How to Configure Teams Voice Assistance Policies in PowerShell Using CsTeamsCortanaPolicy

Modern meeting spaces and personal workstations increasingly integrate natural voice user interfaces (VUI) to facilitate hands-free collaboration. In Microsoft Teams, voice assistance features (previously branded under Cortana integration) allow users to initiate calls, join upcoming calendar meetings, send chat messages, and control Microsoft Teams Rooms hardware using natural voice commands. Users can activate assistance by clicking a microphone icon in the client or by enabling passive ambient wake-word detection (invoking “Cortana”). However, in corporate boardrooms, legal consult rooms, healthcare facilities, and financial trading floors, ambient listening wake-words raise significant security and privacy concerns.

To give IT administrators precise control over voice assistants across the enterprise, Microsoft Teams provides the CsTeamsCortanaPolicy cmdlets in PowerShell. Administrators can enforce policies that restrict voice activation modes, disable hands-free wake-word detection, or completely deactivate voice assistance across specific user groups or the entire tenant.

Understanding Voice Assistance Policy Modes

The CsTeamsCortanaPolicy governs voice assistant capabilities across desktop clients, mobile devices, and Microsoft Teams Rooms (MTR) endpoints. The key operational parameter is CortanaVoiceInvocationMode, which supports three distinct enforcement levels:

• Disabled: Voice assistance is completely suppressed. The microphone button for voice assistance does not appear in the Teams mobile or desktop interface, and no ambient listening or speech recognition takes place.
• PushToTalkUserOverride: Users can access voice assistance exclusively by manually tapping or clicking the microphone icon. Hands-free ambient wake-word listening is disabled, but users can choose whether to enable push-to-talk assistance.
• DisabledUserOverride: Default setting in many enterprise tenants. Hands-free wake-word listening is disabled by default, but individual end users retain the option to enable wake-word activation within their personal Teams client settings if permitted.

Connecting to Microsoft Teams PowerShell

To inspect and configure voice assistance policies, launch an elevated PowerShell console and authenticate with Teams Administrator credentials:

# Install or update Microsoft Teams PowerShell module
Install-Module -Name MicrosoftTeams -Force -AllowClobber

# Authenticate to the corporate Teams tenant
Connect-MicrosoftTeams

Inspect existing voice assistance policies provisioned in the tenant environment:

# Retrieve current voice assistance policies
Get-CsTeamsCortanaPolicy | Format-Table Identity, Description, CortanaVoiceInvocationMode

Tenants include a default Global policy that defines the baseline behavior across all accounts unless a customized policy is assigned.

Creating a Strict Anti-Listening Policy for Executive and Legal Teams

In high-compliance environments—such as executive suites, legal counsel offices, and financial advisory departments—organizations must prevent any passive audio capture or accidental wake-word triggering. Create a strict policy completely deactivating voice assistance:

# Create strict policy completely deactivating voice assistance
New-CsTeamsCortanaPolicy -Identity "Strict-Compliance-NoVoiceAssistant" `
                         -Description "Completely disables voice assistance and ambient listening across all endpoints" `
                         -CortanaVoiceInvocationMode Disabled

When assigned to users or shared room devices, the Teams client removes voice assistance UI elements and prevents background speech parsing.

Creating a Push-to-Talk Policy for Frontline and Field Staff

For warehouse personnel or mobile frontline technicians who benefit from hands-free commands while wearing headsets, configure a policy that allows intentional push-to-talk voice commands while prohibiting passive ambient wake-words:

# Create push-to-talk voice policy for mobile staff
New-CsTeamsCortanaPolicy -Identity "Mobile-Field-PushToTalk-Policy" `
                         -Description "Enables manual push-to-talk voice assistance while blocking ambient wake words" `
                         -CortanaVoiceInvocationMode PushToTalkUserOverride

With this configuration, users must deliberately tap the microphone button on their mobile screen or certified headset, eliminating accidental ambient triggering during confidential discussions.

Enforcing Tenant-Wide Protection on the Global Policy

To establish a secure enterprise-wide baseline where ambient listening is disabled across all users by default:

# Enforce Push-to-Talk only across the entire organization
Set-CsTeamsCortanaPolicy -Identity Global `
                         -CortanaVoiceInvocationMode PushToTalkUserOverride

Applying this setting to the Global policy ensures that all newly provisioned accounts automatically inherit push-to-talk restrictions without requiring manual administrative intervention.

Modifying and Inspecting Policy Configurations

To inspect all configured parameters on an existing voice assistance policy:

# Inspect detailed policy attributes
Get-CsTeamsCortanaPolicy -Identity "Strict-Compliance-NoVoiceAssistant" | Format-List

To update the invocation mode on an existing policy dynamically:

# Update policy settings
Set-CsTeamsCortanaPolicy -Identity "Mobile-Field-PushToTalk-Policy" `
                         -CortanaVoiceInvocationMode Disabled

Assigning Voice Assistance Policies to Users and Room Accounts

Use the Grant-CsTeamsCortanaPolicy cmdlet to assign tailored policies to individual users, meeting room resource accounts, or departmental groups.

Assign the strict compliance policy to an executive user:

# Assign policy to an individual user account
Grant-CsTeamsCortanaPolicy -Identity "[email protected]" `
                           -PolicyName "Strict-Compliance-NoVoiceAssistant"

Assign the policy to a dedicated boardroom Teams Room resource account:

# Assign policy to a Teams Room console account
Grant-CsTeamsCortanaPolicy -Identity "[email protected]" `
                           -PolicyName "Strict-Compliance-NoVoiceAssistant"

To revert a user account back to the default tenant-wide Global policy:

# Revert account to Global policy inheritance
Grant-CsTeamsCortanaPolicy -Identity "[email protected]" -PolicyName $Null

By implementing targeted voice assistance policies with CsTeamsCortanaPolicy, IT security teams protect proprietary acoustic data while delivering secure, productive voice collaboration across Microsoft Teams.