{
  "id": "CB-M365-COLLAB-035",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-035",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-035.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-035.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-035",
    "title": "Make end-to-end encryption available for Teams calls",
    "finding": {
      "title": "Users cannot turn on end-to-end encryption for Teams calls",
      "description": "Sensitive one-to-one calls rely only on service-side encryption, so their media is readable by the service during processing."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "encryption",
      "calls",
      "meetings"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "The Global enhanced encryption policy lets users turn on end-to-end encryption (E2EE) for one-to-one\ncalls (**End-to-end call encryption** = **Not enabled, but users can enable**,\n`CallingEndtoEndEncryptionEnabledType` = `DisabledUserOverride`). Where organizers have Teams\nPremium, **End-to-end meeting encryption** is also available (`MeetingEndToEndEncryption` =\n`DisabledUserOverride`).\n\nE2EE stays opt-in: users switch it on in their Teams settings, or meeting templates and sensitivity\nlabels enforce it for sensitive meetings.\n",
    "rationale": "Standard Teams encryption protects media in transit and at rest but the service can decrypt it.\nEnd-to-end encryption keeps the keys on the endpoints, so audio, video and screen sharing of a\nsensitive call cannot be read by the service or by someone with privileged access to it. Making it\navailable lets people who handle sensitive matters use it when they need it.\n",
    "impact": "During an end-to-end encrypted call or meeting, recording, live captions and transcription, Copilot,\ncall transfer and merge, breakout rooms, PowerPoint Live and PSTN dial-in are unavailable. Users\nsubject to compliance recording cannot use E2EE. Teams on the web and VDI cannot join encrypted\nmeetings. Train users to keep E2EE for calls that need it.\n",
    "setting": {
      "location": "Teams admin center > Enhanced encryption policies > Global (Org-wide default) > End-to-end call encryption",
      "default_value": "Not enabled (Disabled)",
      "recommended_value": "Not enabled, but users can enable (DisabledUserOverride)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Enhanced encryption policies** and open the **Global (Org-wide default)** policy and\n   the custom policies assigned to users.\n3. Check that **End-to-end call encryption** is **Not enabled, but users can enable** (and, with\n   Teams Premium, that **End-to-end meeting encryption** is the same).\n4. With Microsoft Teams PowerShell:\n   `Get-CsTeamsEnhancedEncryptionPolicy | Select-Object Identity, CallingEndtoEndEncryptionEnabledType, MeetingEndToEndEncryption`.\n5. Fail if `CallingEndtoEndEncryptionEnabledType` is `Disabled` in the Global policy.\n"
    },
    "remediation": {
      "manual": "1. In the Teams admin center, browse to **Enhanced encryption policies**, open the **Global\n   (Org-wide default)** policy, set **End-to-end call encryption** to **Not enabled, but users can\n   enable** and **Save**. Role: Teams Administrator.\n2. PowerShell equivalent:\n   `Set-CsTeamsEnhancedEncryptionPolicy -Identity Global -CallingEndtoEndEncryptionEnabledType DisabledUserOverride`.\n3. Tell users how to turn on end-to-end encrypted calling and when to use it.\n"
    },
    "references": [
      {
        "title": "Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls",
        "url": "https://learn.microsoft.com/microsoftteams/teams-end-to-end-encryption",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-CsTeamsEnhancedEncryptionPolicy",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsenhancedencryptionpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-8(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1557"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-031",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}