Disallow recording of certain users in Teams?

Posted by mixduptransistor@reddit | sysadmin | View on Reddit | 44 comments

I've got a narrow request from the business and trying to thread the various Teams policy options and wanted to see if maybe someone has run into this and implemented it We've got a certain class of highly regulated users that we need to ensure information they provide to various constituents doesn't leak or get outside of organizational control The request is that we set, for our tenant only, a policy that any meeting where these users are a participant cannot be recorded Meetings that do not have the regulated users should be able to be recorded, and we understand we don't control meetings from other tenants these users might be invited to, but any internal to our tenant meeting they attend we want to block recording

Reply to Post

44 Comments

[-]

ProperEye8285@reddit

Teams is a collaboration platform, not a secure communications platform. if you want one of those you have to use Signal or SnapChat like the White House does! :)

[-]

chefkoch_@reddit

The Whitehouse used DMs on Truth Social.

[-]

fireandbass@reddit

Teams policy precedence is: Direct > Group > Global Create a new Meeting Policy named 'No Recording' In the Teams Admin Center > Meetings > Meeting Policies > Recording and Transcription Toggle 'Meeting Recording' to Off Apply the policy to the sensitive users and test it out. You can apply it to yourself first as a test and see if you can record or if someone else can record if they host.

[-]

Remarkable-Guess-856@reddit

This only applies if a sensitive users hosts a meeting, but has no effect if a user joins a meeting from someone else

[-]

fireandbass@reddit

I wasn't sure and its a bit unclear. Have you actually tested it?

[-]

Remarkable-Guess-856@reddit

My understanding is that policies are dictated by the host, not by the participants

[-]

fireandbass@reddit

Here's a page that OP should read. Sounds like OP could possibly do this with sensitivity labels. https://learn.microsoft.com/en-us/microsoftteams/configure-meetings-highly-sensitive-protection

[-]

sec_goat@reddit

Turn on Explicit Consent Policy, then if a user does not agree to recording no recording can happen. this is useful especially in Explicit Consent states

[-]

Remarkable-Guess-856@reddit

This only applies when the host has this set in his policy, not the participants - or am Im wrong?

[-]

sec_goat@reddit

You can push it out for your organization for all users, there's no way to stop external agencies from recording if they want to they will find a way. If you turn this on agency wide then every meeting will prompt for participant consent to record, if any one says no you can't record the meeting at all.

[-]

Remarkable-Guess-856@reddit

Yes but if I'm joining a meeting from an external party it won't apply - that's my point

[-]

sec_goat@reddit

Yeah there's nothing you can do about external meeting origins, cover what you can and make sure the policy is documented

[-]

fireandbass@reddit

Create a second tenant for your sensitive users.

[-]

34door@reddit

What would prevent someone in the meeting from using speakers (instead of headphones) and recording the audio to their phone?

[-]

TKInstinct@reddit

Maybe setup a separate tenant that would allow you to enforce separate policies? Like how CMMC does it.

[-]

jonahbek@reddit

I would look at DLP options. If you can’t block recording of specific people you might be able to craft a dlp policy to block seeing it externally.

[-]

Nydus87@reddit

Why are those users invited to the meeting to begin with lol. “We invited you to this meeting because you need to hear this information, but you can’t have a copy of it.”

[-]

mixduptransistor@reddit (OP)

it's not about a single meeting, it's more global in nature

[-]

Nydus87@reddit

I’m not saying it only has to be applicable to one specific meeting. I’m saying that as a general rule, why are you inviting people to any meeting where you also don’t want them to be allowed to retain the information presented?

[-]

gentoorax@reddit

Its fairly trivial for a teams call to be recorded outside of the teams application anyway if someone really wants to do that. Windows 11 Xbox game overlay is but one other method. Ohe of those situations where the effort you would have go to to protect these users from themselves is not really going to be worth it.

[-]

brokensyntax@reddit

How sensitive are we talking? Do people join these Teams meetings remotely (as in from home/hotel/cell phone)? Or just from various office locations? I ask because, if these are sensitive enough that they can't be recorded, then they are sensitive enough that they should only happen in person. Even if you control the laptop that someone uses to login to the meeting so they can't install a USB capture card, or OBS or XSplit, or use/access built in Windows screen recording apps, etc. I can point a camera and microphone at my laptop and capture all the details.

[-]

mixduptransistor@reddit (OP)

I mean they are not government employees with high security clearances. This is meant to be a control we can put in place to avoid having to tell this group of 150-odd people to watch to see if they're being recorded and drop the meeting if they are. It was also a little bit of an off the cuff "what's possible" request, not the end of the world if we couldn't meet it

[-]

brokensyntax@reddit

Then this sounds like a training issue, not on IT side, but on the organizers side. They have controls to set who can record in Teams when making the invite. They have controls to set who can access the recording or its transcripts. You need to go back to the requesting party, and make very sure you understand their goals, nailed down in specificity they would be willing to place before a tribunal. Yes that leaves whether or not a meeting with a particular individual gets recorded or not up to the organizer, but at the end of the day, with all of the options on how a recording may happen, this could only ever have been a policy issue, and needs to be addressed as such. Anything else is going to scapegoat IT when someone uses an alternative channel to take a recording.

[-]

itspie@reddit

Drop the meeting when they get the notification...

[-]

IdiosyncraticBond@reddit

Doesn't https://learn.microsoft.com/en-us/microsoftteams/meeting-recording#allow-or-prevent-users-from-recording describe this?

[-]

mixduptransistor@reddit (OP)

This sets who can start and stop recording in a meeting. We could of course restrict the ability to record a meeting to the members of this group, but unfortunately that doesn't meet the need which is allow anyone to record any call, except if the call has one of these special users in the call

[-]

coollll068@reddit

Administrative control but I wonder if you can have an automated bot using power automate that looks at all the invitees of meetings and if there is a meeting a minute after the start time have the bot Post in that meeting chat This meeting should not be recorded since a restricted member is present

[-]

slowclicker@reddit

Yeah, the way I understand your request: Take it out of the end-user's ability to choose. It just happens. In this case, it just works that meetings they join can't be recorded. Teams doesn't have this option. An option where a human decides not to record out of policy for those users.

[-]

WaywardSachem@reddit

People issue, legal issue, compliance issue, maybe HR issue, not IT issue.

[-]

mixduptransistor@reddit (OP)

I mean IT is here to empower and provide solutions to the business. We're a company of 3,000 users and untold external constituents that may join our calls, so I can't just say to the business IT cannot provide any controls and it's up to the users to comply. That wouldn't fly as a response to a request for setting permissions on a file share, and just because a control is odd/rare/hard to do doesn't mean just punt it as a "non IT issue" Sometimes that's a valid response, I wouldn't say this is one of those times

[-]

Steve----O@reddit

If it’s the employees job to not be recorded then it’s on the employee to leave any meetings where the recording is enabled. There are far more ways to record a meeting than just the teams recording.

[-]

mixduptransistor@reddit (OP)

Sure, we are not going to be able to ensure these folks are in a SCIF and can't be recorded by someone pointing a phone at the screen or a laser mic at their window, but it would keep casual recordings of meetings with them from slipping into random employees' OneDrives with little oversight It's less about handling a super sophisticated scenario and more about accidental leakage protection

[-]

Nydus87@reddit

Isn’t the best case scenario for any meeting that every attendee pays perfect attention and remembers everything exactly as presented? Like if you don’t want them to have the info, don’t let them join in the first place.

[-]

_RemyLeBeau_@reddit

You'll need to write some code. The updateRecordingStatus API can be queried, then boot the users that should not be recorded. You'll only have to explain/train the booted users why that may happen, instead of a ~3k user base.

[-]

ilevelconcrete@reddit

This is absolutely an IT issue.

[-]

40513786934@reddit

I've been researching Teams Premium and one of the features they list is "Designate who can record meetings" but I don't know the details

[-]

mixduptransistor@reddit (OP)

That is an available setting, but we want everyone to be able to record meetings, just not if they also include an excluded user

[-]

40513786934@reddit

so more of "Designate who can be recorded"

[-]

mixduptransistor@reddit (OP)

Exactly

[-]

Electrical_Space7100@reddit

Unfortunately, this isn't an option. Your best bet would be to require explicit consent to begin recording, and it's up to those who are recording/being recorded to understand the consequences of what they're doing.

[-]

mixduptransistor@reddit (OP)

Yeah, this is what I had found and landed on. Was hoping there was a better option, but there doesn't seem to be

[-]

inucune@reddit

Teams automatically starts recording for Copilot. You will probably need to use a different application.

[-]

mixduptransistor@reddit (OP)

Teams absolutely does not automatically start recording. We do not have Copilot rolled out to users right now anyway

[-]

7ep3s@reddit

if you don't want to be recorded, watch the recording instead of attending :D