Back to Checks
m365

Meetings global (Org-wide default) policy has meeting recording disabled by default

teams_meeting_recording_disabled
Service: teamsSeverity: medium
OfficialBuilt-inVerified
Categories:e3
Resource Type:NotDefined

Microsoft 365 Teams Global meeting policy has cloud meeting recording disabled by default (AllowCloudRecording=false).

Prowler logoProwlerprowler-provider-m365

Risk

Recording allowed by default enables uncontrolled capture of meetings, threatening confidentiality. Files and transcripts persist in collaboration stores and can be broadly shared, leading to insider exfiltration, accidental leakage, and long-lived exposure of sensitive discussions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_meeting_recording_disabled

Recommendation

Adopt a stance of no default recording and grant recording only to specific roles or groups per least privilege. Require explicit consent, restrict sharing to need-to-know, and apply retention and access controls. Periodically review policies as part of defense in depth to minimize data exposure.

Remediation

CLI

Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false

Other

1Sign in to Microsoft Teams admin center: https://admin.teams.microsoft.com
2Go to Meetings > Meeting policies
3Select Global (Org-wide default)
4Under Recording & transcription, set Cloud recording to Off
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_meeting_recording_disabled(Check):
    """Check if meeting recording is disabled by default.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for meeting recording settings.

        This method checks if meeting recording is disabled in the Global meeting policy.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_meeting_policy = teams_client.global_meeting_policy
        if global_meeting_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_meeting_policy if global_meeting_policy else {},
                resource_name="Teams Meetings Global (Org-wide default) Policy",
                resource_id="teamsMeetingsGlobalPolicy",
            )
            report.status = "FAIL"
            report.status_extended = "Meeting recording is enabled by default."

            if not global_meeting_policy.allow_cloud_recording:
                report.status = "PASS"
                report.status_extended = "Meeting recording is disabled by default."

            findings.append(report)

        return findings

References