Teams meeting policies: set lobby, recording and transcription controls

Teams meeting policies control the lobby, anonymous join, recording, transcription and content sharing for meetings that a user organizes. You set them per policy under Meetings > Meeting policies in the Teams admin center or with Set-CsTeamsMeetingPolicy, then assign the policy to users or groups. Several lobby settings are only defaults that organizers can change in Meeting options, so enforcing them takes an extra step that this article covers.

Who this is for and what you will have at the end

This guide is for Teams and Microsoft 365 administrators who need to tighten or document meeting behaviour for a tenant, or for a group such as HR, legal or executives. By the end you will have:

• A clear picture of which settings follow the organizer and which follow the attendee.
• A lobby configuration that matches your risk level, in the admin center and in PowerShell.
• Recording, transcription and consent settings that match your retention and privacy needs.
• A short test plan to verify the result and fixes for the common surprises.

How meeting policies work

A meeting policy is a bundle of settings assigned to users. The policy that matters for a given meeting is the one assigned to the organizer. A participant's own policy matters for what that participant can do in meetings they attend, such as joining external meetings, but lobby and recording defaults come from the organizer.

Users without a custom assignment get the Global (Org-wide default) policy. To treat a group differently, create a custom policy, change only the settings that differ, and assign it to users or to a group through group policy assignment. Policy changes can take up to 24 hours to take effect, so do not conclude a change failed after a few minutes.

Settings, defaults and who can override them

The tables below use the defaults documented in the Teams settings and policies reference.

The practical rule: on/off feature switches such as recording and anonymous join are enforced by the policy. Lobby and presenter settings are defaults that organizers can change when they schedule a meeting. If you must force a lobby value, use a meeting template or a sensitivity label. Both require a Teams Premium license, and neither supports the Who can admit from lobby setting.

Prerequisites

• A Teams administrator role (or Global Administrator) for the Teams admin center.
• For PowerShell, the Microsoft Teams PowerShell module and a session connected with Connect-MicrosoftTeams.
• For external participants, the matching Teams features must be on. Guests need guest access, trusted-organization users need external access, and anonymous users need anonymous meeting join. If one of these is off, that participant type cannot join regardless of lobby settings. See Teams external access vs guest access for those settings.
• Teams Premium licenses for organizers if you want to enforce lobby values through templates or sensitivity labels.

Connect and look at what already exists before you change anything:

Connect-MicrosoftTeams
Get-CsTeamsMeetingPolicy |
    Select-Object Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby,
        AllowAnonymousUsersToJoinMeeting, AllowCloudRecording, AllowTranscription

Note that a null or blank value in this output usually means the property is inheriting the service default rather than being unset.

Step 1: Create a policy for the group that needs tighter control

Changing the Global policy affects everyone who has no custom assignment. For a first rollout, a separate policy is safer and easy to roll back.

1. In the Teams admin center, go to Meetings > Meeting policies.
2. Select Add, name the policy (for example Restricted-Meetings), and describe its purpose.
3. Adjust the settings in the sections below, then select Save.
4. Select the policy, then Manage users > Assign users, or use Group policy assignment to assign it to a group.

Create the policy in the admin center, then assign it to a user with PowerShell if you prefer:

Grant-CsTeamsMeetingPolicy -Identity '[email protected]' -PolicyName 'Restricted-Meetings'

To assign to a group, use Grant-CsTeamsMeetingPolicy -Group <group ID> -PolicyName 'Restricted-Meetings'.

Step 2: Configure the lobby

The lobby holds participants until an organizer, co-organizer or presenter admits them. The settings are in the Meeting join & lobby section of the policy.

Who can bypass the lobby

This setting chooses which participant types join directly. Phone callers are controlled separately. The options map to PowerShell values for -AutoAdmittedUsers as follows:

The cmdlet reference also lists EveryoneInCompanyExcludingGuests, which places guests and external users in the lobby while admitting everyone else in your company. The reference does not tie each admin center label to its PowerShell value one for one, so test after you set it rather than assuming the mapping.

The lobby documentation describes what each option means for each participant type. In short:

• Everyone lets anonymous participants straight in.
• People in my org and guests (the default) sends anonymous participants and people from trusted organizations to the lobby.
• People in my org, trusted orgs, and guests admits trusted-organization users but still holds anonymous participants.
• People who were invited admits people who were sent or forwarded the invite, including members of an invited distribution list of up to 10,000 users. People with only the join link wait in the lobby. For channel meetings, only channel members who were directly invited bypass the lobby.
• Only organizers and co-organizers holds everyone else, which suits meetings with sensitive or regulated content.

To apply a stricter default to the group:

Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -AutoAdmittedUsers OrganizerOnly

Phone callers and leaderless meetings

People dialing in can bypass the lobby is Off by default, so callers wait until an organizer, co-organizer or presenter admits them. Keep it off unless you have a reason, for example a conference line where the organizer is often absent.

Anonymous users and dial-in callers can start a meeting is Off by default and Microsoft recommends leaving it off. When it is on, people with unverified accounts can start meetings, including at unscheduled times using the meeting link. It only works when anonymous join is on at both levels and Who can bypass the lobby is set to Everyone.

Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' `
    -AllowPSTNUsersToBypassLobby $false `
    -AllowAnonymousUsersToStartMeeting $false

Anonymous join

Anonymous users are not signed in to an account that can be verified. That includes people without a work or school account, people from organizations you do not trust in external access, and people from organizations that you trust but that do not trust yours.

There are two controls. The org-wide Anonymous users can join a meeting setting is under Meetings > Meeting settings > Participants. Microsoft's reference says this setting will be removed in the future and recommends leaving it On and using the per-policy control instead. To block anonymous join only for one group, leave the org-wide setting on and turn off Anonymous users can join a meeting in the policy:

Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -AllowAnonymousUsersToJoinMeeting $false

If you would rather let anonymous people join but only after admission, set Who can bypass the lobby to anything except Everyone.

The BlockedAnonymousJoinClientTypes parameter (PowerShell only) can block anonymous join from a Teams client or from a custom Azure Communication Services application. Blocking both is equivalent to disabling anonymous join completely.

Effectively turning the lobby off

There is no single control that disables the lobby. Setting Who can bypass the lobby to Everyone and People dialing in can bypass the lobby to On has that effect, but anonymous users and callers still wait if the meeting has not started. Treat this as a deliberate exception for specific policies, not a tenant default.

Step 3: Configure recording and transcription

The Recording & transcription section of the policy holds these controls.

Allow recording for some users only

A common pattern is to turn recording off in the Global policy and on in a custom policy for the people who need it, or the reverse. For example, to prohibit recording for the restricted group:

Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -AllowCloudRecording $false -AllowTranscription $false

If organizers turn off Microsoft Copilot in Teams meetings, recording and transcription are also turned off for that meeting.

Require consent

When consent is required, participants' audio, video and content sharing stay off until they agree to be recorded and transcribed.

Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -ExplicitRecordingConsent Enabled

LegitimateInterest is a less restrictive option that does not require explicit agreement from participants. Decide with your privacy or legal team which option fits the jurisdictions you operate in.

Where recordings go and how long they live

A recording of a private meeting is uploaded to the organizer's OneDrive, and a channel meeting recording goes to the channel's SharePoint site. Invited people can view it, but guests and external attendees can view it only when it is explicitly shared with them. Purview and OneDrive storage and permission rules apply as for any other file, and the recording is indexed by Microsoft 365 Search.

By default recordings expire after 120 days and then move to the recycle bin. To change the default for new recordings:

Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -NewMeetingRecordingExpirationDays 60

With -ChannelRecordingDownload Block, channel recordings and transcripts are saved to a Recordings\View only folder in the channel's SharePoint site. Channel owners keep full rights, while channel members can only view them. If you plan retention beyond the expiration setting, align it with your Purview retention policies.

External participants cannot record your meetings, with the exception of third-party compliance recording enabled for their organization. Organizers, co-organizers and presenters are notified and can remove such a participant.

Step 4: Enforce values for sensitive meetings

Because organizers can change the lobby defaults, a policy alone does not guarantee the outcome. With Teams Premium, you have two enforcement options:

• Meeting templates (Meetings > Meeting templates) have a Security template with a Lobby setting, People dialing in can bypass the lobby, end-to-end encryption, watermarks and a restriction on copying or forwarding chat messages. The Recording & transcription template can record meetings automatically and restrict who can record.
• Sensitivity labels can apply protection to meetings that use the label. See Purview sensitivity labels deployment for label publishing basics.

Meeting templates and sensitivity labels do not support the Who can admit from lobby setting.

Verify the configuration

1. Wait for the policy to apply, which can take up to 24 hours, then confirm in the admin center (select the policy, then Manage users) that the organizer is assigned to it.

2. Read the policy back and compare against what you intended:

   Get-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' |
       Select-Object Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby,
           AllowAnonymousUsersToJoinMeeting, AllowCloudRecording,
           AllowTranscription, ExplicitRecordingConsent

3. Schedule a meeting as the organizer and open Meeting options. The lobby fields should show your defaults.

4. Join from an InPrivate browser window without signing in to test the anonymous path, from a guest account, and from a phone if you use audio conferencing.

5. If a user had an unexpected lobby experience, run the lobby diagnostic tool that Microsoft provides for the lobby page. It explains the expected experience for a specific user in a specific meeting. Sign in as a Teams administrator to use it.

Troubleshooting

One documentation caveat: the lobby article's PowerShell examples show Set-CsTeamsEventsPolicy and repeat EveryoneInCompany for two different options. The cmdlet reference lists these parameters on Set-CsTeamsMeetingPolicy, which is what this article uses. Read the policy back after you set it.

Rollout checklist

• Decide which group needs stricter settings and create a custom meeting policy for it.
• Set Who can bypass the lobby, keep phone-caller bypass and leaderless meetings off unless required.
• Leave the org-wide anonymous join setting on and control anonymous join through policies.
• Set recording, transcription, consent and expiration to match your retention and privacy rules.
• Use meeting templates or sensitivity labels where a value must be enforced.
• Assign the policy to a pilot group, wait for propagation, and test as organizer, guest, anonymous and phone participant.
• Document the policy names and owners, and review them when Microsoft changes defaults.

References

• https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference
• https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby
• https://learn.microsoft.com/en-us/microsoftteams/meeting-recording
• https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy