How to Configure Teams Screen Sharing and Desktop Control Policies in PowerShell Using CsTeamsMeetingPolicy

Screen Sharing Governance in Microsoft Teams Meetings

In enterprise collaboration environments, screen sharing is an indispensable capability for technical support, collaborative authoring, and executive presentations. However, unrestricted screen sharing introduces data protection risks, such as accidental disclosure of confidential desktop notifications, unapproved personal windows, or intellectual property. Furthermore, granting remote desktop control permissions to external participants or unvetted contractors can bypass organisational security boundaries.

Within Microsoft Teams, screen sharing, window sharing, and desktop control permissions are governed at the user and policy level via the TeamsMeetingPolicy architecture in the MicrosoftTeams PowerShell module. By managing these policies programmatically, administrators can restrict users to sharing single application windows rather than entire monitors, disable remote control handoffs, or block screen sharing altogether for sensitive compliance groups.

The central parameter governing this functionality is ScreenSharingMode, which interacts with companion control switches including AllowParticipantGiveRequestControl and AllowExternalParticipantGiveRequestControl. Configuring these parameters ensures meetings comply with organisational privacy standards while preserving productivity.

Connecting to Microsoft Teams PowerShell

To inspect and update meeting policies across your Microsoft 365 tenant, verify that the MicrosoftTeams PowerShell module is installed, and establish an authenticated administrative session with appropriate credentials (such as Teams Administrator or Global Administrator):

# Install or update Microsoft Teams PowerShell module
Install-Module -Name MicrosoftTeams -Scope CurrentUser -Force -AllowClobber

# Connect to tenant administration endpoint
Connect-MicrosoftTeams

Auditing Existing Screen Sharing Settings in CsTeamsMeetingPolicy

Before implementing changes, audit the current screen sharing and desktop control parameters configured across your existing meeting policies using Get-CsTeamsMeetingPolicy:

# Retrieve screen sharing parameters across all meeting policies
Get-CsTeamsMeetingPolicy | Select-Object Identity, ScreenSharingMode, AllowParticipantGiveRequestControl, AllowExternalParticipantGiveRequestControl, AllowSharedUnmanagedApp

The output enumerates the operational policy settings:

Identity                                     : Global
ScreenSharingMode                            : EntireScreen
AllowParticipantGiveRequestControl           : True
AllowExternalParticipantGiveRequestControl   : False
AllowSharedUnmanagedApp                      : True

The key properties define specific presentation capabilities:

• ScreenSharingMode: Dictates whether attendees can share their full desktop, only individual application windows, or cannot share content at all. Supported values are EntireScreen, SingleApplication, and Disabled.
• AllowParticipantGiveRequestControl: A boolean flag determining whether internal presenters can grant or request control of a shared screen or application window.
• AllowExternalParticipantGiveRequestControl: Controls whether external participants (including guests, anonymous attendees, or federated partners) can be granted or request desktop control.
• AllowSharedUnmanagedApp: Dictates whether presenters can share application windows that are not centrally managed through enterprise application catalogues.

Configuring Single Application Sharing to Prevent Data Spills

To mitigate the risk of users inadvertently broadcasting sensitive desktop popups, personal chat alerts, or background documents, organisations often restrict high-risk departments (such as Human Resources, Legal, or Finance) to sharing individual application windows instead of entire physical monitors.

To create a dedicated restricted sharing policy:

# Create custom meeting policy enforcing single application sharing
New-CsTeamsMeetingPolicy -Identity "RestrictedSharingPolicy" `
    -ScreenSharingMode SingleApplication `
    -AllowParticipantGiveRequestControl $true `
    -AllowExternalParticipantGiveRequestControl $false

If the policy already exists, update its parameters using Set-CsTeamsMeetingPolicy:

# Update existing policy to restrict sharing to single applications
Set-CsTeamsMeetingPolicy -Identity "RestrictedSharingPolicy" `
    -ScreenSharingMode SingleApplication `
    -AllowExternalParticipantGiveRequestControl $false

When assigned this policy, users attempting to share content in a Teams meeting will only see options to select individual open windows (such as Microsoft Word, Excel, or PowerPoint), while the option to share their entire desktop monitor is disabled.

Disabling Desktop Control Handoffs for External Attendees

Allowing external meeting attendees to take interactive control of an employee’s computer presents serious compliance and endpoint security risks. Even if internal collaboration allows colleagues to assist one another, external control should typically be disallowed across corporate tenants.

To explicitly prohibit external participants from requesting or receiving control of shared screens across the tenant-wide Global policy:

# Disable external participant desktop control in the Global policy
Set-CsTeamsMeetingPolicy -Identity "Global" `
    -AllowExternalParticipantGiveRequestControl $false

Conversely, for technical helpdesk and IT support teams that require the ability to take interactive remote control of external vendor devices or federated client desktops, create a specialised support policy with external control permitted:

# Create specialized policy permitting external remote control for IT support
New-CsTeamsMeetingPolicy -Identity "ITSupportSharingPolicy" `
    -ScreenSharingMode EntireScreen `
    -AllowParticipantGiveRequestControl $true `
    -AllowExternalParticipantGiveRequestControl $true

Disabling Screen Sharing Completely for High-Security Users

For strictly regulated environments, such as compliance-restricted contact center operators or users handling sensitive financial transactions, screen sharing can be disabled entirely:

# Create policy disabling screen sharing completely
New-CsTeamsMeetingPolicy -Identity "NoScreenSharingPolicy" `
    -ScreenSharingMode Disabled `
    -AllowParticipantGiveRequestControl $false `
    -AllowExternalParticipantGiveRequestControl $false

Assigning Screen Sharing Policies to Target Users

After defining custom meeting policies, grant them to individual users or bulk assign them to specific departmental security groups.

To assign a policy to an individual user via Grant-CsTeamsMeetingPolicy:

# Assign restricted sharing policy to a specific user
Grant-CsTeamsMeetingPolicy -Identity "[email protected]" -PolicyName "RestrictedSharingPolicy"

To bulk-assign the policy to all members of an Entra ID security group:

# Assign policy to all members of a department security group
$GroupId = (Get-MgGroup -Filter "DisplayName eq 'Finance Team'").Id
New-CsGroupPolicyAssignment -GroupId $GroupId `
    -PolicyType TeamsMeetingPolicy `
    -PolicyName "RestrictedSharingPolicy" `
    -Rank 1

To verify the effective policy applied to a user account:

# Verify user meeting policy assignment
Get-CsUserPolicyAssignment -Identity "[email protected]" -PolicyType TeamsMeetingPolicy

By tailoring ScreenSharingMode and remote control privileges across organizational roles, IT teams prevent unauthorized data leakage and maintain robust endpoint security during interactive virtual collaborations.