How to Secure Microsoft Teams Meetings (Checklist + Best Practices)

Quick Security Checklist#

TL;DR (Checklist) - Require MFA and enforce Conditional Access for Teams. - Disable anonymous join where possible; otherwise, use the lobby for externals. - Set “Who can present” to Specific people or Only organizers and co-organizers. - Restrict chat, file sharing, recording, transcription, and screen sharing. - Use sensitivity labels for “secure-by-default” meeting templates. - After sensitive calls, review attendance + audit logs.

---

Meeting Security Checklist (Organizers)#

Use this checklist before you hit “Send.”

1) Lock down who can join (Meeting Options Click Paths)

In your Teams calendar or Outlook invite, open Meeting options (during a live call, navigate to More options (…) > Settings > Meeting options):

• Who can bypass the lobby?
• For sensitive meetings: Only organizers and co-organizers (or People in my org).
• For external/client calls: keep externals in the lobby unless you truly need frictionless join.

• Microsoft documented options: Everyone, People in my org, trusted orgs, and guests, People in my org, and Only organizers and co-organizers.

• Who can present?

• Set to Specific people or Only organizers and co-organizers.
• Microsoft documented options: Everyone, People in my org and guests, Specific people, and Only organizers and co-organizers.

• This is one of the highest-impact controls because most real-world meeting abuse comes from presenter privileges (screen share, link drops, disruptive content).

• Allow mic and camera for attendees

• In Meeting options, toggle Allow mic for attendees? and Allow camera for attendees? to No for large webinars or all-hands calls to eliminate disruptions.

2) Control chat to reduce link-spread and data retention

• Set meeting chat to In-meeting only (or disable it) if you do not need pre/post-meeting link sharing.
• If chat must remain on, communicate a simple rule: no passwords, no secrets, no customer PII in chat.

3) Disable or restrict recording and transcription

Recording increases your data footprint and can expand breach impact if shared broadly.

• For confidential meetings: disable recording and transcription in Meeting options.
• If recording is required (training/compliance):
• Ensure storage permissions are tight in OneDrive/SharePoint.
• Apply retention and access controls appropriate to the content sensitivity.

4) Reduce screen-sharing risk (accidental leakage prevention)

• Prefer sharing a window instead of the entire desktop.
• Use PowerPoint Live or share a specific document rather than a file explorer view.
• Before sharing: close email, chats, admin consoles; silence notifications.

5) Treat the meeting link as forwardable

Assume the URL may be forwarded (internally or externally). Your security posture should still hold if the link leaks, via authenticated join, lobby, and restricted presenters.

---

Harden Identity (Tenant-Wide Best Practice)#

Meeting options help, but strong identity is what prevents compromised accounts from joining as “trusted users.”

Require MFA for hosts and attendees (especially for sensitive calls)

MFA is one of the most effective defenses against account takeover, which is a common route to unwanted meeting access.

• Require MFA for Teams access.
• Ensure break-glass/admin exceptions are controlled and monitored.

Use Conditional Access (Microsoft Entra ID)

Common Conditional Access patterns for Teams: - Require MFA for Teams sign-in. - Require compliant devices (e.g., Intune-managed) for users accessing sensitive data. - Block legacy authentication (if still relevant in your environment). - Apply stricter controls for high-risk sign-ins or risky locations.

If your broader endpoint posture is weak, meeting security is harder to sustain. You may also want to align Teams security with endpoint security standards (see: best antivirus for windows business endpoints 2026).

---

Teams Premium and Microsoft Purview Meeting Protection#

For high-confidentiality meetings (such as board briefings, M&A discussions, or incident response), advanced protections are available via Microsoft Purview and Teams Premium licenses:

Watermarking (Teams Premium)

• Teams Premium allows organizers to enforce dynamic watermarking across attendee video feeds and shared presentation content.
• The watermark displays the viewing attendee email address (User Principal Name) across the content, deterring unauthorized screenshots and smartphone photos.

End-to-End Encryption for Scheduled Meetings (Teams Premium)

• While one-to-one calls support basic E2EE, Teams Premium enables end-to-end encryption for scheduled multi-participant meetings (up to 200 participants).
• Note that enabling E2EE intentionally disables cloud recording, live transcription, and dial-in PSTN attendees to maintain cryptographic boundaries.

Sensitivity Labels (Microsoft Purview Information Protection)

If you use Microsoft Purview sensitivity labels, apply them to meetings to standardize restrictions and eliminate organizer error: - Configure labels in the Microsoft Purview compliance portal under Information protection > Labels. - Sensitivity labels can automatically lock down lobby bypass, force presenter restrictions, apply watermarking, and prevent copying meeting chat text. - This is especially useful for executives, finance, HR, incident response, or customer escalations, where the same meeting controls should be repeatable every time.

---

External and Guest Access: Choose Deliberately#

Most Teams meeting risk increases when identity is unknown or unmanaged. Your safest approach is known identity over anonymous access.

Preferred order (security-first)

1. Internal-only (highest assurance)
2. External attendees with verified identity (guest or federated)
3. Anonymous join (lowest assurance; use only when necessary)

Practical guidance

• Prefer inviting external attendees by named identity (email/account) rather than “Anyone with the link.”
• Restrict or disable anonymous join tenant-wide if the business can tolerate it.
• Configure cross-tenant access settings in Microsoft Entra ID to match your partner model and trust assumptions.

---

After the Meeting: Verify and Monitor#

For high-risk or sensitive meetings, add a lightweight “after action” step:

• Attendance report: verify who actually joined and duration.
• Chat review: look for unexpected links, files, or participants.
• Audit and sign-in review:
• Unexpected sign-in locations or IPs
• Multiple failed MFA prompts
• New device sign-ins close to meeting time

If your organization tracks security events, it can help to document what you consider an indicator of compromise and what logs to check. For related terminology and detection workflow, see what is an ioc.

---

Admin Controls: Standardize Secure Defaults with Meeting Policies#

Organizers are human. Secure admin defaults reduce operational mistakes across the tenant.

Teams Admin Center Navigation Paths

IT administrators configure meeting baselines in the Teams admin center (https://admin.teams.microsoft.com): 1. Navigate to Meetings > Meeting policies. 2. Select Global (Org-wide default) or create a targeted policy assigned to sensitive groups. 3. Configure these critical baseline settings: - Meeting join & lobby > Anonymous users can join a meeting: Toggle to Off. - Meeting join & lobby > Who can bypass the lobby: Select People in my organization or Only organizers and co-organizers. - Content sharing > Screen sharing mode: Select Single application (prevents accidental desktop notification leaks). - Meeting engagement > Meeting chat: Set to On for everyone but anonymous users or Off. - Recording & transcription > Cloud recording: Toggle Off for restricted departments.

Review and Configure Teams Meeting Policies via PowerShell

Administrators can inspect and automate policy enforcement using the Microsoft Teams PowerShell module:

# Install and connect with Teams Administrator role
Install-Module -Name MicrosoftTeams -Scope CurrentUser
Connect-MicrosoftTeams

# Inspect current Global meeting policy settings
Get-CsTeamsMeetingPolicy -Identity Global | Format-List AutoAdmittedUsers, AllowAnonymousUsersToJoinMeeting, DesignatedPresenterRoleMode, ScreenSharingMode, MeetingChatEnabledType

# Harden Global policy: enforce lobby for externals, block anonymous joins, restrict default presenter mode
Set-CsTeamsMeetingPolicy -Identity Global `
  -AutoAdmittedUsers "EveryoneInCompany" `
  -AllowAnonymousUsersToJoinMeeting $false `
  -DesignatedPresenterRoleMode "OrganizerOnlyUserOverride" `
  -ScreenSharingMode "SingleApplication" `
  -MeetingChatEnabledType "EnabledExceptAnonymous"

Key verified parameters in Set-CsTeamsMeetingPolicy: - -AutoAdmittedUsers: Controls lobby bypass (Everyone, EveryoneInSameAndFederatedCompany, EveryoneInCompany, OrganizerOnly). - -AllowAnonymousUsersToJoinMeeting: Disables unauthenticated guest joining ($false). - -DesignatedPresenterRoleMode: Dictates presenter rights (EveryoneUserOverride, EveryoneInCompanyUserOverride, OrganizerOnlyUserOverride). - -ScreenSharingMode: Limits screen capture scope (EntireScreen, SingleApplication, Disabled). - -MeetingChatEnabledType: Restricts chat lifecycle (Enabled, Disabled, EnabledExceptAnonymous).

Audit Strategy (Microsoft Purview + Entra ID)

In Purview Audit (licensing dependent), filter by: - Teams meeting actions (MeetingParticipantDetail, MemberAdded, MeetingDetail) - Organizer identity - Time range around the meeting

In Entra ID sign-in logs, look for: - Unfamiliar geographies/IPs - “Impossible travel” or risky sign-ins - Repeated MFA failures - New devices shortly before meeting start

---

Common Misconceptions (What Actually Helps)#

“A Teams meeting link is private.”

It is often forwarded. Do not rely on obscurity; use authentication, lobby, and presenter controls.

“The lobby is enough.”

The lobby helps against unknown joiners, but not against compromised internal accounts. Pair it with MFA and Conditional Access.

“Disabling anonymous join makes us safe.”

It reduces drive-by joins, but it does not prevent: - Stolen internal credentials - Over-permissive presenters - Data leakage through chat, recording, or screen share

“Recording is harmless because it is in Microsoft 365.”

Recordings expand retention and access surface area. Treat them like sensitive artifacts: restrict access, label if possible, and apply retention rules.

---

Optional Extras (When You Need More Than Teams Settings)#

Some organizations add a “secure meeting” kit for high-risk calls: - A password manager for safely sharing temporary credentials (where policy allows). If that is relevant, consider a business-grade manager like 1Password via Try 1Password → and compare options in password manager for small business 2026. - A privacy network for travel scenarios or untrusted Wi-Fi. If your policy permits, NordVPN is an option via Check NordVPN pricing →, or Proton VPN via Try Proton VPN →. (These do not replace MFA/Conditional Access; think defense-in-depth for network exposure.)

---

Related Reading (Microsoft Documentation)

• Microsoft Learn: Manage meeting policies in Microsoft Teams
• Microsoft Learn: Configure lobby settings and meeting options in Teams
• Microsoft Learn: Teams meeting options and presenter permissions
• Microsoft Learn: Set-CsTeamsMeetingPolicy cmdlet reference
• Microsoft Learn: Watermarking for Teams meetings (Teams Premium)
• Microsoft Learn: End-to-end encryption for Microsoft Teams meetings
• Microsoft Learn: Sensitivity labels for Microsoft Teams meetings

---

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.