Keep Your Virtual Meetings Safe With Teams Premium

April 7, 2023
15 min read

Virtual meetings have become the new norm, especially during the pandemic, and for good reason. They’re cost-effective, time-saving, and convenient. However, virtual meetings can come with their own set of challenges, particularly when it comes to security. That's where Teams Premium comes in.

Teams Premium is an add-on license that brings additional features to the current Teams experience, making it more personalized, intelligent, and protected. It’s perfect for organizations that want to get the most out of their virtual meetings while keeping them safe and secure. It comes with a new webinar experience that helps deepen engagement with internal and external audiences. The add-on extends current functionality with registration waitlists and manual approvals, automated reminder emails, a virtual green room for hosts and presenters, and controls to manage what attendees can see. Finally, virtual Appointments is another area where Teams Premium adds further value for your organization.

To use Teams Premium, you’ll need to first subscribe to a version of Teams. It is available for commercial, government, and nonprofit customers with Microsoft 365 or Microsoft Teams Essentials.

This article will not cover all available functionality of Teams Premium, instead solely focusing on the security aspects of this add-on. For more detailed information about Teams Premium and licensing information, see here. To learn more about the new webinar experience in Teams, see my fellow TekkiGuru writer Knut’s article

Premium Security

Let’s look further into how Teams Premium can protect your meetings and meeting content. Breaking down the security features one by one, we have the following functionality:

  • Watermarks
  • Recording permissions
  • Copy chat protection
  • Teams meeting templates
  • Sensitivity labels for meetings

Templates and sensitivity labels are used to control the other settings in this list, as well as other meeting options, in various ways. They will be covered later in the article.

Now, let's investigate these features in depth!

Watermarks

You can enable watermarks to be displayed in Teams meetings on both shared content and attendees’ video. Once enabled, watermarks show the email address of meeting participants on the shared content and/or video itself and cannot be turned off by attendees. Using watermarks can be helpful when sharing confidential information, where you want to lower the risk of any attendee sharing this content outside of the meeting.

To enable watermarks on the tenant level, go to the Teams admin center, select Meeting policies from the left-hand side menu and select an existing policy or create a new one that you want to apply watermarks to. Toggle either or both of the watermark settings available. Once enabled here, watermarks can be configured for meetings using the meeting options, a meeting template, or sensitivity labels configured for meetings.

This image shows where to enable watermarking in Teams admin center
Figure 1: To use watermarks, you must first enable them in the Teams admin center. | Used with permission from Microsoft.

You can also enable or disable watermarks using the following PowerShell commands:

Set-CsTeamsMeetingPolicy -Identity Global -AllowWatermarkForCameraVideo $True
Set-CsTeamsMeetingPolicy -Identity Global -AllowWatermarkForScreenSharing $True

With these options enabled at the tenant level, any user assigned to the watermark-enabled meeting policy can manually enable it for any meeting via the meetings options as seen below:

This setting shows where you enable watermarking in the Teams meeting options
Figure 2: When enabled in the tenant, watermark is visible within the meeting options. | Used with permission from Microsoft.

When shared content or video is shared, there will be a watermark showing the name of the viewer. This is to prevent a participant from copying and sharing the content, since the person’s name is clearly visible on the copied content.

Watermark for Teams meetings - Microsoft Support
Figure 3: Watermarks show the attendee’s own name, so any unauthorized copying always reveals the name of the person that copied the content. | Used with permission from Microsoft.

The following table shows where the watermark settings can be set:

SettingAdmin policySensitivity labelTemplateMeeting options
Watermark videosEnable onlyYesYesYes
Watermark shared contentEnable onlyYesYesYes

Finally, a couple of caveats are in order about watermarks. First, at the time of this writing, watermarks are not supported on all platforms and may result in an audio-only experience for some participants. Second, when watermarks are in use, some meeting features such as recording, large gallery, together mode, PowerPoint Live, whiteboard, and content from camera are turned off.

For more information about watermarks and how to configure them, see here.

End-to-end encryption

End-to-end encryption (E2EE) is a method of encrypting information so that it can only be decrypted by the intended recipient. In the case of Teams meetings, E2EE ensures that only the participants of the meeting can hear and see the communication. No one, not even Microsoft, has access to the decrypted conversation. E2EE should be used to ensure full confidentiality for highly sensitive meetings.

By default, end-to-end encryption for meetings is not enabled. You can enable it by selecting Enhanced encryption policies, available from the Teams admin center once there’s an active Teams Premium subscription.

This image shows where to configure E2EE in Teams admin center
Figure 4: E2EE can’t be mandated within the encryption policy, only made optional. You can use templates or labels to mandate it. | Used with permission from Microsoft.

Once enabled, meeting organizers with a Teams Premium license have the option of choosing E2EE via the meeting options when they create a meeting. You can also mandate E2EE by using a meeting template or a sensitivity label, just as with watermarks.

During an E2EE meeting, Teams secures audio, video, and screen sharing. Default encryption in Microsoft 365 protects chat, file sharing, presence, and other content in the meeting. However, apps, avatars, reactions, chat, and Q&A are not end-to-end encrypted!

Several features are not available during an end-to-end encrypted meeting, such as live captions and transcription, recording, together mode, companion mode, large gallery, breakout rooms, PowerPoint Live, and Excel Live.

E2EE is an effective way to ensure the security of your sensitive Teams meetings and help you protect your organization's confidential information from unauthorized access. That said, using it for all meetings might not be a good idea if you use any of the features it disables.

For more information about end-to-end encryption for meetings, see here.

Recording Permissions

By default, Teams allows easy recording for meeting participants, but the Teams administrator has overall control over whether meeting recording is enabled in the tenant or not. With Teams Premium, meeting organizers get additional options to manage who can record in Teams meetings. There are two options for who can record:

  • organizers and co-organizers
  • organizers and presenters
Image showing the meeting recording permissions in the meeting options
Figure 5: Meeting organizers can set recording permissions within the meeting options. | Used with permission from Microsoft.

If you have meetings where sensitive information is being shared and you want to limit the ability to record to organizers and co-organizers only, you can enforce this setting by using the meeting options, a meeting template, or a sensitivity label configured for meetings. This will ensure that only those who are authorized to do so can start a recording.

If you need to prevent meetings from being recorded entirely, you must configure recording options in a meetings policy in the Teams admin center. This setting cannot be configured any other way.

Both meeting organizers and administrators can configure whether meetings are automatically recorded. The following table shows the features available to help manage meeting recordings and where they can be configured:

SettingMeeting policySensitivity labelTemplateMeeting options
Prevent meeting recordingYesNoNoNo
Who can recordNoYesYesYes
Record automaticallyNoYesYesYes

Chat Options

If your organization requires a high level of security, with Teams Premium, you can use a sensitivity label to prevent attendees from copying or saving chat content. When trying to copy text from the chat in the meeting with this feature enabled, the user will be prompted with the following message:

Image of disclaimer, not being able to copy meeting chat
Figure 6: Any attempt to copy the chat will not work when the appropriate sensitivity label is enabled. | Used with permission from Microsoft.

Since this setting is only available using a sensitivity label, now is the perfect time to dive into how to use sensitivity labels in Teams meetings!

Sensitivity Labels

Microsoft’s sensitivity labels have long offered protection to documents and emails by limiting access to authorized users. These labels can now be applied to Teams meetings and chats using the Teams Premium add-on. A label can enforce specific meeting options, such as:

  • Who can bypass the lobby
  • Who can present
  • Who can record
  • E2EE for meeting video and audio
  • Automatic recording
  • Video watermarking for screen sharing and video
  • Preventing copying of meeting chat content

Sensitivity labels can also be applied to the invitation and limiting access to authorized users only.

Teams labels, like all sensitivity labels, are configured from the Microsoft Purview administrative center, which is reached at compliance.microsoft.com. When configuring a label, you are able to include meetings:

This image shows the setting that needs to be ticked in order to configure a sensitivity label for meetings
Figure 7: You can set labels to apply to Teams meetings and chats. This can be applied to both new and existing labels. | Used with permission from Microsoft.

When selecting Protect Teams meetings and chats, you are prompted with additional settings related to meetings.

This image shows the settings you can configure for meetings within a sensitivity label
Figure 8: Any settings made here will be enforced if the label is applied to a meeting. | Used with permission from Microsoft.

After a label has been configured, a label policy is needed to publish it. Within a label policy, you can set a default label for meetings just like you can with files and email. You can also make it a requirement to apply a label to meetings.

Image showing the default label setting and the require a label for meetings setting when creating a sensitivity label
Figure 9: Use a default label and/or require one to be applied if necessary to ensure compliance. | Used with permission from Microsoft.

Once you configure and publish a label for meetings, you get the option to apply a sensitivity label in Meeting options. If you selected the default label in the label policy, it will be applied automatically.

Image of the Teams meeting options after publishing a label
Figure 10: The label option within Meeting options shows when you have published labels configured for meetings. | Used with permission from Microsoft.

Depending on how the label was configured, it may override some meeting options. Below, you can see that watermarking options and Who can record are set by the label I’ve configured and applied to the meeting. Those options are now greyed out and can't be changed.

Image of the Teams meeting options after applying a Teams meeting sensitivity label on it
Figure 11: With a sensitivity label applied, any options that label configures cannot be changed in Meeting options. | Used with permission from Microsoft.

For more information about how to configure and use sensitivity labels in Teams meetings, see here.

Meeting Templates

Microsoft Teams Premium offers the ability to create custom meeting templates that allow you to control meeting settings that the meeting organizer normally controls. With templates, you can create consistent meeting experiences in your organization and help enforce compliance requirements and business rules.

Meeting templates can be used to both enforce settings and set default values. Each template setting can be locked, so the meeting organizer can't change it, or it can be left unlocked for the meeting organizer to change if needed.

The following meeting settings can be controlled using a meeting template:

  • Chat: Specifies if the meeting chat is available, and whether people can chat before and after the meeting.
  • E2EE: Specifies if the meeting is encrypted.
  • Lobby: Specifies who can bypass the lobby and join the meeting directly.
  • Manage what attendees see: Specifies if meeting organizers can preview and approve content being shared on-screen before other meeting participants can see it.
  • Mic and camera for attendees: Specifies if attendees can unmute and use their camera.
  • Notify when callers join and leave: Specifies if a sound plays when people calling in by phone join or leave the meeting.
  • Q&A: Specifies if attendees can use the Q&A feature to ask questions during the meeting.
  • Reactions: Specifies if attendees can use reactions or raise their hand in the meeting.
  • Recording: Specifies who can record and if the meeting is recorded automatically.
  • Sensitivity label: Specifies the sensitivity label to be used for the meeting.
  • Watermarks: Specifies if watermarks are used for camera feeds and content that is shared on-screen in the meeting.

Meeting templates can be useful for various scenarios, such as enforcing automatic meeting recording for certain types of meetings, restricting chat and attendee camera and audio. They also allow you to use a stricter default for who can bypass the lobby, but still allow the meeting organizer to change the setting if needed.

You may have noticed in the list above that templates can apply a sensitivity label to meetings, which itself can be used to control some of the same settings as templates. If any of these overlapping settings are configured in the sensitivity label, they will override those settings in the template. However, some settings can only be applied by using a label and others by a template. These settings are exclusively available via a sensitivity label:

  • Control who can present
  • Prevent copying chat content to clipboard

And these settings are only available in templates:

  • Manage what attendees can see
  • QnA
  • Reactions
  • Mic and camera for attendees
  • Notify when callers join and leave

Using labels in combination with templates and individual user settings ensures you can create and conduct Teams meetings easily with a secure baseline automatically applied, while still allowing the organizer to change some selected settings.

Configuring Templates

When your Teams Premium subscription is activated, you will have the Meeting templates option available from the Teams admin center:

Image of the Meeting Template option in Teams admin center
Figure 12: When you have an active Teams Premium subscription, additional functionality is visible and configurable from the Teams admin center. | Used with permission from Microsoft.

Selecting Meeting templates will show you all existing templates and let you view, edit, duplicate, or delete them. From here you can also create new templates.

Image of the page where you can see and edit meeting templates
Figure 13: You can create multiple templates for different meeting types. | Used with permission from Microsoft.

Selecting Add takes you to a new page where you can start configuring your new template. As seen below, you can choose an existing sensitivity label and apply it to the template.

Image of the Teams meeting template configuration page
Figure 14: Adding a sensitivity label will override any conflicting settings configured in the template. | Used with permission from Microsoft.

In figure 15 below, you can see the options to lock and unlock any settings made. This will prevent meeting organizers from changing these settings manually via Meeting options.

Image showing the confirmation of locking a meeting option in a teams meeting template
Figure 15: Use the lock feature to enforce any settings from being changed by the meeting organizers. | Used with permission from Microsoft.

When the template is created, you need to publish it, just like with labels. From the Teams admin center, select Meeting template policies. Template policies will dictate what templates are available to whom.

Image of the meeting template policies in Teams admin center
Figure 16: You can assess which templates should be available to whom and create different policies if needed. | Used with permission from Microsoft.

You can create multiple policies and assign these to different users in your organization. In figure 16, the default Global policy (Org-wide default) is applied.

When configuring the policy, you can select what specific templates should be visible to users with the policy assigned. If you want certain users have some templates available only for them, separate policies can be created for this scenario.

Image showing the setting of a teams meeting template policy
Figure 17: Adding and removing templates from meeting template policies by using show/hide is very easy. | Used with permission from Microsoft.

Seen above, the template "Sensitive meeting" is configured as viewable for users assigned to this policy. All other existing templates are hidden.

Meeting Templates: The User Experience

As a user assigned to a template policy, we open the calendar in our Teams client. When we select the dropdown arrow next to the New meeting button, we can view and select the template "Sensitive meeting":

Image of the meeting templates visible from the calendar in Teams
Figure 18: The meeting template policy a user is assigned to determines what templates are visible to them. In this case, there are four templates available: | Used with permission from Microsoft.

If we open Meeting options, we can see that some of the settings are greyed out and can't be changed. This is because we locked those settings for this template. Since we also applied a sensitivity label to it, any settings configured with that label can't be changed either.

Image of the Teams meetings options after configuring options with labels and templates
Figure 19: Ultimately, what settings are preconfigured and enforced depends on if you use a label and/or a template. | Used with permission from Microsoft.

You have now learned how to create and use templates and sensitivity labels, both separately and together!

To learn more about templates and sensitivity labels for Teams meetings, see here.

Summary

I’ve covered the security aspects of Teams Premium, and as you can see, there’s quite a lot to learn and experiment with in order to use these optimally. Luckily, Microsoft provides you with great documentation and scenario-based examples of how you can configure labels and templates and use them together.

I recommend assessing the requirements in your organization to find out what kinds of templates, labels, and settings are needed and in what scenarios. Try out any changes with a subset of users using test policies before implementing them on a larger scale within your organization.

Microsoft offers a free 30-day trial for Teams Premium, so take the opportunity to try these security features out! They still impose some functional limitations, but Microsoft has done a great job so far, making sure we can conduct more secure meetings while making it simple for users.

Adam Deltinger

Adam Deltinger

I have for many years been working as a consultant, mostly focusing on Microsoft products and cloud technologies. Today I work to empower my employer with Microsoft 365 and modern tools - helping users collaborate better, work more efficiently, and be more productive - in a secure environment.

I'm also a Microsoft MVP since 2019, focusing on collaboration and productivity.

Your Privacy

Like most sites, TekkiGurus uses cookies and similar technologies to improve your experience.

We may use cookies and other technologies that:

  • Are essential for the site to work
  • Remember your preferences
  • Collect information about how you use our site
  • Provide more relevant content and advertising
Cookie Policy