How to Enable and Use End-to-End Encryption for One-to-One Calls in Microsoft Teams

In standard configurations, Microsoft Teams encrypts data in transit using industry-standard protocols such as Transport Layer Security (TLS) and Secure Real-time Transport Protocol (SRTP). While this protects conversations between user endpoints and Microsoft cloud servers, certain highly confidential discussions require zero possibility of third-party or intermediary interception. For these scenarios, Microsoft Teams offers end-to-end encryption (E2EE) for one-to-one calls, ensuring that media traffic—including voice, video, and screen sharing—is encrypted at the originating device and decrypted exclusively by the intended recipient.

Prerequisites and Administrative Policies

Before an individual user can activate end-to-end encryption on their desktop or mobile client, tenant administrators must enable the feature at the organisation level via the Microsoft Teams Admin Centre or PowerShell:

1. In the Teams Admin Centre, navigate to Enhanced encryption policies under Voice or Teams policies.
2. Ensure that End-to-end call encryption is toggled to Enabled (or configured to allow individual users to decide).
3. Assign the policy to the target security group or individual users. Changes typically propagate within a few hours across the tenant.

Both participants in the call must belong to an organisation policy that permits end-to-end encryption for the feature to function during a call.

Enabling End-to-End Encryption in Teams Client Settings

Once the administrator enables the policy, each participant must turn on the feature within their personal Teams client:

1. Open the Microsoft Teams desktop application on Windows or macOS.
2. Click the Settings and more icon (three horizontal dots) next to your profile picture at the top right of the window.
3. Select Settings from the dropdown menu.
4. Navigate to the Privacy tab in the left-hand navigation pane.
5. Scroll down to the End-to-end encrypted calls section.
6. Toggle the switch next to Turn on end-to-end encryption for one-to-one calls to the active position.

On mobile clients (iOS and Android), open Settings > Privacy > End-to-end encrypted calls and toggle the option on.

Verifying the Security Code During an Active Call

To confirm that a call is authentically encrypted and not subject to a man-in-the-middle attack, Microsoft Teams provides a cryptographically generated security code:

1. Initiate or answer a direct one-to-one voice or video call with another user who also has E2EE enabled.
2. Look for a small shield icon with a lock in the upper-left corner of the call window.
3. Click the encryption shield icon. A call details card appears displaying a 20-digit hexadecimal security code.
4. Read or compare the security code aloud with the other participant. Both callers must see the exact same 20-digit string.

If the 20-digit strings match identically on both screens, the direct cryptographic exchange is mathematically proven secure between the two endpoints.

Features Disabled During End-to-End Encrypted Calls

Because E2EE prevents Microsoft cloud media processors from decrypting and analysing the live stream, several server-side collaboration features are temporarily unavailable during encrypted calls:

Feature / Capability	Availability Under E2EE	Alternative or Explanation
Voice and Video Calling	Supported	Direct peer-to-peer encrypted media stream between both callers.
Screen Sharing	Supported	Screen content is encrypted using the same session keys.
Call Recording	Disabled	Server-side recording bots cannot decrypt the stream.
Live Captions & Transcription	Disabled	Cloud speech-to-text algorithms cannot process encrypted audio.
Call Transfer & Escalation	Disabled	Transferring a call breaks the point-to-point key handshake.
Multi-Party Group Calls	Disabled	One-to-one E2EE does not support adding a third participant.
Call Merge	Disabled	Cannot combine separate cryptographic sessions together.

Troubleshooting E2EE Connection Failures

If the shield icon does not appear when calling another user, consider the following diagnostic steps:

• Verify Both Endpoints: E2EE only activates if both the caller and recipient have toggled the setting to On in their respective clients. If either user has it disabled, Teams falls back to standard TLS/SRTP encryption.
• Client Version Requirements: Verify that both users are running up-to-date versions of the new Microsoft Teams client. Web browser clients (such as Chrome or Edge) have limited support for E2EE compared to native desktop applications.
• Corporate Firewalls and UDP: Teams prefers peer-to-peer UDP traffic for encrypted calls. Strict corporate NAT or firewall rules that block direct UDP port ranges may force traffic through Azure Media Relays, occasionally preventing direct key negotiation.