How to Configure Teams 1:1 Private Calling Policies in PowerShell Using Set-CsTeamsCallingPolicy

In Microsoft Teams enterprise voice environments, communication tools must balance user collaboration with regulatory oversight, compliance recording, and workforce productivity. While 1:1 private audio and video calling enables seamless direct communication between employees, unrestricted private calling presents distinct operational challenges in specific business scenarios. In shared kiosk environments, manufacturing floor terminals, customer support contact centres, educational student accounts, or compliance-monitored trading floors, unmonitored 1:1 private calls bypass automated recording compliance and distract staff from designated queues.

Microsoft Teams administrators govern private peer-to-peer calling capabilities through Calling Policies. Using the Microsoft Teams PowerShell module and the Set-CsTeamsCallingPolicy cmdlet, administrators can toggle the AllowPrivateCalling parameter to enforce channel-only collaboration or permit full peer-to-peer audio and video dialing.

Understanding Private Calling Controls in Teams Calling Policies

Within Microsoft Teams telephony architecture, peer-to-peer communication is controlled by the AllowPrivateCalling parameter in CsTeamsCallingPolicy:

• 1:1 Audio and Video Calling: When set to $true, users can initiate direct 1:1 voice or video calls with colleagues from chat windows, contact cards, or the Calls application.
• Calls App Visibility: When set to $false, the dial pad, call history, and 1:1 calling buttons (the phone and camera icons in direct chats) are disabled or hidden in the Teams client.
• Channel & Meeting Independence: Disabling private calling does not prevent users from participating in scheduled multi-party calendar meetings, ad-hoc team channel meetings, or audio conferences where compliance supervision is active.

The parameter accepts boolean values: $true (default) or $false.

Connecting to Microsoft Teams PowerShell

To inspect and update calling policies, launch an elevated PowerShell console and authenticate with Microsoft 365 administrator credentials:

# Import MicrosoftTeams module
Import-Module MicrosoftTeams

# Sign in to Teams tenant
Connect-MicrosoftTeams

Verify active connection by retrieving all configured calling policies and their private calling states:

Get-CsTeamsCallingPolicy | Select-Object Identity, Description, AllowPrivateCalling, AllowVoicemail | Format-Table -AutoSize

Inspecting Current Private Calling Settings

To check the default organization-wide policy (Global), execute:

Get-CsTeamsCallingPolicy -Identity Global | Select-Object Identity, AllowPrivateCalling, AllowCallRedirect, AllowCallForwardingToUser

A typical output confirms that private calling is enabled by default:

Identity                    : Global
AllowPrivateCalling         : True
AllowCallRedirect           : Enabled
AllowCallForwardingToUser   : True

To query specific custom policies created for student bodies, frontline staff, or call centre agents:

Get-CsTeamsCallingPolicy -Identity "Frontline-Kiosk-Policy" | Select-Object Identity, AllowPrivateCalling

Creating a Custom Calling Policy with Private Calling Disabled

Enterprise best practice recommends leaving the Global policy set to $true for information workers, while creating dedicated restrictive policies for regulated or frontline user tiers.

Execute New-CsTeamsCallingPolicy to create a restricted calling policy:

New-CsTeamsCallingPolicy -Identity "Restricted-NoPrivateCalling" -Description "Blocks 1:1 private audio and video calls for kiosk and frontline terminals" -AllowPrivateCalling $false -AllowVoicemail "Disabled"

Confirm the new policy attributes:

Get-CsTeamsCallingPolicy -Identity "Restricted-NoPrivateCalling" | Format-List Identity, Description, AllowPrivateCalling, AllowVoicemail

Modifying Existing Calling Policies with Set-CsTeamsCallingPolicy

To update an existing policy or enforce a tenant-wide lockdown, use Set-CsTeamsCallingPolicy.

To disable 1:1 private calling globally across all standard users in the tenant:

Set-CsTeamsCallingPolicy -Identity Global -AllowPrivateCalling $false

Conversely, to re-enable 1:1 private calling on a specialized managerial or sales policy:

Set-CsTeamsCallingPolicy -Identity "Sales-Executives-Policy" -AllowPrivateCalling $true

Confirm that your changes are registered in the Teams Admin Center repository:

Get-CsTeamsCallingPolicy -Identity "Sales-Executives-Policy" | Select-Object Identity, AllowPrivateCalling

Assigning the Policy to Target Users and Security Groups

After creating or updating the calling policy, assign it to individual employees or security groups.

Assigning to an Individual User

Assign the restricted policy to a specific user account using Grant-CsTeamsCallingPolicy:

Grant-CsTeamsCallingPolicy -Identity "[email protected]" -PolicyName "Restricted-NoPrivateCalling"

Verify user policy assignment:

Get-CsUserPolicyAssignment -Identity "[email protected]" -PolicyType TeamsCallingPolicy

Assigning to an Entra ID Security Group

To apply the policy across an entire department using an Entra ID (Azure AD) security group:

# Retrieve Entra ID group Object ID
$GroupId = (Get-AzureADGroup -SearchString "Frontline Warehouse Staff").ObjectId

# Assign policy to group with priority rank
New-CsGroupPolicyAssignment -GroupId $GroupId -PolicyType TeamsCallingPolicy -PolicyName "Restricted-NoPrivateCalling" -Rank 1

Validating Client Behaviour and User Experience

After granting the policy, allow 2 to 4 hours for policy replication across Microsoft 365 cloud edge services. Validate the enforcement by opening the Microsoft Teams client as the restricted user:

1. Open a direct 1:1 chat with another internal user.
2. Inspect the top right header of the chat window: the audio call (telephone) and video call (camera) icons should be completely removed or greyed out.
3. In the left-hand app navigation bar, verify that the Calls application icon is hidden or displays a notice stating that private calling is restricted by policy.
4. Verify that the user can still participate in scheduled team meetings and join channel calls normally.

To ensure total compliance in regulated financial or healthcare spaces, combine AllowPrivateCalling $false with Messaging Policies (Set-CsTeamsMessagingPolicy) to regulate chat history and file transfer capabilities.