By default, all communication in Microsoft Teams is encrypted in transit using Transport Layer Security (TLS) and Secure Real-Time Transport Protocol (SRTP). However, in standard calls, media is decrypted at Microsoft cloud media processing relays to enable enterprise services such as cloud call recording, live transcription, real-time closed captions, and PSTN dialing. For organizations handling trade secrets, privileged legal communications, or intelligence operations, Microsoft Teams provides End-to-End Encryption (E2EE) for one-to-one voice and video calls—ensuring that media packets remain encrypted between client endpoints with zero decryption at Microsoft servers.
Understanding Standard Encryption vs End-to-End Encryption
Before deploying E2EE, administrators must evaluate how enabling end-to-end cryptographic encapsulation alters in-call features:
| Feature | Standard Microsoft Teams Call | E2EE Encrypted 1:1 Call |
|---|---|---|
| Encryption Standard | TLS / SRTP (Hop-by-hop via Microsoft Cloud) | DTLS / SRTP (End-to-End client-to-client) |
| Cloud Call Recording | Supported | Disabled (Blocked by design) |
| Live Captions / Transcription | Supported | Disabled (Blocked by design) |
| Call Escalation to Group Call | Supported | Disabled (Terminates E2EE upon 3rd participant) |
| Call Transfer / Call Park | Supported | Disabled |
Enabling E2EE Policies in the Microsoft Teams Admin Center
End-to-end encryption is managed through administrative call policies and is disabled by default tenant-wide:
- Sign in to the Microsoft Teams admin center as a Global Administrator or Teams Administrator.
- In the left sidebar, navigate to Voice > Enhanced encryption policies.
- Select the Global (Org-wide default) policy, or click Add to create a targeted policy assigned to executive leadership or legal teams.
- Toggle End-to-end call encryption to Users can enable (or Always enabled).
- Click Save. (Policy propagation across Microsoft 365 can take up to 24 hours).
Enabling E2EE via Microsoft Teams PowerShell Module
Administrators can configure and assign enhanced encryption policies programmatically using PowerShell:
# Connect to Microsoft Teams PowerShell
Connect-MicrosoftTeams
# Create a custom enhanced encryption policy
New-CsTeamsEnhancedEncryptionPolicy -Identity "Executive-Confidential-E2EE" -CallingEndtoEndEncryptionEnabledType "UserCanEnable"
# Grant the policy to a specific user
Grant-CsTeamsEnhancedEncryptionPolicy -Identity "[email protected]" -PolicyName "Executive-Confidential-E2EE"Enabling End-to-End Encryption in the Desktop and Mobile Client
Once the admin policy is granted, individual users must activate the feature in their Teams client settings:
- In the Microsoft Teams desktop client (Windows or macOS), click the Settings and more (…) button next to your profile picture and select Settings.
- Select Privacy from the left sidebar.
- Scroll down to the End-to-end encrypted calls section.
- Toggle the switch to On.
Note: Both call participants must have the feature enabled in their respective settings for E2EE to engage automatically during a one-to-one call.
Verifying the Security Code During a Live Call
When an encrypted call connects between two endpoints:
- A prominent Shield with a Padlock icon appears in the top-left corner of the call window.
- Clicking the shield icon reveals a 20-digit security verification code.
- Both participants can read the first few digits aloud to each other. If the numbers match on both ends, participants have absolute cryptographic certainty that the call is secure against man-in-the-middle (MITM) interception.
Configuring End-to-End Encryption in Microsoft Teams ensures that high-value discussions remain private and impervious to surveillance.