How to turn off Teams meeting recording by default

Turn cloud recording off in the Global meeting policy and give it, through a custom policy, to those who need it.

Every Microsoft 365 security check · Collaboration & Sharing · NL-TMS-116

What this check looks at

Checks that the organisation-wide meeting policy does not let everyone record meetings, so recording is given to the people who need it.

Cloud recording saves a meeting’s audio, video and shared screens to the organiser’s OneDrive (or the channel’s SharePoint site for channel meetings), usually with a transcript. AllowCloudRecording in the meeting policy ("Meeting recording") decides who can start a recording; Microsoft’s Global policy lets everyone record every meeting.

The check fails when AllowCloudRecording is true in the Global policy, also counting custom policies with the same value. When Global has it off but a custom policy allows it, the check warns and names the policy. A custom policy that gives recording to the few people who need it is the intended set-up, so that warning records a deliberate exception rather than a mistake.

A recording holds everything said and shown, in a file that can be downloaded, shared with a link and kept indefinitely. When recording is routine, sensitive discussions (HR cases, legal advice, pricing) end up in files nobody decided to keep, shared more widely than the meeting itself, and returned by search and Copilot to anyone the file is shared with.

Why it matters

Recordings and their transcripts hold everything said in a meeting and are easy to share. Allowing recording for everyone makes it routine, when for many meetings it should be a deliberate, agreed decision.

A typical case: a line manager records a disciplinary meeting by habit. The recording and its transcript sit in their OneDrive and are shared with HR by a link that is later forwarded. The employee asks for their personal data, and the recording, together with the managers’ chat during it, has to be disclosed and is quoted at an employment tribunal.

A recording of identifiable people is personal data under UK GDPR: it needs a lawful basis, people must be told, and it should be kept no longer than necessary. Making recording a deliberate choice for the people who need it keeps the organisation able to meet those duties.

CIS Microsoft 365 Foundations Benchmark 8.5.9 and CISA SCuBA MS.TEAMS.1.6v1 ask for meeting recording to be off by default. Recordings that already exist are unaffected.

How to fix it

Where: Teams admin centre → Meetings → Meeting policies

Before you start

  • Find out who needs to record meetings (training, HR, board minutes) and give them a custom meeting policy that allows it before turning it off in the Global policy.
  • Tell users what is changing and when, with a contact for problems.

Step by step

  1. Find out who needs to record. Ask department heads who records meetings and why (training, board minutes, client calls). Put those people in a security group, for example "Teams recording allowed". Tell everyone else that recording is being turned off and how to ask for it.
  2. Give recording to that group through a custom policy. In the Teams admin centre, go to Meetings > Meeting policies, select Global (Org-wide default) and choose Duplicate, so the new policy keeps every other Global setting. Name it "Recording allowed", turn Meeting recording on and select Save. On the Group policy assignment tab, assign it to the group. This is the one custom policy to leave allowing recording in the steps below. If you use PowerShell instead, note that New-CsTeamsMeetingPolicy starts from Microsoft’s defaults, not from Global, so set the other meeting settings to match Global too.
  3. List the meeting policies and their current value. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording. Global is the organisation-wide default; entries named Tag:<name> are custom policies, including Microsoft’s preset ones such as Tag:AllOn. Note every policy whose value is not $false; they are the ones named in the finding’s evidence.
  4. Change the organisation-wide (Global) policy. In the Teams admin centre (admin.teams.microsoft.com), go to Meetings > Meeting policies and select Global (Org-wide default). Find "Meeting recording", set it to Off and select Save. The PowerShell equivalent is Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false.
  5. Change or retire each custom policy that differs. For each custom policy you noted when listing them, run Set-CsTeamsMeetingPolicy -Identity "<policy name>" -AllowCloudRecording $false, or open it on the same Meeting policies page and make the same change. If a policy is no longer needed, find who has it (Get-CsOnlineUser -Filter "TeamsMeetingPolicy -eq '<policy name>'" | Select-Object UserPrincipalName, and Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy for group assignments), move those people back to Global (Grant-CsTeamsMeetingPolicy -Identity <user> -PolicyName $null), then delete it with Remove-CsTeamsMeetingPolicy -Identity "<policy name>".
  6. Confirm the change. Run Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording again: Global and every custom policy should show $false, apart from any exception you decided to keep. Teams can take a few hours to apply a policy change to meetings. Then sign in as a user on the Global policy, start a test meeting and open More actions > Record and transcribe: Start recording should not be available, while a member of the recording group can still record.

With PowerShell

Connect-MicrosoftTeams
Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false

What users will notice

People without the custom policy no longer see Start recording; existing recordings are unaffected.

How to confirm it worked

In Teams PowerShell, Get-CsTeamsMeetingPolicy | Select-Object Identity, AllowCloudRecording shows the value for the Global policy and every custom one; Teams can take a few hours to apply it to meetings.

Frameworks and controls

This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The frameworks and controls NL-TMS-116 maps to
FrameworkControl
NCSC CAFB3.c Stored data
DSPTStandard 1: Personal confidential data
NIS2Art. 21(2)(i) Access control and asset management
Zero TrustData
SOC 2C1.1 Identifying and maintaining confidential information
NIST SP 800-1713.1.3 Control the flow of CUI in accordance with approved authorisations
CMMC Level 2AC.L2-3.1.3 Control CUI Flow
ISO 27001:2022A.5.14 Information transferA.5.33 Protection of records
CISA SCuBAMS.TEAMS.1.6v1 Meeting recording disabled
CIS M3658.5.9 Ensure meeting recording is off by default
NIST CSF 2.0PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected
NCSC 10 StepsData security

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

The full Microsoft 365 security checklist, worst first

Check this in every tenant.

ConfigCheckup runs this check on every tenant you connect and gives you a step-by-step fix guide. The next assessment confirms the fix.

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.Where this check fits: Microsoft 365 security assessment for MSPs