Teams meeting policies design

Teams meeting policies govern what users can do in meetings — recording, transcription, lobby behaviour, presenter controls, screen sharing, chat, breakouts, watermarking. Designing the policy set deliberately, rather than leaving everyone on the Global default, is one of the higher-leverage admin actions in a serious Teams deployment.

The shorter map of what a meeting policy is lives in Microsoft Teams meeting policies; adjacent controls are meeting recording management, sensitivity labels for meetings, live captions and translation, and the Copilot-in-meetings settings in Copilot in Teams meetings.

The Global default

Every tenant has a Global (Org-wide default) meeting policy. The shipped defaults are reasonable starting points for most organisations, but worth reviewing:

• Cloud recording: on by default — usually correct.
• Transcription: on by default — required for Copilot meeting recap.
• Anonymous join: on by default with lobby — usually correct.
• Who can present: "Everyone" by default — usually wrong; should be "Specific people" or "Only organisers."
• Lobby bypass: "Everyone" by default — usually wrong; should be "People in your organisation."

Many tenants improve security and consistency just by tightening the Global default.

Custom policies for specific populations

Beyond Global, create custom policies for populations with specific needs:

Executives

• Watermarking on (Teams Premium) for confidential meetings.
• Recording off by default — manual enable per meeting.
• End-to-end encryption available (Teams Premium) for highly confidential meetings.
• Lobby stricter — manual admit even for internal participants.
• Chat retention longer for accountability.

General employees

• Default policy with reasonable settings.
• Anonymous join allowed with lobby for external meetings.
• Recording allowed but not required.

Frontline / shift workers

• Reduced features — many meeting features irrelevant.
• Walkie Talkie more important than meetings.

Restricted users (interns, contractors)

• No recording (privacy concerns).
• No anonymous attendees they can admit.
• Specific people can present locked down.
• Sensitive features disabled.

Lobby and presenter controls

Two of the most important settings:

Lobby bypass

Who skips the lobby and joins meetings immediately:

• Everyone — anyone can join without admission. Use only for public webinars.
• Everyone except dial-in users — common reasonable default.
• People in your organisation — internal users skip; externals wait.
• People in your organisation and trusted organisations — internal plus federated partners skip.
• People I invite — only explicitly-invited get in.

For most meetings, "People in your organisation" is the right default. External attendees wait in lobby; organiser admits when ready.

Who can present

By default, everyone can present in a Teams meeting. This means external attendees can present, take control, share their screen. Better defaults:

• Specific people — designated presenters by name.
• Only organisers and co-organisers — strictest.
• People in your organisation — internal users can present.

For meetings with external attendees, especially webinars and customer-facing meetings, restrict who can present.

Recording and transcription

For Microsoft 365 Copilot users, transcription must be enabled for meeting recap to work. Recording is optional; transcription alone gives the AI summarisation capability.

Recordings store in:

• Channel meetings → the channel's SharePoint site.
• Other meetings → the organiser's OneDrive.

Retention follows the storage location's policies. For default 60-day or shorter retention of meeting recordings, configure a Purview retention policy scoped to Teams meeting messages.

Watermarking and Teams Premium

Teams Premium unlocks several meeting-protection features:

• Watermarks on shared content and video — recipient identity displayed semi-transparently.
• End-to-end encryption for scheduled meetings.
• Sensitivity-label-driven meeting controls — different protections per labelled meeting.

For high-security meetings (board, M&A, legal), these features matter.

Configuration via PowerShell

Bulk policy configuration is faster via PowerShell:

Connect-MicrosoftTeams

# Create a custom policy
New-CsTeamsMeetingPolicy -Identity "Executive" `
    -AllowCloudRecording $false `
    -AllowMeetWatermark $true `
    -DesignatedPresenterRoleMode "OrganizerOnlyUserOverride"

# Assign to a user
Grant-CsTeamsMeetingPolicy -Identity exec@yourcompany.com -PolicyName "Executive"

Operational discipline

• Document the policy set so admins know what each does.
• Pilot before broad assignment — test policies on a small group.
• Review periodically — Microsoft adds new settings; existing policies don't auto-include them.
• Audit assignments — users on wrong policies create surprises.

For organisations using Teams seriously, well-designed meeting policies are one of the lower-effort, higher-leverage Teams admin investments. The Global default tweaked plus 2–3 custom policies for specific populations covers most needs.

A worked example: three-tier policy set

Rather than one all-encompassing policy, most organisations settle on three:

• Default (everyone). Recording allowed with consent-notice on; transcription on; live captions on; meeting chat on; anonymous join for scheduled meetings only; screen share for entire screen and applications; PSTN dial-out allowed within the country; watermarks off (E5/Teams Premium only anyway).
• External-facing (client-facing staff). Same as default but: participants sent to lobby by default (organisation, federated, and trusted orgs bypass); anonymous users can join scheduled meetings but not present without organiser promote; recording auto-notifies chat; meeting insights and Copilot recap on.
• Restricted (regulated roles: legal, HR, senior finance, boards). Recording off (or "controlled" — only organiser can start); transcription off; anonymous join off; lobby for everyone including staff; meeting chat off after meeting ends; sensitive-content watermarks on (Teams Premium); Copilot recap off; end-to-end encryption available on 1:1 calls for that role.

Assign via group-based licence-style Teams policy assignment, not per-user clicks. Reassign nightly via Set-CsUserPolicyPackage or the newer Graph endpoints if you drive it from an identity source of truth.

Decision matrix: which policy to touch first

| Concern | Setting | | --- | --- | | Untrusted anonymous joiners | Anonymous join off, or lobby everyone | | Sensitive discussions leaking through recording | Meeting recording off for that policy, or org-wide with organiser-only start | | External participants seeing private chat history | Meeting chat = for the current meeting only | | Screen-share of the wrong window | Content sharing = single app only, disable entire screen | | Overwhelming attendee count in a broadcast | Meeting type = webinar or town hall, not standard meeting | | Recording retention drift | Purview retention on the storage location (organiser's OneDrive for chats, meeting site for channel meetings) | | End-to-end encrypted 1:1 calls | Enhanced encryption for 1:1 in the policy | | Sensitive-content watermark on the meeting | Sensitivity label on the meeting invite (Teams Premium) |

When meeting policies are the wrong tool

• You need per-meeting overrides. Meeting options (per-invite) override the policy for chat, lobby, presenters, and camera/mic. Design the policy for the 90th-percentile meeting, not the exception.
• You need to block file sharing in-meeting. That's DLP and SharePoint permissions on the storage location, not a meeting-policy setting.
• You need to prevent recording by the participant's OS/other software. Meeting policies can only stop Teams from recording. External capture is a human/legal problem, not a policy problem.
• You need to change chat retention. Teams chat retention is a Purview retention policy, scoped to Teams. Meeting policies don't control retention.

MSP checklist

• Default, external-facing, restricted three-tier template applied at every new tenant.
• Group-based assignment. Never per-user for meeting policies — the audit trail is worse and the drift is guaranteed.
• Change control. Meeting-policy edits go through a documented change ticket. Silent tweak = call at 4pm from the client's marketing team saying anonymous join stopped working.
• Recording storage audit. Monthly per-client: which OneDrive/SharePoint sites hold meeting recordings, retention posture on those, any recordings shared externally.
• Teams Premium features enabled per-user, not tenant-wide, and reviewed quarterly against actual usage — the seats are the expensive part.