How to Secure Microsoft Teams Meetings (Checklist + Best Practices)

TL;DR (Checklist) - Require MFA and enforce Conditional Access for Teams. - Disable anonymous join where possible; otherwise, use the lobby for externals. - Set “Who can present” to Specific people or Only organizers/co-organizers. - Restrict chat, file sharing, recording, transcription, and screen sharing. - Use sensitivity labels for “secure-by-default” meeting templates. - After sensitive calls, review attendance + audit logs.

Meeting Security Checklist (Organizers)

Use this quick list before you hit “Send.”

1) Lock down who can join (Meeting Options)

In the meeting invite, open Meeting options and set:

Who can bypass the lobby?
For sensitive meetings: Only organizers and co-organizers (or People in my org).
For external/client calls: keep externals in the lobby unless you truly need frictionless join.
Who can present?
Set to Specific people or Only organizers and co-organizers.
This is one of the highest-impact controls because most real-world meeting abuse comes from presenter privileges (screen share, link drops, disruptive content).
Allow mic for attendees / reactions
For large or high-risk calls, restrict unmuting and reactions to reduce disruption.

2) Control chat to reduce link-spread and data retention

Set meeting chat to In-meeting only (or disable it) if you don’t need pre/post-meeting link sharing.
If chat must remain on, communicate a simple rule: no passwords, no secrets, no customer PII in chat.

3) Disable or restrict recording and transcription

Recording increases your data footprint and can expand breach impact if shared broadly.

For confidential meetings: disable recording and transcription.
If recording is required (training/compliance):
Ensure storage permissions are tight.
Apply retention and access controls appropriate to the content’s sensitivity.

Prefer sharing a window instead of the entire screen.
Use PowerPoint Live or share a specific document rather than a file explorer view.
Before sharing: close email, chats, admin consoles; silence notifications.

5) Treat the meeting link as forwardable

Assume the URL may be forwarded (internally or externally). Your security posture should still hold if the link leaks—via authenticated join, lobby, and restricted presenters.

Harden Identity (Tenant-Wide Best Practice)

Meeting options help—but strong identity is what prevents compromised accounts from joining as “trusted users.”

Require MFA for hosts and attendees (especially for sensitive calls)

MFA is one of the most effective defenses against account takeover, which is a common route to unwanted meeting access.

Require MFA for Teams access.
Ensure break-glass/admin exceptions are controlled and monitored.

Use Conditional Access (Microsoft Entra ID)

Common Conditional Access patterns for Teams: - Require MFA for Teams sign-in. - Require compliant devices (e.g., Intune-managed) for users accessing sensitive data. - Block legacy authentication (if still relevant in your environment). - Apply stricter controls for high-risk sign-ins or risky locations.

If your broader endpoint posture is weak, meeting security is harder to sustain. You may also want to align Teams security with endpoint security standards (see: best antivirus for windows business endpoints 2026).

Use Sensitivity Labels to Make Secure Meetings “Default”

If you use Microsoft Purview sensitivity labels, apply them to meetings to standardize restrictions and reduce organizer error.

Labels can help enforce or strongly encourage: - Internal-only access - Reduced guest capabilities (depending on configuration/support) - More restrictive collaboration defaults

This is especially useful for executives, finance, HR, incident response, or customer escalations—where the same meeting controls should be repeatable every time.

External and Guest Access: Choose Deliberately

Most Teams meeting risk increases when identity is unknown or unmanaged. Your safest approach is known identity over anonymous access.

Preferred order (security-first)

Internal-only (highest assurance)
External attendees with verified identity (guest or federated)
Anonymous join (lowest assurance; use only when necessary)

Practical guidance

Prefer inviting external attendees by named identity (email/account) rather than “Anyone with the link.”
Restrict or disable anonymous join tenant-wide if the business can tolerate it.
Configure cross-tenant access rules to match your partner model and trust assumptions.

After the Meeting: Verify and Monitor

For high-risk or sensitive meetings, add a lightweight “after action” step:

Attendance report: verify who actually joined.
Chat review: look for unexpected links, files, or participants.
Audit/sign-in review:
Unexpected sign-in locations or IPs
Multiple failed MFA prompts
New device sign-ins close to meeting time

If your organization tracks security events, it can help to document what you consider an indicator of compromise and what logs to check. For related terminology and detection workflow, see what is an ioc.

Admin Controls: Standardize Secure Defaults with Meeting Policies

Organizers are human. Secure defaults reduce mistakes.

Review Teams meeting policies (PowerShell)

# Requires Teams PowerShell module and appropriate admin role
Connect-MicrosoftTeams

# List policies
Get-CsTeamsMeetingPolicy

# Inspect the global policy
Get-CsTeamsMeetingPolicy -Identity Global | Format-List

Key settings to evaluate in your baseline policy: - Anonymous join allowance - Lobby/bypass behavior - Presenter permissions - Meeting chat behavior - Recording/transcription controls - Screen sharing defaults

Parameter names can change as Teams evolves. Validate in your tenant with:
Get-Help Get-CsTeamsMeetingPolicy -Full

Audit strategy (Microsoft Purview + Entra ID)

In Purview Audit (licensing dependent), filter by: - Teams meeting actions - Organizer identity - Time range around the meeting

In Entra ID sign-in logs, look for: - Unfamiliar geographies/IPs - “Impossible travel” or risky sign-ins - Repeated MFA failures - New devices shortly before meeting start

Common Misconceptions (What Actually Helps)

“A Teams meeting link is private.”

It’s often forwarded. Don’t rely on obscurity—use authentication, lobby, and presenter controls.

“The lobby is enough.”

The lobby helps against unknown joiners, but not against compromised internal accounts. Pair it with MFA and Conditional Access.

“Disabling anonymous join makes us safe.”

It reduces drive-by joins, but it doesn’t prevent: - Stolen internal credentials - Over-permissive presenters - Data leakage through chat/recording/screen share

“Recording is harmless because it’s in Microsoft 365.”

Recordings expand retention and access surface area. Treat them like sensitive artifacts: restrict access, label if possible, and apply retention rules.

Optional Extras (When You Need More Than Teams Settings)

Some organizations add a “secure meeting” kit for high-risk calls: - A password manager for safely sharing temporary credentials (where policy allows). If that’s relevant, consider a business-grade manager like 1Password via Try 1Password → and compare options in password manager for small business 2026. - A privacy network for travel scenarios or untrusted Wi‑Fi. If your policy permits, NordVPN is an option via Check NordVPN pricing →, or Surfshark via Try Proton VPN →. (These don’t replace MFA/Conditional Access—think defense-in-depth for network exposure.)

Microsoft Learn: Manage meeting policies in Microsoft Teams
Microsoft Learn: Configure lobby settings and meeting options in Teams
Microsoft Learn: Conditional Access for Microsoft 365 and Teams (Entra ID)
Microsoft Purview documentation: Audit and searching audit logs
Microsoft Purview documentation: Sensitivity labels for Teams/Groups/Meetings (where supported)

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.