How to Configure Teams End-to-End Encryption Policies in PowerShell Using CsTeamsEnhancedEncryptionPolicy

End-to-End Encryption (E2EE) Architecture in Microsoft Teams

While Microsoft Teams encrypts all data in transit using Transport Layer Security (TLS) and Secure Real-time Transport Protocol (SRTP), standard enterprise calls and meetings are decrypted at Microsoft cloud media relays to facilitate centralized services—such as cloud recording, live transcription, real-time captioning, dial-in PSTN conferencing, and compliance recording bots. For standard business operations, cloud processing provides indispensable productivity features.

However, for highly sensitive communications—such as confidential executive board discussions, merger and acquisition (M&A) negotiations, legal consultations, or intelligence briefings—organisations often mandate that call and meeting audio, video, and screen sharing remain completely inaccessible to any intermediary, including Microsoft cloud infrastructure. Microsoft Teams satisfies this requirement through End-to-End Encryption (E2EE).

When E2EE is engaged, cryptographic keys are generated and exchanged directly between participant endpoints using standard DTLS-SRTP. The media stream is encrypted at the source device and decrypted only at the receiving participant’s device. In Microsoft Teams, administrative control over E2EE capabilities is governed through the TeamsEnhancedEncryptionPolicy cmdlets in the MicrosoftTeams PowerShell module. This allows administrators to provision E2EE access selectively to vetted security groups without exposing the wider organization to unsupported call features.

Connecting to Microsoft Teams PowerShell

To inspect and configure enhanced encryption policies, ensure the official MicrosoftTeams PowerShell module is installed. Connect to your tenant endpoint using an administrative account assigned the Teams Administrator, Skype for Business Administrator, or Global Administrator role:

# Install or update Microsoft Teams module
Install-Module -Name MicrosoftTeams -Scope CurrentUser -Force -AllowClobber

# Connect to tenant administration endpoint
Connect-MicrosoftTeams

Auditing Existing Enhanced Encryption Policies

Before applying modifications, query the existing enhanced encryption policies configured across your Microsoft 365 tenant using Get-CsTeamsEnhancedEncryptionPolicy:

# Query all tenant enhanced encryption policies
Get-CsTeamsEnhancedEncryptionPolicy | Select-Object Identity, CallingEndToEndEncryptionEnabledType, MeetingEndToEndEncryptionOption

The cmdlet returns the current operational policy records:

Identity                              : Global
CallingEndToEndEncryptionEnabledType  : Disabled
MeetingEndToEndEncryptionOption       : Disabled

By default, Microsoft Teams disables E2EE across both one-to-one calls and group meetings. The two governing parameters include:

• CallingEndToEndEncryptionEnabledType: Controls one-to-one call E2EE capabilities. Accepts Disabled (calls cannot be encrypted end-to-end) or UserControlled (users can toggle E2EE in their Teams client settings).
• MeetingEndToEndEncryptionOption: Controls group meeting E2EE capabilities. Accepts Disabled or UserControlled (meeting organizers can require E2EE in meeting options).

Configuring One-to-One and Group Meeting E2EE Policies

To prevent broad disruption of automated compliance recording or live captioning across the general workforce, enterprise best practice recommends creating a dedicated enhanced encryption policy scoped to sensitive executive and legal groups rather than altering the default Global policy.

To create a custom enhanced encryption policy enabling E2EE for both one-to-one calls and group meetings:

# Create custom policy permitting E2EE for calls and meetings
New-CsTeamsEnhancedEncryptionPolicy -Identity "ExecutiveE2EEPolicy" `
    -CallingEndToEndEncryptionEnabledType UserControlled `
    -MeetingEndToEndEncryptionOption UserControlled

If you only wish to permit E2EE for one-to-one calls while keeping group meetings subject to standard compliance recording, configure the parameters accordingly:

# Create policy enabling E2EE exclusively for one-to-one calls
New-CsTeamsEnhancedEncryptionPolicy -Identity "CallsOnlyE2EEPolicy" `
    -CallingEndToEndEncryptionEnabledType UserControlled `
    -MeetingEndToEndEncryptionOption Disabled

To update an existing policy identity, invoke Set-CsTeamsEnhancedEncryptionPolicy:

# Update existing policy to enable meeting E2EE
Set-CsTeamsEnhancedEncryptionPolicy -Identity "ExecutiveE2EEPolicy" `
    -MeetingEndToEndEncryptionOption UserControlled

Assigning Enhanced Encryption Policies to Users and Groups

Once defined, assign the custom encryption policy to specific executive users using Grant-CsTeamsEnhancedEncryptionPolicy:

# Assign E2EE policy to an executive user
Grant-CsTeamsEnhancedEncryptionPolicy -Identity "[email protected]" -PolicyName "ExecutiveE2EEPolicy"

To assign the policy across an entire Entra ID security group (e.g. Legal and Executive Leadership):

# Assign policy to members of a target security group
$GroupId = (Get-MgGroup -Filter "DisplayName eq 'Executive Leadership Team'").Id
New-CsGroupPolicyAssignment -GroupId $GroupId `
    -PolicyType TeamsEnhancedEncryptionPolicy `
    -PolicyName "ExecutiveE2EEPolicy" `
    -Rank 1

To audit which enhanced encryption policy is effectively assigned to a user account:

# Verify effective policy assignment
Get-CsUserPolicyAssignment -Identity "[email protected]" -PolicyType TeamsEnhancedEncryptionPolicy

Verifying End-to-End Encryption in the Teams Client

After the policy replicates to the user’s Teams desktop or mobile client:

1. The user navigates to Settings > Privacy > End-to-end encrypted calls and toggles the switch to active.
2. During an active call or meeting, an encryption shield icon with a padlock appears in the top-left corner of the call window.
3. Clicking the shield icon reveals a 20-digit security code. Both call participants can compare this code out-of-band to verify mutual authentication and ensure no man-in-the-middle interception exists.

Operational Constraints and Feature Trade-offs

When E2EE is active during a call or meeting, certain cloud-dependent services are intentionally bypassed and unavailable:

• Cloud Recording and Transcription: Server-side recording and automated transcripts cannot function because the cloud relay cannot decode the media stream.
• Live Captions: Cloud-based automated speech-to-text captions are disabled.
• Call Escalation: Adding a third participant to a 1:1 E2EE call drops encryption down to standard TLS/SRTP unless the meeting itself was scheduled as an E2EE group meeting.
• PSTN Dial-in and Out: Traditional phone numbers cannot participate in E2EE sessions.

Managing E2EE via CsTeamsEnhancedEncryptionPolicy enables enterprise security architects to provide mathematical confidentiality for critical communications while preserving standard compliance features across everyday business operations.