Enable End-to-End Encryption for Microsoft Teams Calls

End-to-end encryption (E2EE) for Microsoft Teams calls ensures that your audio and video are encrypted from your device to the recipient’s device, so even Microsoft cannot decrypt the content. This guide walks you through enabling E2EE for your Teams calls, covering both the admin-side policy and the user-side toggle. You’ll need Teams admin access to set the policy and the latest Teams desktop client for the call.

What You’ll Need

• Microsoft Teams admin center access (to create and assign the E2EE policy).
• Teams desktop client (Windows or Mac) – E2EE is not available on mobile or web browsers.
• Both call participants must have E2EE enabled and be using compatible clients.
• An active Microsoft 365 subscription that includes Teams (E3/E5 or equivalent).

Step-by-Step

1. Sign in to the Microsoft Teams admin center. Go to admin.teams.microsoft.com and sign in with an account that has Teams administrator or Global administrator permissions.
2. Navigate to the E2EE policy settings. In the left sidebar, expand Voice and select Calling policies. Alternatively, go to Teams > Calling policies.
3. Create or edit a calling policy. Click Add to create a new policy, or select an existing one to modify. Name it something like “E2EE-Enabled” for clarity.
4. Enable end-to-end encryption. Scroll down to the End-to-end call encryption section and set the toggle to On. This allows users with this policy to use E2EE in their calls.
5. Save the policy. Click Save at the bottom of the page.
6. Assign the policy to users. Go to Users > Manage users, select the user(s) you want to enable E2EE for, then click Policies in the top bar. Under Calling policy, choose the policy you just created, then click Apply.
7. Wait for the policy to propagate. It can take up to 24 hours for the policy to take effect, though usually it’s much faster.
8. Have the user enable E2EE in the Teams client. On the Teams desktop app, click the Settings and more (three dots) menu in the top-right, then select Settings.
9. Turn on E2EE for calls. In Settings, go to Privacy and toggle End-to-end encrypted calls to On. This is a per-user setting, so each participant must do this.
10. Make an E2EE call. Start a call as you normally would. During the call, you should see a shield icon with a lock next to the participant’s name, indicating E2EE is active. If you don’t see it, the call is not encrypted end-to-end.

Common Mistakes

• Forgetting to assign the policy – Creating the policy alone isn’t enough; you must assign it to the specific users who need E2EE.
• Using an unsupported client – E2EE only works on the Teams desktop client (Windows and Mac). If you try to join from mobile or web, the call will fall back to standard encryption.
• Not enabling the user toggle – Even if the admin policy is set, each user must manually turn on E2EE in their own Settings > Privacy.
• Expecting E2EE for all call types – Currently, E2EE is only available for one-on-one calls, not group calls or meetings. It also doesn’t cover voicemail or call recording.
• Assuming E2EE is on by default – It is off by default; both the admin policy and the user toggle must be explicitly enabled.

Tips

• Verify before relying on it. Always check for the shield icon during a call to confirm E2EE is active.
• Communicate with participants. Make sure everyone you call has E2EE enabled; otherwise, the call will not be end-to-end encrypted.
• Keep clients updated. E2EE features are improved over time, so ensure all users are on the latest Teams desktop version.
• Use a separate policy for E2EE. Create a dedicated calling policy for E2EE so you can assign it selectively without affecting other calling settings.
• Test with a colleague. Before relying on E2EE for sensitive conversations, do a test call to confirm the shield appears.

Troubleshooting

• Shield icon not appearing: First, check that both you and the other participant have the user toggle enabled in Settings > Privacy. Then confirm the admin policy is assigned to both of you. If it still doesn’t show, try restarting Teams or signing out and back in.
• Policy changes not taking effect: Wait at least a few hours, and up to 24 hours. If it’s been longer, ask the admin to re-assign the policy or create a new one.
• E2EE option is grayed out in Settings: This usually means the admin policy hasn’t been applied to your account. Contact your IT admin to verify the calling policy is assigned.
• Call drops or has poor quality: E2EE can add overhead. Check your internet connection and try again. If the problem persists, temporarily disable E2EE to see if it’s the cause.
• Can’t enable E2EE on mobile: This is by design. Use the Teams desktop app for E2EE calls.

Frequently Asked Questions

Does E2EE apply to group calls or meetings?

No, currently E2EE is only available for one-on-one calls in Teams. Group calls and meetings use standard encryption (which is still secure, but Microsoft holds the keys).

Can I use E2EE on the Teams web browser?

No, E2EE is only supported on the Teams desktop client for Windows and Mac. Web and mobile clients do not support it.

Will E2EE affect call recording or transcription?

Yes, when E2EE is active, call recording and transcription are disabled. You must turn off E2EE to use those features.

How do I know if a call is end-to-end encrypted?

During the call, you’ll see a shield icon with a lock next to the participant’s name. If you don’t see it, the call is not E2EE.

Does E2EE require a special license?

E2EE is available in Microsoft 365 E3 and E5 plans, as well as some education plans. Check your subscription to confirm.

What happens if the other participant doesn’t have E2EE enabled?

The call will still connect, but it will use standard encryption instead of E2EE. You won’t see the shield icon.

Related

• Test Responsive Screenshots of an Indian Web App at 375px
• GeForce Game Ready Driver Install Can’t Continue? Fixes
• Fix Windows 10 Couldn’t Be Installed Error