M365TEAMS-005: Recording and transcription policies
- Platform
- Entra ID / M365
- Category
- Microsoft Teams Security
- Severity
- Medium
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Teams meeting recording and transcription features capture audio, video, and text content of meetings that may contain sensitive business discussions, strategic planning, or confidential information. Unrestricted recording capabilities allow any meeting participant to record conversations without other participants' awareness or consent. Recording and transcription policies must balance business needs with data protection and privacy compliance requirements.
Recommended value
Cloud recording restricted to meeting organizers; automatic transcription requires consent; recordings stored in approved locations with appropriate retention
Remediation
Configure the meeting policy to restrict cloud recording initiation to meeting organizers and co-organizers rather than all participants. Enable recording consent notifications so that all participants are aware when a recording begins, and configure automatic transcription settings to comply with privacy regulations in your jurisdiction. Review the storage location and retention policies for meeting recordings to ensure they are stored in a governed location with appropriate access controls and lifecycle management.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.TEAMS.1.6v1, MS.TEAMS.1.7v2
- NIST SP 800-53
- AU-2
- CIS M365 Benchmark
- 8.5.5