How to Configure End-to-End Encryption for One-on-One Calls in Microsoft Teams

While Microsoft 365 encrypts data in transit using Transport Layer Security (TLS) and data at rest using BitLocker, organizations handling sensitive corporate transactions, confidential legal interviews, or proprietary intellectual property require zero-knowledge cryptographic safeguards. Microsoft Teams supports End-to-End Encryption (E2EE) for one-on-one calls. When enabled, call media (voice and video) is encrypted directly on each caller’s device, ensuring Microsoft servers cannot decrypt or inspect the call content.

Understanding End-to-End Encryption in Microsoft Teams

In standard Microsoft Teams calls, media streams travel from user endpoints to Microsoft cloud media processing nodes, which decrypt and re-encrypt data to enable cloud recording, live captions, transcription, and multi-party mixing. When End-to-End Encryption is activated for a direct one-on-one call:

• Media streams are encrypted on the caller’s device using ephemeral session keys.
• Only the receiving participant’s device possesses the matching cryptographic key to decrypt the audio, video, and screen sharing streams.
• Intermediate Microsoft cloud relays merely forward encrypted packet streams without the ability to decode the payload.

Tenant-Level Policy Configuration in Teams Admin Center

Before individual users can activate E2EE in their Teams clients, an organization administrator must enable the capability within the Teams Admin Center:

1. Sign into the Microsoft Teams Admin Center (admin.teams.microsoft.com) using administrative credentials.
2. In the left-hand navigation menu, expand Voice and select Enhanced encryption policies.
3. Select the Global (Org-wide default) policy or click Add to create a targeted policy for specialized departments.
4. Under the End-to-end encryption setting, choose User can enable.
5. Click Save. Allow up to 24 hours for tenant-wide policy propagation to user desktop and mobile clients.

Enabling E2EE in the Desktop Teams Client

Once permitted by policy, each user must enable end-to-end encryption within their local client settings:

1. Open the Microsoft Teams desktop app on Windows or macOS.
2. Click the Settings and more (…) menu next to your profile picture in the top-right corner, then select Settings.
3. Navigate to the Privacy tab in the sidebar.
4. Scroll down to the End-to-end encrypted calls section.
5. Toggle the switch to On.

Note: For an active call to be end-to-end encrypted, both participants must have the setting toggled to On. If either caller has the feature disabled, the call reverts to standard Microsoft 365 cloud-encrypted transmission.

Verifying Encryption Security Codes During an Active Call

To confirm that a call is cryptographically secure and protected against man-in-the-middle attacks:

1. During an active one-on-one call, look for the Shield icon with a lock displayed in the upper-left corner of the call window.
2. Click the shield icon to display the Security code panel.
3. Teams presents a 20-digit verification code. Read the initial digits aloud to the other participant or compare them across a secondary trusted communication channel.
4. If the codes match identically on both screens, the call is proven to be end-to-end encrypted without unauthorized interception.

Operational Feature Limitations During E2EE Calls

Because Microsoft cloud infrastructure cannot decrypt the media stream during an E2EE call, certain cloud-dependent features are intentionally unavailable:

• Cloud Call Recording and Automated Transcription are disabled.
• Live Captions powered by cloud speech recognition are unavailable.
• Call Transfer, Call Merging, and Consult Before Transfer are disabled.
• Escalating the call to a multi-party group conference drops E2EE, reverting the call to standard tenant encryption.