Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/10-security-and-compliance/feature-security-premium-meeting-watermark-and-e2ee.md
feature-security-premium-meeting-watermark-and-e2ee.mdv2 · history
CurrentApplies to Teams PremiumUpdated 3 weeks agoSource Microsoft Learn ↗

What it does

Two Teams Premium controls for meetings where the content itself is the risk. Watermarking stamps each viewer's email address over shared content and camera video so a screenshot can be traced. End-to-end encryption encrypts the meeting media between clients so the service can't process it, which means switching off most of what makes a Teams meeting a Teams meeting.

Key facts

  • Both need the meeting organiser to have Teams Premium.
  • Watermarking is controlled in the meeting policy under Content Protection in the Teams admin center, or via Set-CsTeamsMeetingPolicy -AllowWatermarkForCameraVideo and -AllowWatermarkForScreenSharing.
  • Watermarks cover camera video and shared screens, including PowerPoint Live, Excel Live and Live Share. Large gallery and content from camera are disabled while it's on.
  • VDI users, anonymous and overflow participants, older clients and Direct Guest Join on Teams Rooms get an audio-only experience in watermarked meetings. Events are capped at 1,000 attendees.
  • Recordings of watermarked meetings show each viewer's own email at playback. .mp4 download is off by default, and the watermark is lost if the file is edited or moved.
  • E2EE is set in the Teams enhanced encryption policy: Set-CsTeamsEnhancedEncryptionPolicy -MeetingEndToEndEncryption with values Disabled (default) or DisabledUserOverride, which lets users turn it on for their meetings. The same policy has CallingEndtoEndEncryptionEnabledType for 1:1 calls.
  • E2EE meetings support up to 200 participants. Recording, transcription, live captions, Copilot, breakout rooms, PowerPoint Live, Excel Live, PSTN dial-in, request control, companion mode and large gallery are all unavailable.
  • E2EE works on current Teams desktop (Windows and Mac), iOS, Android, Teams Rooms on Windows, and a listed set of Teams Rooms on Android devices. The web client, VDI and CVI devices aren't supported and their users are blocked from joining.
  • Users with compliance recording applied can't join E2EE meetings.
  • Both settings can be enforced through meeting templates and sensitivity labels instead of relying on organisers.

When to use / skip

Watermarking is the easier sell. It suits board packs, results previews, M&A and HR casework, where the threat is someone photographing their screen rather than the cloud reading the meeting. It deters, it traces, and most of the meeting experience still works.

E2EE is for a much smaller set: meetings where the client doesn't want Microsoft's service touching the media at all. Be blunt with them about the cost. No recording, no transcript, no Copilot, no dial-in, no web joiners. In most organisations that's maybe a handful of meetings a month, and the regulated users on compliance recording can't attend anyway. If they want "secure but still recorded", that's a sensitivity label with lobby and watermark settings, not E2EE.

Configuration decisions

  • Who gets Teams Premium to organise protected meetings, and whether that's a small named group (board office, deal teams) or broader.
  • Watermark on camera video, shared content, or both.
  • Whether E2EE is DisabledUserOverride for everyone with Premium, or only for a dedicated policy assigned to a small group.
  • Whether protections come from organiser choice, a meeting template, or a sensitivity label. Labels and templates are more reliable.
  • How VDI, web and external attendees are handled, since they'll be downgraded or blocked.
  • Whether 1:1 call E2EE is in scope at the same time; it's a separate setting in the same policy.

Gotchas

  • VDI estates hit this hard. Watermarked meetings drop VDI users to audio only and E2EE blocks them entirely.
  • Teams Rooms on Android support for E2EE is a specific device list; check the room estate before promising the board room can join.
  • External attendees on the web client can't join E2EE meetings at all. Most deal meetings have at least one.
  • Compliance-recorded users can't join E2EE meetings. In a regulated firm, that can be most of the people who actually want it.
  • Watermarked recordings lose protection once copied or edited. Downloads are off by default for a reason; don't turn them back on casually.
  • Organisers without Premium can't apply these even if the policy says yes, and the failure isn't always obvious to them.

Consultant notes

  • Run a test meeting with every client type the client uses: VDI, web, mobile, Rooms on Windows and Android, an external guest. That's where the surprises are.
  • Prefer a sensitivity label like "Board – Restricted" that bundles watermarking, lobby and copy controls, rather than asking organisers to remember toggles.
  • Put E2EE behind a separate policy for a named group rather than the global policy.
  • Document the features lost under E2EE in the user guide; the first complaint is always "where's the recording button?".

Revisit when Microsoft extends E2EE to the web client or VDI, or changes the 200-participant ceiling

Was this accurate?
Related
Sensitivity labels for teams and Teams meetings10-security-and-complianceMeeting Recording and Transcript Storage, Permissions and Expiration02-meetings-webinars-and-eventsDirect Guest Join and third-party meetings on Teams Rooms06-teams-rooms-and-devicesTeams Premium vs Microsoft 365 Copilot for meeting intelligence13-decision-guidesQoS and DSCP marking for Teams media11-network-and-call-qualityTeams Rooms on Windows vs Android, and Rooms Basic vs Pro13-decision-guides