

Impact

Users without the custom policy cannot record or, depending on transcription settings, transcribe meetings; people who rely on recordings for absent colleagues or training need the custom policy. Recording for town halls and webinars is controlled separately in events policies (RecordingForTownhall, RecordingForWebinar); align them with this decision.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Meetings > Meeting policies and open the Global (Org-wide default) policy, then every custom policy assigned to users.
3. In the Recording & transcription section, check that Meeting recording is Off in the Global policy, and On only in custom policies assigned to approved users.
4. With Microsoft Teams PowerShell (Global Reader is enough): Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording. For live events: Get-CsTeamsMeetingBroadcastPolicy | Select-Object Identity, BroadcastRecordingMode.
5. Fail if the Global policy returns True, or if Get-CsTeamsMeetingBroadcastPolicy returns AlwaysEnabled for any policy.

Remediation

1. In the Teams admin center, browse to Meetings > Meeting policies and open the Global (Org-wide default) policy.
2. In the Recording & transcription section, set Meeting recording to Off and Save. Role: Teams Administrator.
3. Repeat for each custom policy, unless a documented exception applies to its users.
4. PowerShell equivalent: Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false (repeat with -Identity <policy> for custom policies). Changes can take up to 24 hours to apply.
5. Create a custom meeting policy with recording on and assign it only to approved users.
6. If live events policies still exist, set Record an event to Organizer can record or Never record (Set-CsTeamsMeetingBroadcastPolicy -Identity Global -BroadcastRecordingMode UserOverride).

Rollback

Run Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $true.

References

• Teams meeting recording Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMeetingPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsMeetingBroadcastPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-COLLAB-035 Make end-to-end encryption available for Teams calls Recording is unavailable during end-to-end encrypted calls and meetings.

People and lifecycle