What this check looks at
Checks that the organisation-wide meeting policy does not let everyone record meetings, so recording is given to the people who need it.
Cloud recording saves a meeting’s audio, video and shared screens to the organiser’s OneDrive (or the channel’s SharePoint site for channel meetings), usually with a transcript. AllowCloudRecording in the meeting policy ("Meeting recording") decides who can start a recording; Microsoft’s Global policy lets everyone record every meeting.
The check fails when AllowCloudRecording is true in the Global policy, also counting custom policies with the same value. When Global has it off but a custom policy allows it, the check warns and names the policy. A custom policy that gives recording to the few people who need it is the intended set-up, so that warning records a deliberate exception rather than a mistake.
A recording holds everything said and shown, in a file that can be downloaded, shared with a link and kept indefinitely. When recording is routine, sensitive discussions (HR cases, legal advice, pricing) end up in files nobody decided to keep, shared more widely than the meeting itself, and returned by search and Copilot to anyone the file is shared with.
Why it matters
Recordings and their transcripts hold everything said in a meeting and are easy to share. Allowing recording for everyone makes it routine, when for many meetings it should be a deliberate, agreed decision.
A typical case: a line manager records a disciplinary meeting by habit. The recording and its transcript sit in their OneDrive and are shared with HR by a link that is later forwarded. The employee asks for their personal data, and the recording, together with the managers’ chat during it, has to be disclosed and is quoted at an employment tribunal.
A recording of identifiable people is personal data under UK GDPR: it needs a lawful basis, people must be told, and it should be kept no longer than necessary. Making recording a deliberate choice for the people who need it keeps the organisation able to meet those duties.
CIS Microsoft 365 Foundations Benchmark 8.5.9 and CISA SCuBA MS.TEAMS.1.6v1 ask for meeting recording to be off by default. Recordings that already exist are unaffected.
How to fix it
Where: Teams admin centre → Meetings → Meeting policies
Before you start
- Find out who needs to record meetings (training, HR, board minutes) and give them a custom meeting policy that allows it before turning it off in the Global policy.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Find out who needs to record. Ask department heads who records meetings and why (training, board minutes, client calls). Put those people in a security group, for example "Teams recording allowed". Tell everyone else that recording is being turned off and how to ask for it.
- Give recording to that group through a custom policy. In the Teams admin centre, go to Meetings > Meeting policies, select Global (Org-wide default) and choose Duplicate, so the new policy keeps every other Global setting. Name it "Recording allowed", turn Meeting recording on and select Save. On the Group policy assignment tab, assign it to the group. This is the one custom policy to leave allowing recording in the steps below. If you use PowerShell instead, note that New-CsTeamsMeetingPolicy starts from Microsoft’s defaults, not from Global, so set the other meeting settings to match Global too.
- List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
- Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Meeting recording", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false.
- Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowCloudRecording $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
- Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then sign in as a user on the Global policy, start a test meeting and open More actions > Record and transcribe: Start recording should not be available, while a member of the recording group can still record.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false
What users will notice
People without the custom policy no longer see Start recording; existing recordings are unaffected.
How to confirm it worked
In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | C1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.14 Information transferA.5.33 Protection of records |
| CISA SCuBA | MS.TEAMS.1.6v1 Meeting recording disabled |
| CIS M365 | 8.5.9 Ensure meeting recording is off by default |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Teams meeting recording (Microsoft Learn)