Teams controls

In this article, you learn what tools Microsoft 365 provides to control the user experience in Microsoft Teams meetings. You know what those tools are, how they interact, which roles and licenses you need, and many more. Let's start with a high-level decision tree diagram describing whether a specific feature is allowed for a meeting participant. A subset of the controls might control individual features. Let's take an example of call recording in the Teams meeting. Microsoft 365 administrators can't control this feature with tenant configuration but can control it via

  • Policy assigned to the users,
  • A sensibility label selected for the meeting,
  • Meeting template selected for the meeting
  • Meeting options defined by the meeting organizer
  • Role of the user in the meeting.

Decision tree for enabling functionality

Tenant configurations

Tenant configurations are organization-wide settings that impact everyone in the tenant. There's only one configuration, and the administrator can't create a new configuration. Just modify the existing one. Microsoft Teams provides, for example, configuration for federation with Azure Communication Services, federation with Skype for Business, or configuration to control Teams meetings (this configuration is being deprecated). Teams administrators can use these configurations as safeguards to disable capabilities for everyone in the tenant easily.

  • Required role: Teams or global administrator
  • Licensing: standard licensing
  • Tools: Teams Admin Center or PowerShell
Setting name Description Tenant configuration Property
Enable federation with Azure Communication Services If enabled, Azure Communication Services users can join Teams meeting as Communication Services users even if Teams anonymous users are not allowed CsTeamsAcsFederationConfiguration EnableAcsUsers
List federated Azure Communication Services resources Users from listed Azure Communication Services resources can join Teams meeting if Teams anonymous users are not allowed to join. CsTeamsAcsFederationConfiguration AllowedAcsResources
Anonymous users can join a meeting If disabled, Teams external users can't join Teams meetings. CsTeamsMeetingConfiguration DisableAnonymousJoin

Your custom application should consider user authentication and other security measures to protect Teams meetings. Be mindful of the security implications of enabling anonymous users to join meetings. Use the Teams security guide to configure capabilities available to anonymous users.

Tenant policies

Tenant policies are configurations that can be assigned to specific users or groups of users. A policy consists of properties with one of the following scopes: per-organizer, per-user, or both. Scope controls which policy is considered when evaluating the feature's availability, the organizers, participants, or both. Popular tenant policies are meeting, calling, messaging, or external access policies. A tenant has, by default, a Global policy assigned to everyone in the tenant. However, an administrator can create a new policy of a specific type, define a custom configuration, and assign it to users or groups of users. The following priority takes place when selecting which policy applies to the user:

  1. Directly assigned policy: The policy is assigned directly to the user.
  2. Group-assigned policy: The policy is assigned to a group the user is part of.
  3. Organization-wide policy: The Global policy applies.

Decision tree for selection of policy for evaluation

An organizer-assigned policy can disable the feature in all meetings this user organizes. Disabled capability by policy can't be enabled with other tools. For example, administrators can use a global meeting policy to allow recording for everyone. Then create a new meeting policy called "external customers", which would disable recording. Admin then assigns the new policy to a group of users that conduct calls with external customers.

  • Required role: Teams or global administrator
  • Licensing: standard licensing
  • Tools: Teams Admin Center or PowerShell
Setting name Policy scope Description Tenant policy property
Let anonymous people join a meeting per-organizer If disabled, Teams external users can't join Teams meetings. CsExternalAccessPolicy EnableAcsFederationAccess
Blocked anonymous join client types per-organizer If the property "BlockedAnonymousJoinClientTypes" is set to "Teams" or "Null", the Teams external users via Azure Communication Services can join Teams meeting. CsTeamsMeetingPolicy BlockedAnonymousJoinClientTypes
Anonymous users can join a meeting per-organizer If disabled, Teams external users can't join Teams meetings. CsTeamsMeetingPolicy AllowAnonymousUsersToJoinMeeting
Let anonymous people start a meeting per-organizer Teams external users can start a Teams meeting without Teams user if enabled. CsTeamsMeetingPolicy AllowAnonymousUsersToStartMeeting
Anonymous users can dial out to phone users per-organizer If enabled, Teams external users can add phone participants to the meeting. CsTeamsMeetingPolicy AllowAnonymousUsersToDialOut
Automatically admit people per-organizer If set to "Everyone", Teams external users can bypass the lobby. Otherwise, Teams external users must wait in the lobby until an organizer, coorganizer, or presenter admits them. CsTeamsMeetingPolicy AutoAdmittedUsers

Sensitivity label

Sensitivity labels allow Teams admins to protect and regulate access to sensitive organizational content during Microsoft Teams meetings. Compliance administrators can create sensitivity labels in Microsoft Purview compliance portal and assign them with policy to users or groups of users. These labels can then be assigned to Teams meeting via meeting templates or meeting options. The sensitivity labels control subset of meeting options, adds new controls such as prevention of copy & paste in the chat, and might require justification for a change of the sensitivity label of the meeting.

  • Required role: Compliance or global administrator to manage sensitivity labels and policy. Teams or global administrators to manage meeting templates. Meeting organizer to manage meeting options.
  • Licensing: Microsoft Purview
  • Tools: Microsoft Purview compliance portal

Meeting options that can be controlled via sensitivity label:

  • Who can bypass the lobby
  • Who can present
  • Who can record
  • Encryption for meeting video and audio
  • Automatically record
  • Video watermark for screen sharing and camera streams
  • Prevent copying of meeting chat
  • Prevent or allow copying of chat contents to the clipboard

Meeting templates

Teams administrators can use meeting templates to control meeting settings that the meeting organizer usually controls. With templates, Teams administrators can create consistent meeting experiences in your organization and help enforce compliance requirements and business rules. Meeting templates can be used to enforce settings or to set default values. The administrator can lock the individual template option so the meeting organizer can't change it, or it can be left unlocked for the meeting organizer to change it if needed.

  • Required role: Teams or global administrator to manage meeting templates. Meeting organizer to select meeting template for the meeting.
  • Licensing: Microsoft Premium
  • Tools: Teams Admin Center
Group Teams meeting option Description
Security Sensitivity label Specifies the sensitivity label to be used for the meeting.
Lobby - Who can bypass the lobby? Specify who can bypass the lobby and join the meeting directly.
People calling in by phone can bypass the lobby Specifies whether phone users can bypass the lobby.
Enable meeting end-to-end encryption Specifies if the meeting is encrypted.
Enable Watermarks Specifies if watermarks are used for camera feeds and content that's shared on screen in the meeting.
Audio and video Enable mic for attendees? When off, you can unmute individual attendees as needed.
Enable camera for attendees? When on, meeting attendees can turn on video.
Recording and transcription Record meetings automatically Speficy if the meeting is recorded automatically.
Who can record meetings? Specifies who can record the meeting.
Roles Notify when callers join and leave A sound plays when someone calling in by phone joins or leaves the meeting.
Meeting engagement Allow meeting chat Specifies if the meeting chat is available. It can also be used to prevent chatting before and after the meeting.
Allow reactions Specifies if attendees can use reactions in the meeting.
Enable Q&A Specifies if attendees can use the Q&A feature to ask questions during the meeting.
Manage what attendees see Specifies if meeting organizers can preview and approve content being shared on screen before other meeting participants can see it.

Meeting roles

Teams meeting roles define permissions that Teams meeting participants have. Microsoft Teams provides roles: organizer, coorganizer, presenter, and attendee. The meeting organizer can assign default roles to the participants. Coorganizers and presenters share most organizer permissions, while attendees are more controlled. There can be only one meeting organizer.

  • Required role: Organizer, coorganizer, and presenter can change the roles of individual participants. Each user knows their role.
  • Licensing: standard licensing
  • Tools: Microsoft Teams and Graph API (only default roles)

List of permissions per role can be found here and more details about coorganizer.

Meeting options

Meeting options allow meeting organizer and coorganizers to customize the meeting experience before and during the meeting. Default values, editability, and visibility of individual features depend on the tenant configuration, policies, sensitivity label, and meeting template.

  • Required role: Organizer or coorganizer can change available meeting options.
  • Licensing: standard licensing
  • Tools: Microsoft Teams and Graph API (only before the meeting starts)

Here's an overview of Meeting options:

Option name Description Supported
Automatically admit people If set to "Everyone", Teams external users can bypass the lobby. Otherwise, Teams external users have to wait in the lobby until an authenticated user admits them. ✔️
Always let callers bypass the lobby Participants joining through phone can bypass lobby Not applicable
Announce when callers join or leave Participants hear announcement sounds when phone participants join and leave the meeting ✔️
Choose coorganizers Not applicable to external users ✔️
Who can present in meetings Controls who in the Teams meeting can have assigned presenter role. ✔️
Manage what attendees see Teams organizer, coorganizer and presenter can spotlight videos for everyone. ✔️
Allow mic for attendees If an external user is an attendee, then this option controls whether the external user can send local audio ✔️
Allow camera for attendees If an external user is an attendee, then this option controls whether the external user can send local video ✔️
Record automatically Records meeting when anyone starts the meeting. The user in the lobby does not start a recording. ✔️
Allow meeting chat If enabled, external users can use the chat associated with the Teams meeting. ✔️
Allow reactions If enabled, external users can use reactions in the Teams meeting
RTMP-IN If enabled, organizers can stream meetings and webinars to external endpoints by providing a Real-Time Messaging Protocol (RTMP) URL and key to the built-in Custom Streaming app in Teams. Not applicable
Provide CART Captions Communication access real-time translation (CART) is a service in which a trained CART captioner listens to the speech and instantaneously translates all speech to text. As a meeting organizer, you can set up and offer CART captioning to your audience instead of the Microsoft Teams built-in live captions that are automatically generated.
Apply a watermark to everyone's video feed Watermark is applied to everyone's video feed. Instead, no video is received.
Apply a watermark to shared content Watermark is applied to screen share feed. Instead, no screen-sharing video is received.
End-to-end encryption Enable end-to-end encryption for Teams meeting. Audio and video streams are encoded end-to-end. Azure Communication Services can't join meetings with end-to-end encryption.
Who can record Select which roles in the meeting can manage Teams recording. Azure Communication Services does not provide API for Teams recording.
Enable Q&A Allow Q&A in the Teams meeting
Enable language interpretation  Allows professional interpreters to translate what a speaker says into another language in real-time.
Enable Green room Use a green room to prepare with other presenters, practice sharing materials, and more before attendees enter the meeting.

Next steps