# Teams meeting policies: set lobby, recording and transcription controls

> Configure Teams meeting policies for the lobby, anonymous join, recording and transcription, and learn which defaults organizers can override.

Source: https://www.epifive.com/blog/teams-meeting-policies-recording-lobby · Published 2026-10-21 · EpiFive

Teams meeting policies control the lobby, anonymous join, recording, transcription and content sharing for meetings that a user organizes. You set them per policy under Meetings > Meeting policies in the Teams admin center or with `Set-CsTeamsMeetingPolicy`, then assign the policy to users or groups. Several lobby settings are only defaults that organizers can change in Meeting options, so enforcing them takes an extra step that this article covers.

## Who this is for and what you will have at the end

This guide is for Teams and Microsoft 365 administrators who need to tighten or document meeting behaviour for a tenant, or for a group such as HR, legal or executives. By the end you will have:

- A clear picture of which settings follow the organizer and which follow the attendee.
- A lobby configuration that matches your risk level, in the admin center and in PowerShell.
- Recording, transcription and consent settings that match your retention and privacy needs.
- A short test plan to verify the result and fixes for the common surprises.

## How meeting policies work

A meeting policy is a bundle of settings assigned to users. The policy that matters for a given meeting is the one assigned to the **organizer**. A participant's own policy matters for what that participant can do in meetings they attend, such as joining external meetings, but lobby and recording defaults come from the organizer.

Users without a custom assignment get the Global (Org-wide default) policy. To treat a group differently, create a custom policy, change only the settings that differ, and assign it to users or to a group through group policy assignment. Policy changes can take up to 24 hours to take effect, so do not conclude a change failed after a few minutes.

### Settings, defaults and who can override them

The tables below use the defaults documented in the Teams settings and policies reference.

| Setting | Default | Can organizers change it per meeting? |
| --- | --- | --- |
| Anonymous users can join a meeting | On | No, it is a policy control |
| Anonymous users and dial-in callers can start a meeting | Off | No |
| Who can bypass the lobby | People in my org and guests | Yes, in Meeting options |
| People dialing in can bypass the lobby | Off | Yes, in Meeting options |
| Who can admit from lobby | Organizers and presenters | Yes, in Meeting options |
| Who can present | Everyone | Yes, in Meeting options |
| Meeting recording | On | No, it is a policy control |
| Require participant agreement for recording and transcription | Off | No |
| Recordings automatically expire | On, 120 days | No |
| Transcription | On | No |

The practical rule: on/off feature switches such as recording and anonymous join are enforced by the policy. Lobby and presenter settings are defaults that organizers can change when they schedule a meeting. If you must force a lobby value, use a meeting template or a sensitivity label. Both require a Teams Premium license, and neither supports the Who can admit from lobby setting.

## Prerequisites

- A Teams administrator role (or Global Administrator) for the Teams admin center.
- For PowerShell, the Microsoft Teams PowerShell module and a session connected with `Connect-MicrosoftTeams`.
- For external participants, the matching Teams features must be on. Guests need guest access, trusted-organization users need external access, and anonymous users need anonymous meeting join. If one of these is off, that participant type cannot join regardless of lobby settings. See [Teams external access vs guest access](https://www.epifive.com/blog/teams-external-access-vs-guest-access) for those settings.
- Teams Premium licenses for organizers if you want to enforce lobby values through templates or sensitivity labels.

Connect and look at what already exists before you change anything:

```powershell
Connect-MicrosoftTeams
Get-CsTeamsMeetingPolicy |
    Select-Object Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby,
        AllowAnonymousUsersToJoinMeeting, AllowCloudRecording, AllowTranscription
```

Note that a null or blank value in this output usually means the property is inheriting the service default rather than being unset.

## Step 1: Create a policy for the group that needs tighter control

Changing the Global policy affects everyone who has no custom assignment. For a first rollout, a separate policy is safer and easy to roll back.

1. In the Teams admin center, go to **Meetings** > **Meeting policies**.
2. Select **Add**, name the policy (for example `Restricted-Meetings`), and describe its purpose.
3. Adjust the settings in the sections below, then select **Save**.
4. Select the policy, then **Manage users** > **Assign users**, or use **Group policy assignment** to assign it to a group.

Create the policy in the admin center, then assign it to a user with PowerShell if you prefer:

```powershell
Grant-CsTeamsMeetingPolicy -Identity 'adele@contoso.com' -PolicyName 'Restricted-Meetings'
```

To assign to a group, use `Grant-CsTeamsMeetingPolicy -Group <group ID> -PolicyName 'Restricted-Meetings'`.

## Step 2: Configure the lobby

The lobby holds participants until an organizer, co-organizer or presenter admits them. The settings are in the **Meeting join & lobby** section of the policy.

### Who can bypass the lobby

This setting chooses which participant types join directly. Phone callers are controlled separately. The options map to PowerShell values for `-AutoAdmittedUsers` as follows:

| Admin center option | `-AutoAdmittedUsers` value |
| --- | --- |
| Everyone | `Everyone` |
| People in my org, trusted orgs, and guests | `EveryoneInSameAndFederatedCompany` |
| People in my org and guests | `EveryoneInCompany` |
| People who were invited | `InvitedUsers` |
| Only organizers and co-organizers | `OrganizerOnly` |

The cmdlet reference also lists `EveryoneInCompanyExcludingGuests`, which places guests and external users in the lobby while admitting everyone else in your company. The reference does not tie each admin center label to its PowerShell value one for one, so test after you set it rather than assuming the mapping.

The lobby documentation describes what each option means for each participant type. In short:

- **Everyone** lets anonymous participants straight in.
- **People in my org and guests** (the default) sends anonymous participants and people from trusted organizations to the lobby.
- **People in my org, trusted orgs, and guests** admits trusted-organization users but still holds anonymous participants.
- **People who were invited** admits people who were sent or forwarded the invite, including members of an invited distribution list of up to 10,000 users. People with only the join link wait in the lobby. For channel meetings, only channel members who were directly invited bypass the lobby.
- **Only organizers and co-organizers** holds everyone else, which suits meetings with sensitive or regulated content.

To apply a stricter default to the group:

```powershell
Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -AutoAdmittedUsers OrganizerOnly
```

### Phone callers and leaderless meetings

**People dialing in can bypass the lobby** is Off by default, so callers wait until an organizer, co-organizer or presenter admits them. Keep it off unless you have a reason, for example a conference line where the organizer is often absent.

**Anonymous users and dial-in callers can start a meeting** is Off by default and Microsoft recommends leaving it off. When it is on, people with unverified accounts can start meetings, including at unscheduled times using the meeting link. It only works when anonymous join is on at both levels and Who can bypass the lobby is set to Everyone.

```powershell
Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' `
    -AllowPSTNUsersToBypassLobby $false `
    -AllowAnonymousUsersToStartMeeting $false
```

### Anonymous join

Anonymous users are not signed in to an account that can be verified. That includes people without a work or school account, people from organizations you do not trust in external access, and people from organizations that you trust but that do not trust yours.

There are two controls. The org-wide **Anonymous users can join a meeting** setting is under **Meetings** > **Meeting settings** > **Participants**. Microsoft's reference says this setting will be removed in the future and recommends leaving it On and using the per-policy control instead. To block anonymous join only for one group, leave the org-wide setting on and turn off **Anonymous users can join a meeting** in the policy:

```powershell
Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -AllowAnonymousUsersToJoinMeeting $false
```

If you would rather let anonymous people join but only after admission, set Who can bypass the lobby to anything except Everyone.

The `BlockedAnonymousJoinClientTypes` parameter (PowerShell only) can block anonymous join from a Teams client or from a custom Azure Communication Services application. Blocking both is equivalent to disabling anonymous join completely.

### Effectively turning the lobby off

There is no single control that disables the lobby. Setting Who can bypass the lobby to Everyone and People dialing in can bypass the lobby to On has that effect, but anonymous users and callers still wait if the meeting has not started. Treat this as a deliberate exception for specific policies, not a tenant default.

## Step 3: Configure recording and transcription

The **Recording & transcription** section of the policy holds these controls.

| Setting | PowerShell parameter | Notes |
| --- | --- | --- |
| Meeting recording | `-AllowCloudRecording` | Both the organizer and the person starting the recording need recording permission |
| Transcription | `-AllowTranscription` | Controls post-meeting captions and transcription |
| Require participant agreement | `-ExplicitRecordingConsent` | Values: `Enabled`, `Disabled`, `LegitimateInterest` |
| Recordings automatically expire | `-NewMeetingRecordingExpirationDays` | 1 to 99,999 days, or -1 for never |
| Download of channel recordings | `-ChannelRecordingDownload` | `Allow` (default) or `Block` |

### Allow recording for some users only

A common pattern is to turn recording off in the Global policy and on in a custom policy for the people who need it, or the reverse. For example, to prohibit recording for the restricted group:

```powershell
Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -AllowCloudRecording $false -AllowTranscription $false
```

If organizers turn off Microsoft Copilot in Teams meetings, recording and transcription are also turned off for that meeting.

### Require consent

When consent is required, participants' audio, video and content sharing stay off until they agree to be recorded and transcribed.

```powershell
Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -ExplicitRecordingConsent Enabled
```

`LegitimateInterest` is a less restrictive option that does not require explicit agreement from participants. Decide with your privacy or legal team which option fits the jurisdictions you operate in.

### Where recordings go and how long they live

A recording of a private meeting is uploaded to the organizer's OneDrive, and a channel meeting recording goes to the channel's SharePoint site. Invited people can view it, but guests and external attendees can view it only when it is explicitly shared with them. Purview and OneDrive storage and permission rules apply as for any other file, and the recording is indexed by Microsoft 365 Search.

By default recordings expire after 120 days and then move to the recycle bin. To change the default for new recordings:

```powershell
Set-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' -NewMeetingRecordingExpirationDays 60
```

With `-ChannelRecordingDownload Block`, channel recordings and transcripts are saved to a **Recordings\View only** folder in the channel's SharePoint site. Channel owners keep full rights, while channel members can only view them. If you plan retention beyond the expiration setting, align it with your Purview retention policies.

External participants cannot record your meetings, with the exception of third-party compliance recording enabled for their organization. Organizers, co-organizers and presenters are notified and can remove such a participant.

## Step 4: Enforce values for sensitive meetings

Because organizers can change the lobby defaults, a policy alone does not guarantee the outcome. With Teams Premium, you have two enforcement options:

- **Meeting templates** (Meetings > Meeting templates) have a Security template with a Lobby setting, People dialing in can bypass the lobby, end-to-end encryption, watermarks and a restriction on copying or forwarding chat messages. The Recording & transcription template can record meetings automatically and restrict who can record.
- **Sensitivity labels** can apply protection to meetings that use the label. See [Purview sensitivity labels deployment](https://www.epifive.com/blog/purview-sensitivity-labels-deployment) for label publishing basics.

Meeting templates and sensitivity labels do not support the Who can admit from lobby setting.

## Verify the configuration

1. Wait for the policy to apply, which can take up to 24 hours, then confirm in the admin center (select the policy, then **Manage users**) that the organizer is assigned to it.

2. Read the policy back and compare against what you intended:

   ```powershell
   Get-CsTeamsMeetingPolicy -Identity 'Restricted-Meetings' |
       Select-Object Identity, AutoAdmittedUsers, AllowPSTNUsersToBypassLobby,
           AllowAnonymousUsersToJoinMeeting, AllowCloudRecording,
           AllowTranscription, ExplicitRecordingConsent
   ```

3. Schedule a meeting as the organizer and open **Meeting options**. The lobby fields should show your defaults.
4. Join from an InPrivate browser window without signing in to test the anonymous path, from a guest account, and from a phone if you use audio conferencing.
5. If a user had an unexpected lobby experience, run the lobby diagnostic tool that Microsoft provides for the lobby page. It explains the expected experience for a specific user in a specific meeting. Sign in as a Teams administrator to use it.

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| Organizer's meeting does not use the new lobby default | The policy is not assigned to the organizer, the change has not propagated, or the meeting was created before the change | Check the organizer's assigned policy, wait up to 24 hours and create a new meeting |
| Guests wait in the lobby | Who can bypass the lobby is set to People in my org, or guest access is off | Use People in my org and guests, and confirm guest access is enabled |
| Anonymous users cannot join | Anonymous join is off in Meeting settings or in the organizer's policy | Turn it on in both places, or confirm the block is intended |
| Anonymous users or callers wait even though bypass is on | Nobody verified has started the meeting yet | Expected behaviour while Anonymous users and dial-in callers can start a meeting is Off |
| Organizers can chat with lobby participants setting has no effect | Meeting chat policy is off | Meeting chat must be On for everyone or On for everyone but anonymous users |
| Users cannot record | Recording is off in the organizer's policy, or the recording initiator lacks permission | Check `AllowCloudRecording`, and confirm both the organizer and initiator have permission |
| Transcription missing on a recording | The person who started the recording needs Transcription on | Check `AllowTranscription` on that user's policy |
| Organizers keep loosening the lobby | The lobby value is only a default | Enforce it with a meeting template or sensitivity label (Teams Premium) |

One documentation caveat: the lobby article's PowerShell examples show `Set-CsTeamsEventsPolicy` and repeat `EveryoneInCompany` for two different options. The cmdlet reference lists these parameters on `Set-CsTeamsMeetingPolicy`, which is what this article uses. Read the policy back after you set it.

## Rollout checklist

- Decide which group needs stricter settings and create a custom meeting policy for it.
- Set Who can bypass the lobby, keep phone-caller bypass and leaderless meetings off unless required.
- Leave the org-wide anonymous join setting on and control anonymous join through policies.
- Set recording, transcription, consent and expiration to match your retention and privacy rules.
- Use meeting templates or sensitivity labels where a value must be enforced.
- Assign the policy to a pilot group, wait for propagation, and test as organizer, guest, anonymous and phone participant.
- Document the policy names and owners, and review them when Microsoft changes defaults.

## References

- https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference
- https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby
- https://learn.microsoft.com/en-us/microsoftteams/meeting-recording
- https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamsmeetingpolicy

## Frequently asked questions

### How do I make everyone wait in the Teams lobby until an organizer admits them?

In the Teams admin center, open Meetings > Meeting policies, select the policy and set Who can bypass the lobby to Only organizers and co-organizers. In PowerShell the equivalent value for -AutoAdmittedUsers is OrganizerOnly. This sets a default only, so organizers can change it in Meeting options unless you enforce it with a meeting template or sensitivity label, which needs Teams Premium.

### Why can anonymous users still join a meeting after I turned the setting off in meeting policy?

The behaviour depends on both the org-wide Anonymous users can join a meeting setting under Meetings > Meeting settings and the per-organizer meeting policy. Check which policy is assigned to the organizer, because the policy follows the organizer of the meeting, not the attendee. Policy changes can also take up to 24 hours to apply.

### Where are Teams meeting recordings stored?

Recordings of private meetings are uploaded to the meeting organizer's OneDrive, and recordings of channel meetings go to the channel's SharePoint site. Invited people can view the recording, while guests and external attendees can view it only if it is explicitly shared with them.

### Can I make participants consent before a meeting is recorded?

Yes. Turn on Require participant agreement for recording and transcription in the meeting policy, or set -ExplicitRecordingConsent to Enabled in PowerShell. Participants' audio, video and content sharing stay off until they agree to be included in the recording and transcript.