{
  "id": "CB-M365-COLLAB-031",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-031",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-031.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-031.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-031",
    "title": "Turn off Teams meeting recording by default",
    "finding": {
      "title": "Every user can record Teams meetings",
      "description": "Recordings and transcripts of confidential meetings are created freely and stored in OneDrive or SharePoint, where they can be shared further."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "meetings",
      "recording",
      "data-protection"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "Cloud recording is off in the Global meeting policy (`AllowCloudRecording` = `False`); only users\nassigned a custom policy for a documented need can record. For live events, **Record an event** is\nnot **Always record** (`BroadcastRecordingMode` is not `AlwaysEnabled`).\n",
    "rationale": "A recording captures everything said and shown, including content shared by external participants,\nand is stored as a file that follows the recorder's sharing habits and retention. Limiting recording\nto named users who need it reduces copies of sensitive discussions and makes each recording an\nexpected, governed artifact.\n",
    "impact": "Users without the custom policy cannot record or, depending on transcription settings, transcribe\nmeetings; people who rely on recordings for absent colleagues or training need the custom policy.\nRecording for town halls and webinars is controlled separately in events policies\n(`RecordingForTownhall`, `RecordingForWebinar`); align them with this decision.\n",
    "setting": {
      "location": "Teams admin center > Meetings > Meeting policies > Recording & transcription > Meeting recording",
      "default_value": "On",
      "recommended_value": "Off in the Global policy (AllowCloudRecording = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Meetings** > **Meeting policies** and open the **Global (Org-wide default)** policy,\n   then every custom policy assigned to users.\n3. In the **Recording & transcription** section, check that **Meeting recording** is **Off** in the\n   Global policy, and **On** only in custom policies assigned to approved users.\n4. With Microsoft Teams PowerShell (Global Reader is enough):\n   `Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording`. For live events:\n   `Get-CsTeamsMeetingBroadcastPolicy | Select-Object Identity, BroadcastRecordingMode`.\n5. Fail if the Global policy returns `True`, or if `Get-CsTeamsMeetingBroadcastPolicy` returns\n   `AlwaysEnabled` for any policy.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Meetings** > **Meeting policies** and open the **Global\n   (Org-wide default)** policy.\n2. In the **Recording & transcription** section, set **Meeting recording** to **Off** and **Save**.\n   Role: Teams Administrator.\n3. Repeat for each custom policy, unless a documented exception applies to its users.\n4. PowerShell equivalent: `Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false`\n   (repeat with `-Identity <policy>` for custom policies). Changes can take up to 24 hours to apply.\n5. Create a custom meeting policy with recording on and assign it only to approved users.\n6. If live events policies still exist, set **Record an event** to **Organizer can record** or\n   **Never record** (`Set-CsTeamsMeetingBroadcastPolicy -Identity Global -BroadcastRecordingMode\n   UserOverride`).\n",
      "rollback": "Run `Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $true`.\n"
    },
    "references": [
      {
        "title": "Teams meeting recording",
        "url": "https://learn.microsoft.com/microsoftteams/meeting-recording",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMeetingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsMeetingBroadcastPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsmeetingbroadcastpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.1.6v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.1.7v2",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-42",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-035",
        "type": "related",
        "note": "Recording is unavailable during end-to-end encrypted calls and meetings."
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}