Make end-to-end encryption available for Teams calls

Description

The Global enhanced encryption policy lets users turn on end-to-end encryption (E2EE) for one-to-one calls (End-to-end call encryption = Not enabled, but users can enable, CallingEndtoEndEncryptionEnabledType = DisabledUserOverride). Where organizers have Teams Premium, End-to-end meeting encryption is also available (MeetingEndToEndEncryption = DisabledUserOverride).

E2EE stays opt-in: users switch it on in their Teams settings, or meeting templates and sensitivity labels enforce it for sensitive meetings.

Rationale

Standard Teams encryption protects media in transit and at rest but the service can decrypt it. End-to-end encryption keeps the keys on the endpoints, so audio, video and screen sharing of a sensitive call cannot be read by the service or by someone with privileged access to it. Making it available lets people who handle sensitive matters use it when they need it.

Impact

During an end-to-end encrypted call or meeting, recording, live captions and transcription, Copilot, call transfer and merge, breakout rooms, PowerPoint Live and PSTN dial-in are unavailable. Users subject to compliance recording cannot use E2EE. Teams on the web and VDI cannot join encrypted meetings. Train users to keep E2EE for calls that need it.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Enhanced encryption policies and open the Global (Org-wide default) policy and the custom policies assigned to users.
3. Check that End-to-end call encryption is Not enabled, but users can enable (and, with Teams Premium, that End-to-end meeting encryption is the same).
4. With Microsoft Teams PowerShell: Get-CsTeamsEnhancedEncryptionPolicy | Select-Object Identity, CallingEndtoEndEncryptionEnabledType, MeetingEndToEndEncryption.
5. Fail if CallingEndtoEndEncryptionEnabledType is Disabled in the Global policy.

Remediation

1. In the Teams admin center, browse to Enhanced encryption policies, open the Global (Org-wide default) policy, set End-to-end call encryption to Not enabled, but users can enable and Save. Role: Teams Administrator.
2. PowerShell equivalent: Set-CsTeamsEnhancedEncryptionPolicy -Identity Global -CallingEndtoEndEncryptionEnabledType DisabledUserOverride.
3. Tell users how to turn on end-to-end encrypted calling and when to use it.

References

• Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls Microsoft, vendor-doc, accessed 2026-10-24
• Set-CsTeamsEnhancedEncryptionPolicy Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-031 Turn off Teams meeting recording by default

People and lifecycle