# How Secure Is Microsoft Teams? Defaults, Settings and Limits

> Teams encrypts everything in transit and at rest. The risk is six admin defaults and the controls that need Defender for Office 365, E5 or Teams Premium.

Canonical: https://o365hq.com/blog/how-secure-is-microsoft-teams
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-11 · IT Partner

Is Microsoft Teams secure? The service itself is: every chat, call and meeting is encrypted in transit and at rest, and Microsoft publishes how. The exposure is in the tenant settings that ship open, and in the protections that only exist once a license is assigned. This article lists the six defaults to review, the licensed controls with their October 2026 list prices, and the order to work through them.

## The short answer: the platform is encrypted, the tenant is open until you close it

Teams encrypts data in transit with TLS 1.2 or later using AES-256, and real-time media (audio, video, screen sharing) with SRTP. At rest, chat and files sit in Exchange Online, SharePoint and OneDrive, protected by BitLocker disk encryption plus per-file encryption, with an additional service-encryption layer for media content. Organizations that must hold their own keys use Microsoft Purview Customer Key, which covers Teams files and chat.

None of that stops the attacks that actually land in Teams: a phishing link pasted into a chat, a guest who stayed in a team for three years, an anonymous attendee in a confidential meeting, a third-party app with permission to read channel messages. Those are tenant configuration questions, and a new tenant answers most of them permissively: guest access is On, anonymous meeting join is On, third-party apps are allowed, and the external access setting has five modes that nobody chose on your behalf. Teams is as secure as the six settings in the next section, plus the licensed protections you have turned on.

## What Teams encrypts, and what end-to-end encryption changes

| Layer | What it covers | Default | Needs |
|---|---|---|---|
| In transit | TLS 1.2+ (AES-256) for signaling and chat; SRTP for media | On for everyone | Any Teams license |
| At rest | BitLocker plus per-file encryption in Exchange, SharePoint, OneDrive; service encryption for media | On for everyone | Any Teams license |
| Customer-managed keys | Microsoft Purview Customer Key for Teams files and chat | Off | Microsoft 365 E5 ($60.00) or the Microsoft Purview Suite add-on ($12.00 per user per month on an annual commitment) |
| End-to-end encryption, 1:1 calls | Media encrypted between the two endpoints; Microsoft cannot decrypt | Off until enabled in an enhanced encryption policy | Any Teams license |
| End-to-end encryption, meetings | Up to 200 participants (50 if the first participant joins from a Teams Rooms device) | Off | Teams Premium for the organizer; attendees need nothing |

End-to-end encryption is a trade. When it is on, recording, live captions and transcription, breakout rooms, phone dial-in and intelligent recap are unavailable, and server-side retention and eDiscovery cannot see the media. Web, VDI and cloud video interop participants are blocked from E2EE meetings, and it is not available for calls under compliance recording. Use it for the handful of conversations where a recording must not exist, not as a tenant default.

## The six admin-center defaults to review this week

Work through these in the Teams admin center in order; document each decision, not just the setting.

1. **External access (Users > External access).** Five modes: use organization settings, allow all external domains, allow only specific domains, block only specific domains, block all. A tenant nobody has touched lets users chat and meet with any other Microsoft 365 organization; decide whether that is a choice or an accident. A related control blocks trial-only tenants; its default is Blocked, enforced since 29 July 2024.
2. **Teams accounts not managed by an organization (same page).** A separate switch allows chats with personal Teams accounts. Turn it off unless you have a named business reason; with the inbound option off, unmanaged users cannot search for your people by email address.
3. **Guest access (Users > Guest access).** Microsoft's guest sharing settings reference lists the Teams guest access switch as On. If you want it off, set Off explicitly rather than leaving the service default; if you keep it on, pair it with a quarterly guest review and group expiration.
4. **Anonymous join (Meetings > Meeting policies).** Anonymous meeting join is on by default for the organization and in the Global policy. "Anonymous users and dial-in callers can start a meeting" is off by default and only matters when the lobby is set to Everyone. Unless you let everyone bypass the lobby, anonymous participants wait in the lobby; dial-in callers also wait by default.
5. **Who can bypass the lobby and who can present.** Set the Global policy so that only people in your organization (and, if you choose, guests) skip the lobby, and restrict presenting for sensitive meeting types. If you need a value that organizers cannot change, that takes a meeting template or a sensitivity label, both of which require Teams Premium.
6. **Apps (Teams apps > Manage apps > Org-wide app settings).** The Third-party apps switch governs every user and overrides per-user assignments; when it is off, every third-party app shows as Blocked org-wide. A second switch decides whether new store apps become available automatically. App-centric management has replaced app permission policies, so review access app by app.

## Meeting protection: what is standard and what needs Teams Premium

Standard Teams gives you the lobby, presenter roles, attendee chat controls and the recording policy. Teams Premium adds the protections for board, legal, HR and deal meetings: watermarks on shared content and attendee video, end-to-end encryption for meetings (the 200-participant limit above), sensitivity labels for meetings, control over who can record, and a setting that blocks copy and paste from the meeting chat. The organizer needs the license; attendees do not.

As of 1 April 2026, some capabilities that used to be Premium-only, mainly on the events side, are included with Teams Enterprise: events with reactions, polls and Q&A for up to 3,000 attendees, and view-only events up to 10,000. Customers who bought Teams Premium before that date keep the previous feature set until those licenses expire. Teams Premium is $10.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list); Teams Enterprise is on it at $8.55 per user per month on an annual commitment (Microsoft list price, October 2026 price list). Our [Teams Premium guide](/blog/teams-premium-what-it-includes-who-needs-it) covers who actually needs the add-on.

## Phishing and malware inside Teams: Defender for Office 365

Email filters do not see a link pasted into a chat. That is Defender for Office 365's job, and most of it is now in Plan 1, which Microsoft 365 Business Premium includes and which sells on its own at $2.00 per user per month (Plan 2 is $5.00; Microsoft list price, October 2026 price list).

- **Safe Links for Teams.** Time-of-click checks on URLs in chats, group chats and channels. The Built-in protection preset applies Safe Links to Teams for any tenant holding at least one Defender for Office 365 license; check that your users are not excluded from it.
- **Safe Attachments.** Scans files in SharePoint, OneDrive and Teams and blocks the malicious ones.
- **Zero-hour auto purge for Teams.** Blocks messages identified as malware or high-confidence phishing for everyone in the chat, up to 48 hours after delivery. It is in Plan 1 and Plan 2, on by default for Plan 1 tenants since 6 January 2026, and covers internal messages only. Quarantined Teams messages are kept 30 days; only admins can manage them by default.
- **User reporting.** Plan 2 users can report a Teams message as a security risk, and Microsoft has announced the same for Plan 1. Point the reports at a mailbox someone reads.

None of these cover the external chats you allowed in step one, which is why that decision comes first.

## Data leaving through Teams: DLP, retention and audit

**Data loss prevention.** DLP for SharePoint, OneDrive and Exchange is included with Microsoft 365 E3 and Business Premium. DLP for Teams chat and channel messages, including private channels, needs an E5-level entitlement: Office 365 E5, Microsoft 365 E5, Microsoft 365 E5 Compliance, or the Microsoft 365 E5 Information Protection and Governance add-on at $7.00 per user per month (Microsoft list price, October 2026 price list). A Business Premium tenant cannot block a credit card number typed into a chat until it adds one of those.

**Retention.** Teams chats and channel messages are stored in mailboxes, but an Exchange retention policy does not touch them. You must create a retention policy that targets the "Teams chats" and "Teams channel messages" locations; shared channels inherit the parent team's settings. Files shared in Teams follow the SharePoint and OneDrive policies instead.

**Sensitivity labels.** Labels on teams and groups set privacy, guest membership and external sharing for the SharePoint site behind the team; labels on meetings need Teams Premium.

**Audit.** Microsoft Purview Audit (Standard) is on by default. Entra ID, Exchange, OneDrive and SharePoint records are kept one year; other workloads, Teams included, are kept 180 days unless an Audit (Premium) retention policy extends them to one year, or ten years with the add-on license.

## Which license buys which control

| Control | Business Premium ($22.00) | Microsoft 365 E3 ($39.00) | Microsoft 365 E5 ($60.00) | Add-on if missing |
|---|---|---|---|---|
| Conditional Access for Teams sign-in | Included (Entra ID P1) | Included | Included | Entra ID P1, $7.00 |
| Safe Links, Safe Attachments, ZAP for Teams | Included (Defender for Office 365 P1) | Not included | Included (P2) | Defender for Office 365 P1, $2.00 |
| Teams message user reporting | Announced for P1 | Not included | Included (P2) | Defender for Office 365 P2, $5.00 |
| DLP for Teams chat | Not included | Not included | Included | E5 Information Protection and Governance, $7.00 |
| Audit retention beyond 180 days | Not included | Not included | Included (one year) | E5 eDiscovery and Audit, $6.00 |
| Watermarks, meeting labels, E2EE meetings | Not included | Not included | Not included | Teams Premium, $10.00 per user per month on an annual commitment |

All prices are per user per month on an annual commitment, Microsoft list price, October 2026 price list, and are billed to you at that price.

## A 60-minute Teams security review, in order

1. External access: pick a mode and write down why; block personal Teams accounts unless needed.
2. Guest access: On or Off, explicitly; if On, enable group expiration and schedule a guest review.
3. Global meeting policy: lobby bypass, presenters, anonymous start, recording.
4. Org-wide app settings: third-party apps and auto-availability of new store apps.
5. Defender for Office 365: Safe Links covers Teams, ZAP for Teams is on, reports reach a monitored mailbox.
6. Retention: a policy that names the two Teams locations.
7. Conditional Access: MFA and a compliant or app-protected device for Teams, per our [Conditional Access guide](/blog/conditional-access-policies-every-business-should-have).
8. Teams Premium for meeting protection, licensed to organizers only, if anyone needs it.
9. A quarterly review of guests, ownerless teams and inactive teams, on the calendar.

## Frequently asked questions

### Is Microsoft Teams end-to-end encrypted?

Not by default. Teams is always encrypted in transit and at rest, but end-to-end encryption is off until an admin enables it for 1:1 calls (any license) or meetings (organizer needs Teams Premium, up to 200 participants), and it removes recording, transcription, captions, breakout rooms and dial-in for that call or meeting.

### Can people outside my company message my users?

In a tenant nobody has configured, yes: external access allows other Microsoft 365 organizations, and a separate switch covers personal Teams accounts. Both live under Users > External access and can be limited to specific domains or blocked.

### Does Business Premium include DLP for Teams chat?

No. Business Premium includes DLP for Exchange, SharePoint and OneDrive; DLP for Teams messages needs Office 365 E5, Microsoft 365 E5, E5 Compliance or the E5 Information Protection and Governance add-on at $7.00 per user per month (Microsoft list price, October 2026 price list).

### Is Teams HIPAA compliant?

Teams is an in-scope Microsoft 365 service under Microsoft's Product Terms, which include a HIPAA Business Associate Agreement. Compliance still depends on your configuration: MFA, external access, guest policy, retention, audit and DLP.

### Do I need Teams Premium to secure meetings?

For most meetings, no: the lobby, presenter controls and recording policy are standard. Teams Premium is for meetings where a screenshot or recording must be deterred: watermarks, end-to-end encryption, sensitivity labels and who-can-record controls. License only the organizers of those meetings.

### How long does Microsoft keep Teams audit records?

With Audit (Standard), on by default, Teams activity records are kept 180 days; Entra ID, Exchange, SharePoint and OneDrive records are kept one year. Audit (Premium) extends retention to one year, or ten years with the add-on license.

## Sources

- [Encryption for Teams](https://learn.microsoft.com/en-us/microsoftteams/teams-encryption) — Microsoft Learn, checked 2026-10-11
- [Require end-to-end encryption for sensitive Teams meetings](https://learn.microsoft.com/en-us/microsoftteams/end-to-end-encrypted-meetings) — Microsoft Learn, checked 2026-10-11
- [Manage external meetings and chat with people and organizations using Microsoft identities](https://learn.microsoft.com/en-us/microsoftteams/manage-external-access) — Microsoft Learn, checked 2026-10-11
- [Microsoft 365 guest sharing settings reference](https://learn.microsoft.com/en-us/Office365/Enterprise/microsoft-365-guest-settings) — Microsoft Learn, checked 2026-10-11
- [Manage anonymous participant access to Teams meetings, webinars, and town halls](https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings) — Microsoft Learn, checked 2026-10-11
- [Control who can bypass the meeting lobby in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby) — Microsoft Learn, checked 2026-10-11
- [Overview of app management and governance in Teams admin center](https://learn.microsoft.com/en-us/microsoftteams/manage-apps) — Microsoft Learn, checked 2026-10-11
- [Manage Teams Premium for your organization](https://learn.microsoft.com/en-us/microsoftteams/teams-premium-dashboard) — Microsoft Learn, checked 2026-10-11
- [Teams events licensing](https://learn.microsoft.com/en-us/microsoftteams/events-licensing) — Microsoft Learn, checked 2026-10-11
- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about) — Microsoft Learn, checked 2026-10-11
- [Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge) — Microsoft Learn, checked 2026-10-11
- [Microsoft Defender for Office 365 Plan 2 support for Microsoft Teams](https://learn.microsoft.com/en-us/defender-office-365/mdo-support-teams-about) — Microsoft Learn, checked 2026-10-11
- [Data loss prevention and Microsoft Teams](https://learn.microsoft.com/en-us/purview/dlp-microsoft-teams) — Microsoft Learn, checked 2026-10-11
- [Learn about retention for Microsoft Teams](https://learn.microsoft.com/en-us/purview/retention-policies-teams) — Microsoft Learn, checked 2026-10-11
- [Microsoft Purview Audit solutions overview](https://learn.microsoft.com/en-us/purview/audit-solutions-overview) — Microsoft Learn, checked 2026-10-11

## Key takeaways

- Teams encrypts chat, calls and meetings in transit (TLS 1.2+, SRTP) and at rest; end-to-end encryption is a separate, off-by-default option that removes recording, transcription and eDiscovery for what it covers.
- Six admin-center defaults decide most of your exposure: external access, personal Teams accounts, guest access, anonymous join, lobby and presenter rules, and third-party apps.
- Safe Links for Teams, Safe Attachments and zero-hour auto purge come with Defender for Office 365 Plan 1 ($2.00 per user per month), which Business Premium includes; ZAP for Teams has been on by default for Plan 1 since 6 January 2026.
- DLP for Teams messages needs an E5-level entitlement, the cheapest being the E5 Information Protection and Governance add-on at $7.00 per user per month (Microsoft list price, October 2026 price list).
- Retention for Teams needs its own policy locations, and Teams audit records last 180 days by default.
- Teams Premium buys watermarks, meeting labels and end-to-end encrypted meetings for organizers only; since 1 April 2026 the large-event features are in Teams Enterprise instead.
- Work the settings in order, document each decision, and review guests and ownerless teams quarterly.

---

**Want the six defaults, guest lifecycle and labels set and documented in one pass?** [Microsoft Teams Governance and Sprawl Cleanup](/services/microsoft-teams-governance-sprawl-cleanup) implements naming, creation, expiration, guest policy and sensitivity labels for teams, then runs an archive-first cleanup; it is quoted in writing before work begins. If you would rather start with a conversation, [book a free 30-minute call](/book).