Microsoft Teams Call Encryption: Voice and Video Protection

Central answer

Microsoft Teams encrypts real-time voice, video and screen-sharing content in transit using standards-based transport security, including TLS and SRTP. Microsoft describes this protection as applying to data moving between participants, servers and Microsoft systems, so that calls are protected from casual interception on the network path. This is transport encryption: it protects content while it is being transmitted. It is not end-to-end encryption for ordinary Teams calls in the strongest sense of that term, because Microsoft can still process the media in its infrastructure for meeting recording, transcription, cloud services and law-enforcement compliance where those features are enabled.

How call traffic is protected

Teams uses TLS to encrypt signalling between clients and Microsoft servers. Real-time media, including audio, video and shared content, is protected with SRTP when used with the client-server and server-client paths. Screensharing in Teams also travels over an encrypted channel as part of the media stream.

The practical consequence is that someone with passive access to an office network, public Wi-Fi or an intermediate network link should not be able to read or watch the call by simply capturing packets. The claim applies to the protected transport legs and the features and versions configured by an administrator; newer platform behaviour can change, and a specific tenant configuration determines which optional services are active.

What end-to-end encryption adds

Teams also offers end-to-end encryption as a separate optional control for one-to-one calls. When an administrator enables it and both participants turn it on, real-time media is encrypted using keys that the participants control. Text chat is not covered by that Teams end-to-end encryption setting.

With end-to-end encryption enabled for a call, Microsoft states that it does not have access to the decryption keys for the media portion of that call. This is stronger than default transport protection, but it has known limits. Many recording, transcription, live captions, call transfer, translation, call park, call merge and assistant features are unavailable while the setting is active because those services need access to the media. The setting is scoped per call or per one-to-one conversation and depends on both the policy and the user control.

Privacy limits that remain

Encryption prevents exposure on the protected network path. It does not stop a participant who is present in the meeting or using the endpoint from capturing the screen, photographing it, recording externally, sharing session output or reading local media stored by the operating system. Teams recording, retention, compliance and eDiscovery features can retain call content on the server side according to tenant policy. Deletion and retention controls govern when Microsoft removes stored copies, but removal from the service does not guarantee that every cache, backup, participant copy or external capture has disappeared.

Estimates or claims about wider law-enforcement access or government interception are not included in the supplied evidence. The documented behaviour covers the protection Microsoft applies to the Teams call transport and the optional end-to-end encryption control available for supported one-to-one calls.

Practical checks before a sensitive call

• Confirm with the tenant administrator whether default transport encryption and the optional end-to-end encryption policy are enabled for the relevant users.

• For a one-to-one call where stronger protection is required, open the call encryption control and confirm that end-to-end encryption is active before discussing sensitive material.

• Disable or avoid recording and transcription when the call must not leave a durable Microsoft copy; remember that other participants may still capture it separately.

• Encrypt the computer or mobile device itself and keep it unlocked only when necessary, because transport protection does not secure media after it reaches the endpoint.

Transport encryption is enabled as part of the Teams service by default, so there is no separate interoperability toggle for ordinary protected calls. The main user-facing decision is whether to require the optional end-to-end encryption mode for supported one-to-one calls and whether to reduce server-side retention by avoiding optional processing features.