Change in Audit Records for Teams Meeting Recordings Since 2021

Three years ago, I wrote about how to use audit records to track the creation of Teams meeting recordings. The idea was to find the audit records created when a Teams meeting recording was uploaded to OneDrive for Business or SharePoint Online.

Time marches on and old blogs rot, as do old PowerShell scripts. Three years ago, Microsoft hadn’t completed the transition from Stream classic to Stream on SharePoint. The migration finished recently and Microsoft has moved to standardize how Teams meeting recordings and transcripts are stored in OneDrive for Business. Of course, OneDrive only holds recordings for personal meetings. Recordings for channel meetings, including Meet Now in the channel, end up in the SharePoint Online site belonging to the host team.

Closing a Compliance Gap

While some might think that I spend endless hours examining audit records, this is a fallacy. I check on an as required basis, which means that I didn’t notice that my script wasn’t working quite so well because the format of the audit records changed. One important change is that the user noted in all the audit records is app@sharepoint, the ubiquitous SharePoint utility account. No trace exists in the audit records about the user who recorded the meeting, as had happened before.

From a compliance perspective, this is a big deal. Audit records exist to track the actions taken by individuals and system processes, and in this case, it seems important to know who initiated a recording.

Unfortunately, there’s nothing in the audit record to indicate who initiated the recording of a channel message, so we’re left with the SharePoint app. Recordings for personal meetings used to end up in the OneDrive account of the user who started the recording (the organizer or a presenter). Some time ago, Microsoft changed this to a more logical arrangement where recordings always go into the meeting organizer’s OneDrive account. The URL of a OneDrive account contains the site URL, like:

https://office365itpros-my.sharepoint.com/personal/jane_ryan_office365itpros_com

Figuring Out the OneDrive Site Owner

It’s easy for a human to read the URL and know that the OneDrive account belongs to Jane.Ryan@office365itpros.com. With time, I could parse the URL to extract the email address, but I went for a simpler (faster) approach. I used the Get-SPOSite cmdlet from the SharePoint Online PowerShell module to fetch the set of OneDrive accounts in the tenant and created a hash table from the site URL and site owner. It’s fast to check the hash table with the site URL taken from an audit record to return the user principal name of the site owner:

$User = $OneDriveHashTable[$AuditData.SiteURL]
If ($null -eq $User) {
   $User = "SharePoint app"
}

Changes in Search-UnifiedAuditLog Too!

Another influence on the output was the change made by Microsoft in summer 2023 to how the Search-UnifiedAuditLog cmdlet works. Microsoft have denied to me that they did anything, but the evidence shows that:

• The SessionCommand parameter must now be set to ReturnLargeSet to force the cmdlet to return more than 120 records.
• Many more duplicate records are returned than before. This necessitates sorting by the unique audit event identifier to remove the duplicates.
• Search-UnifiedAuditLog returns unsorted data. If a sorted set is important to you, make sure that you sort the audit records by creation date.

$Records = $Records | Sort-Object Identity -Unique | Sort-Object {$_.CreationDate -as [datetime]} -Descending

Of course, you can try to run high completeness searches with Search-UnifiedAuditLog, but I have not had good luck with this preview feature.

Figure 1 shows the output from the updated script, which is available from GitHub. Normal service is resumed.

A Reminder to Check Audit Log Analysis Scripts

It would be nice if a script lasted a little longer, but the ongoing change within Microsoft 365 means that PowerShell developers need to keep a wary eye on updates that might affect production scripts. In this instance, the confluence of the Stream migration and the change to the Search-UnifiedAuditLog cmdlet made a mess of a perfectly good script. I guess life is like that sometimes. Maybe now is a good time to check your scripts that use the Search-UnifiedAuditLog cmdlet.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Teams Meeting Transcripts Exclusively Stored in OneDrive for Business

Microsoft is making a bunch of changes to the handling of Teams meeting transcripts. The most important change is the standardization on OneDrive for Business as the storage location for transcript information, described in message center notification MC726122 (last updated 1 May 2024, Microsoft 365 roadmap item 365720). Targeted release tenants will see the change in early June 2024 and Microsoft hopes to achieve worldwide general availability by late August 2024.

In 2021, Teams was the first application to move workload to the Stream on SharePoint platform. Stream was in the middle of a transition from the old Azure-based application to Stream on SharePoint, and customers still had the option to use either platform. During the transition, Stream stopped creating transcripts automatically for newly uploaded videos. Seeking stability and to support indexing of transcripts, Teams stored the transcript information in the meeting organizer’s Exchange Online mailbox.

Now, Stream on SharePoint is the only option for video storage and automatic transcript generation is performed, so meeting recordings end up with transcripts stored in Exchange Online and Stream. Microsoft is rationalizing the situation by eliminating the copy stored in Exchange Online. This step makes perfect sense because it is consistent with the way that Stream handles transcripts for other videos.

How Teams Meeting Transcripts are Generated

Microsoft is beginning by implementing the change for Teams meeting recordings that only have a transcript (no audio or video content is captured). This happens when a meeting organizer enables a transcript without recording. In the past, Teams wrote the transcript into Exchange Online. When the change is effective, Teams creates an MP4 file in the Recording folder of the meeting organizer’s OneDrive for Business account. To create the file, the normal bot that joins meetings to listen to the audio feed from participants to create the transcript, generates the transcript as normal and then removes the audio track, leaving the MP4 file with just the VTT-formatted captions that compose the transcript.

Figure 1 shows a OneDrive for Business account with two meeting recordings. The first contains only a transcript. The second is a regular recording. Note the “meeting transcript” suffix used for the first and “meeting recording” for the second.

Teams will still write a copy of the transcript for transcript-only recordings into Exchange Online. The situation is different for Teams meeting recordings with audio. The transcript for these recordings is stored in the MP4 file. A copy is also stored in Exchange Online. In other cases, Microsoft emphasizes that Teams will only use the transcript stored in OneDrive for Business.

Phase Out of Exchange Storage for Teams Meeting Transcripts

Eventually, Teams will cease writing a copy into Exchange Online so that the only transcript data is that stored in OneDrive for Business. Microsoft says, “At the same time, meeting transcripts will stop saving in Exchange Online altogether and all transcript storage will be standardized on OneDrive only.” I’m unsure what is meant by “at the same time.”

As you’d expect, standardization on a single location makes it easier to delete transcripts either by the meeting organizer or by retention policies (both the recording and transcript can be removed at the same time).

More Help Coming to Manage Consent and Access

Meeting transcripts are more important now than ever before. Apart from providing captions during playback of meeting recordings, the Teams Premium intelligent recap facility uses transcripts to generate meeting notes and action items. They’re also used by Copilot for Microsoft 365 to allow users to ask questions about meeting proceedings.

To protect the privacy of people and make sure that transcripts are only generated for meetings where everyone consents to recordings, Microsoft has several changes in the pipeline to better manage consent and access, including:

• MC781595: Policy to control the download of Teams meeting recordings. Requires SharePoint-Syntex advanced management licenses.
• MC791598: Consent given by users for recording is captured in the audit logs (requirement for consent must be enabled in the Teams meeting policy)
• MC794819: Explicit consent for all forms of recording.
• MC764456: Explicit consent to transcribe a meeting.
• MC795083: Policy to manage access to meeting transcripts, recordings, AI-generated recap, and Copilot features.

Learn about using Teams and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Block Download Policy covered by Syntex-SharePoint Advanced Management License

Microsoft launched the Syntex-SharePoint Advanced Management license into preview in late January 2023. The license is now generally available and cost $3/user/month. Since news about the license emerged, people have been figuring out if the features covered by the license are worth the cost by examining details of the features it enables. Now a new block download file policy is available for Teams meeting recordings.

Blocking Downloads and Teams Meetings

In February, I covered the Block Download Policy for SharePoint Online, a feature in Syntex-SharePoint Advanced Management to limit users to browser access when interacting with content stored in sensitive sites. Blocking downloads for Teams recordings is a similar feature that’s now available in preview. The big difference is that the block download policy applies tenant-wide for all Teams recordings created after the block comes into force in both SharePoint Online sites (for channel meeting recordings) and OneDrive for Business (for personal meeting recordings).

Clearly Microsoft is responding to a customer need to make Teams meeting recording more secure. Blocking downloads removes the worry that someone with access to a recording of a sensitive meeting can download it before the meeting file automatically expires.

Site-Wide Block Download Policy Applied With PowerShell

As noted above, the block is tenant-wide. No GUI is currently available in the SharePoint Online admin center, so management of the block is by running the Set-SPOTenant cmdlet from the SharePoint Online management module.

Make sure that you run an up-to-date version of the module (I used 16.0.23408.12000) as otherwise the Set-SPOTenant won’t support the necessary parameters. Keeping modules like Exchange Online management, Teams, SharePoint Online, and the Microsoft Graph PowerShell SDK up to date is an important task. Ideally, you should check and update modules monthly. As it’s always nice when PowerShell looks after PowerShell, here’s a script to automate the process, including tidying up by removing old module files afterward.

To impose the block, use Set-SPOTenant to set these parameters:

• BlockDownloadFileTypePolicy from $False (the default) to $True.
• BlockDownloadFileTypeIds to “TeamsMeetingRecording.” This is the only value currently supported by the cmdlet.
• ExcludedBlockDownloadGroupIds to the identifiers of security groups whose members you want to exclude from the block download policy. You can’t use Microsoft 365 groups to exclude accounts. This parameter can be left blank if you want the policy to apply to all accounts. If you want to specify multiple security groups, do so in a comma-separated list.

Here’s the command I ran in my tenant to enable the block policy and check its settings afterward:

Set-SPOTenant -BlockDownloadFileTypePolicy $True -BlockDownloadFileTypeIds TeamsMeetingRecording -ExcludedBlockDownloadGroupIds "dc637020-4b0f-4f65-bdf0-3c7dbe8a83e7"

Get-SPOTenant | Format-List BlockDownLoadFile*, ExcludedBlock*

BlockDownloadFileTypePolicy   : True
BlockDownloadFileTypeIds      : {TeamsMeetingRecording}
ExcludedBlockDownloadGroupIds : {dc637020-4b0f-4f65-bdf0-3c7dbe8a83e7}

It can take up to a day before a policy update becomes effective across SharePoint Online. Before it is effective, anyone can download a Teams meeting recording (Figure 1).

When the block download policy is effective, users don’t see the download options for recordings created after the effective date (Figure 2).

It’s important for users to understand that they are only blocked for new recordings. At least, while the feature is in preview. However, when the block download policy is generally available, a background agent will search for older Teams meeting recordings stored in SharePoint Online and OneDrive for Business and mark the files as blocked for download. Although I can see why customers would want this to happen, the fact is that many of the Teams recordings will age out and disappear in a relatively short period unless users take explicit action to retain the files.

Available in Preview Now

SharePoint Online’s block download policy for Teams recordings is available in preview. After Microsoft makes the block download policy generally available, you’ll need to buy some Syntex-SharePoint Advanced Management licenses to continue using the policy or the block download policy will stop working (perhaps much to the relief of some users!).

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Whiteboard Latest Consumer of OneDrive for Business

As first described in message center notification MC282992 (September 3, updated December 7), many whiteboard clients can now store and access files in OneDrive for Business instead of the original Azure data store. Given the popularity of whiteboard sharing in Teams meetings and the support of the new whiteboard storage in Teams, it’s likely that many files are now in OneDrive for Business (Figure 1), even if their owners don’t realize that the transition has happened.

Whiteboard isn’t the only Teams application which stores its files in OneDrive for Business. Others include:

• Loop components shared in Teams chat.
• Recordings of Teams personal meetings.
• Files shared in Teams chats.

This trend isn’t surprising. By design, Teams uses other Microsoft 365 components rather than creating its own, and responsibility for OneDrive for Business and SharePoint Online roll up under the same Microsoft executive (Jeff Teper). It’s natural for Teams-enabled applications to look to OneDrive as a natural target for file storage, especially as Microsoft makes liberal storage quotas available (here’s a script to report the storage used by OneDrive for Business accounts)

Administrative Challenge

Storing data in OneDrive for Business makes eminent sense. The challenge for administrators occurs when the time comes to delete a user account. By default, Microsoft 365 keeps the OneDrive for Business account for a deleted account for 30 days. You can increase this period to up to ten years (3650 days) by updating the retention setting in the SharePoint Online admin center (Figure 2).

During the retention period, anyone granted access to the OneDrive account can retrieve files. Once the retention period expires, Microsoft 365 removes the account permanently and the files become irretrievable. The exception being if the account or any of the files come under the control of a retention policy or label, in which case they remain in place until all retention controls expire.

The administrative challenge is to decide how to handle the OneDrive content for deleted accounts. One approach is to use the mechanism available to assign access to a deleted user’s OneDrive for Business account to another user (Figure 3). In essence, this makes the designated user the administrator of the OneDrive for Business account and allows them full control over anything stored in the account.

The intention is to give the designated user some time to review the information held in the deleted user’s account so that they can retrieve anything valuable from the account and store it somewhere else, like their own OneDrive for Business account or an appropriate SharePoint Online site. The mechanism works, but the obvious flaw is that once you move files out of their original location, you break the connection between Teams and objects. It’s possible to preserve sharing links when moving files from a OneDrive for Business account, but the link in chats will point to the wrong place and make attachments and loop components in Teams chats unusable, meeting recordings and whiteboards unavailable, and any “cloudy attachments” shared in email inaccessible. In short, users won’t be happy campers because they can’t get at information and help desks will be frustrated because they can’t do much about the underlying problem.

Retention a Better Answer

Instead of asking someone to go through the OneDrive for Business account of deleted users (a dispiriting job), a better approach is to use Microsoft 365 retention policies to retain information in OneDrive for Business accounts for an extended period. Unlike SharePoint Online, where storage quotas are more restrictive and expensive than OneDrive for Business, the effect of long-term retention isn’t a concern. With retention in place, after deleting user accounts, their documents and other files remain in place until the retention period expires. Assuming that the retention period is several years (after creation), this should be sufficient for people to recover copies of information or finish up working with objects like whiteboard or Loop components. At the same time, if someone needs to access the OneDrive account to remove or move files, they can, assuming everyone understands the consequences which ensure.

Of course, retention policies are only available if your organization has Office 365 E3 or better licenses. Organizations with licenses which don’t include retention policies are limited to harvesting information from deleted accounts before they disappear. However, there’s nothing to stop organizations using poor man’s retention by setting the retention period for OneDrive for Business to the maximum 3650 days. After all, ten years after the deletion of an account, who’s going to want to access a document, whiteboard, or loop component from such an antiquated repository?

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Now Available in SharePoint Online and OneDrive for Business

Message Center Notification MC302489 (December 8) brings news of yet another tweak made by Microsoft to the dialog used to create new Sharing Links. The update means that the settings for sharing links for “most video and audio” files now block download by default (Figure 1).

Previous tweaks to the dialog include making it easier to update sharing link settings and highlighting the edit setting. Because many workloads use the sharing link dialog, the benefit of the changes ripple across Microsoft 365.

Understandable Change in Line with Previous Updates

The change is understandable. Sharing a video or audio is often just an invitation to consume final content (using the recently-upgraded web viewer) and you don’t want people to be able to download the files. By comparison, sharing a document, spreadsheet, or presentation is often for review and editing purposes, and the recipient might need to download a local copy to edit the file offline.

Interestingly, Microsoft 365 roadmap item 82193 makes explicit reference to Microsoft Stream, probably reflecting the ongoing motion to move Stream away from its old Azure-based platform to storing videos in OneDrive for Business and SharePoint Online. This transition has already happened for Teams meeting recordings, and the migration for other Stream content is in preview. Teams meeting recordings restrict download access to the recording owner, so setting sharing links to no download by default is in line with that philosophy.

Not All Video or Audio Files

Noting the caveat that the change applies to most video and audio files, I checked the content of my OneDrive for Business account and discovered that OneDrive blocks downloads in sharing links created for Teams meeting recordings. The same doesn’t happen for other MP4 files that I uploaded to OneDrive where the download control is missing when creating sharing links (Figure 2).

The BlockDownloadLinksFileType setting for my tenant (managed through PowerShell with the Set-SPOTenant cmdlet) is WebPreviewableFiles, which means that download blocks are available for all supported files. Given that audio and video files are now in the supported category, something else is going on.

OneDrive recognizes both sets of files as MP4s, so the difference in behavior might be because the uploaded files didn’t have the same PROGID tags as the Teams recordings (these tags make it possible to apply an auto-label retention policy to Teams meeting recordings). Alternatively, it could be because some background job hasn’t yet processed the other MP4 files. Requiring extended periods to process files is not unknown in SharePoint Online and OneDrive for Business. In any case, I’ll keep an eye to see if things change.

Make sure that you’re not surprised about changes which appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Joins the Controls for Teams Meeting Recordings

Now that Microsoft has created the transition of storage for Teams meeting recordings (TMRs) from Stream (classic) to OneDrive for Business and SharePoint Online (ODSP), attention is focused on how to manage these files. Microsoft plans to introduce an auto-expiration policy for TMRs in January 2022 to allow organizations dictate how long these files exist in ODSP. The auto-expiration policy will work for any Microsoft 365 tenant which has licenses for Teams.

If you have Office 365 E3, users can apply retention labels to TMRs to gain more control over their retention, and if you have Office 365 E5 or Microsoft 365 E5 licenses, you can deploy an auto-label retention policy to find and label TMRs (and track the success of the policy in finding and labeling TMRs). In short, over time, organizations are gaining ways to exert compliance control over TMRs.

Blocking Sharing with Data Loss Prevention

Data Loss Prevention (DLP) for SharePoint Online and OneDrive for Business is included in the Office 365 E3 SKU. The value of DLP is that you can use a policy to protect against inadvertent data leakage caused when someone shares a TMR outside the organization. Imagine what would happen if a competitor got hold of a recording of a discussion, complete with slides, about the development of a new product!

Using much the same approach as taken to identify TMRs for the auto-labeling retention policy, we can build a DLP policy for TMRs which looks for recording files and stamps them with metadata to stop sharing happening. The DLP policy to block external sharing for TMRs is very simple. It is a custom DLP policy (i.e., not created using a template) consisting of:

• A name and description.
• Target locations. For maximum coverage, choose all SharePoint Online sites and OneDrive for Business accounts. This will stop any sharing of TMRs created for personal meetings (OneDrive) and channel meetings (SharePoint).
• A single rule. The rule looks for any file with the property value ProgId:Media.Meeting that is shared with someone outside the organization. The rule action blocks sharing with people outside the organization. Figure 1 shows what the rule conditions look like. Optionally, the rule can allow users to override the block by providing a justification to explain why they need to share a recording with an external person.

Other rule settings which you might consider include creating a custom policy tip to explain why users can’t share TMRs externally or generating an incident report to alert administrators or other people when a rule violation occurs.

The Effect of DLP

It can take up to an hour before a new DLP policy is effective. When the policy is active, the indexing process for new files detects that TMRs come within the scope of a policy and applies the policy settings to block external sharing. There might be a few minutes before the block is effective for a new file during which it’s possible to create and send a sharing link. However, once the block is in place, the sharing link is nullified.

The effect of the policy is obvious because any document which matches the policy conditions now has a small icon (circle with a line in the middle). In Figure 2, the icon is shown alongside all the TMRs in the Recordings folder. Other video files that don’t have the property set are not marked. Hovering over a TMR reveals information about the file, including a link to a DLP policy tip if set. In this case, the link reveals some custom text to explain that external sharing is not permitted for TMRs.

If the user ignores the warning and goes ahead to try and share the recording anyway, they won’t be able to do this because OneDrive for Business blocks the attempt to create and send a sharing link (Figure 3).

Easy Update

Even if internal users don’t often go back to relisten to what was discussed in a conference call, there’s no doubt that some external people might find that content interesting, perhaps even to the detriment of your company. The time required to create and deploy a DLP policy to block external sharing of TMRs is roughly ten minutes (including a pause to drink coffee). It’s a quick and easy update to make it easier to manage the security of information contained inside these files. This is a good example of the value of DLP.

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Search for What Participants Say During Teams Meetings

Microsoft message center notification MC260749 (last updated August 12) titled Microsoft Search: Find a meeting recording based on what was said is both technically interesting and important. Described in Microsoft 365 roadmap item 82003, the roll-out was delayed several times, but the way is now clear for Office 365 tenants to be able to search videos using spoken text along with a bunch of other changes to make Teams meeting recordings more accessible and useful. While it’s hard to say exactly when individual tenants will have all the functionality described here, I expect worldwide deployment to be complete by the end of October 2021.

Everything in OneDrive

Exposing the content of meeting recordings for search is important because it starts the process to close a major compliance gap. Up to now, transcripts for online meetings have not been searchable. The problem first surfaced when Teams stored its recordings in Stream. When the meeting finished, Stream processed the recording and created the transcript. However, the transcript remained in the Stream Azure service and was inaccessible to Microsoft Search. If something can’t be indexed by Microsoft Search, its content cannot be found by a search.

Microsoft completed the migration the storage of Teams meeting recordings from Stream to OneDrive for Business or SharePoint Online (ODSP) on August 16, 2021. All new meeting recordings from that date are in ODSP with the migration of older content from Stream to ODSP happening later. Microsoft is busy building out the rest of the Stream 2.0 platform to handle videos which don’t come from Teams. For instance, they’ve released a preview of the new Stream browser interface which supports access to videos stored in both ODSP and the original Stream store.

The move to ODSP removed the ability to create and replay transcripts for meeting recordings which exists in Stream classic. Starting September 20, Microsoft plans to remove some of the automatically-generated transcripts from older videos in Stream classic to prepare for the migration to Stream 2.0.

To fill the functionality gap, Microsoft introduced a transcription capability for Teams meeting recordings (a recent update means that if you record a Teams meeting now, you generate a transcript automatically). However, the issue of searchability remained. Because ODSP stores the recording files, Search could index file metadata like the name of the recording, but that’s about all.

The gap in indexing and searchability is now closed. Teams stores the spoken text captured during a meeting (including speaker attribution so you know who said what) and meeting metadata in the Exchange Online mailbox of the meeting organizer. Capturing the spoken text in mailboxes allows Microsoft Search to index the data and therefore makes it possible for searches to find this information. And as we’ll see, ODSP also holds a copy of the transcript to allow the words in the transcript to connect with segments in a meeting recording.

Exchange Mailbox Storage for Transcript Information

Teams stores transcript information in a folder called ApplicationDataRoot/93c8660e-1330-4e40-8fda-fd27f9eafe10/MeetingTranscriptCollection in the non-IPM part of the mailbox. Hidden means that the folder isn’t available to users through clients like Outlook, but its contents are available to administrative interfaces like Microsoft Search and programs like MFCMAPI.

Transcripts are captured as mail items. Examining the captured items with MFCMAPI, it looks like two properties for are most interesting:

• TranscriptJsonBlob: stores the spoken text captured during the meeting. In Figure 1, you can see some captured text, including the name of the speaker. When users view the transcript in Teams, the information is displayed in a nicer format. It’s also possible to download transcripts in VTT or Word (DOCX) format.
• TranscriptMetadataJsonBlob: stores metadata about the call.

Linking Words to Videos

The original implementation for Teams meeting recordings stored in Stream classic supported transcription, including the ability to edit the transcript to correct obvious errors. To allow Microsoft Search to find the MP4 file for a meeting recording based on words spoken during a meeting, a background process copies the transcript data captured in Exchange Online and indexes it against the recording to match segments of the video with the spoken words.

Replication of transcript data from Exchange Online to ODSP can take anything from 15 minutes to a day after the meeting ends. Once the process completes, you can search for text spoken in meetings and find recordings using the transcript (Figure 2).

Transcript Playback

Matching words in the transcript with meeting recordings (and eventually, any video stored in ODSP) allows concurrent playback for the two elements. Microsoft 365 roadmap item 82057, rolling out in September 2021, delivers a transcript pane for video playback (Figure 3). No ability is yet available for a video owner to edit the transcript.

Curiously, closed captions are available for only 60 days from the date of recording. In addition, Microsoft says that “Closed captions aren’t fully supported” if you move or copy a recording from its original location. Presumably, this is because the move might affect the link to the transcript data.

Making Transcription Available to More Teams Users

The option to transcribe meetings used to be restricted to accounts with enterprise E3/E5 and Business Premium/Standard. In early July, Microsoft made live transcription available (MC260564) for other licenses, including the E1, F1, academic, and Business basic SKUs, noting that this step improves the accessibility of Teams and makes meetings more inclusive for those who are hard of hearing. Microsoft followed up with MC280258 (August 24), to announce support for transcripts and captions in 27 additional languages (Figure 4) to join the previous support for U.S. English.

Another Compliance Gap Nearly Closed

All the information shared during Teams meetings is gradually coming within the scope of compliance policies. eDiscovery can already find chat, presentations, and documents, and the advent of indexed speech means that spoken comments should soon come within the scope of eDiscovery searches. This hasn’t happened yet, probably because of the work needed to export transcripts and videos in eDiscovery cases, but I am sure this capability is high on Microsoft’s agenda.

Although the captured text is sometimes inaccurate, capturing any record of spoken comments is better than nothing. As time goes by, the artificial intelligence technology used to analyze speech to create the transcript will improve in terms of accuracy and ability to handle accents.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what’s happening.

Only for Recordings of New Teams Meetings

Updated 21 May 2022

Announced in MC274188 (July 30), in late September, Microsoft planned to enable meeting recording auto-expiration for new Teams meeting recordings (TMRs) stored in SharePoint Online and OneDrive for Business (Microsoft 365 roadmap item 84580). The new feature will move the MP4 files used for TMRs to the site recycle bin when their expiration date lapses. For enterprise users, the expiration period is 120 days after the creation of the recording. A reduced period of 30 days applies for academic users with the Office 365 A1 license. Once in the recycle bin, the MP4 files follow the standard SharePoint file deletion cycle. Auto-expiration for TMRs is available for all Office 365 and Microsoft 365 licenses which contain Teams.

TMRs are the first workload to move video storage from the classic Stream Azure-based platform to SharePoint Online and OneDrive for Business (ODSP), From August 16, 2021, all new TMRs will be in ODSP. Even though tenants have a lot more storage quota available (especially in OneDrive for Business for recordings of personal meetings) than in Stream, the new policy aims to restrict the amount of storage occupied by TMRs (roughly 400 MB per hour).

Update: Following a series of earlier delays, on January 31, 2022, Microsoft pushed deployment out to late March 2022 to make sure that when they start to delete files, they remove the right files. At the same time, Microsoft increased the default retention period from 60 to 120 days for all tenants that haven’t configured a custom retention period. Eventually all the blocking factors were removed and Microsoft began to roll out the auto-expiration of Teams meeting recordings feature in early April.

Setting a New Expiration Period for TMRs

Microsoft says that 96% of TMRs are not watched again in the 60 days (and 99% after 110 days) following the original meeting, which is why they’ve chosen this to be the default expiration period. Users can change the expiration period for individual TMRs by updating file properties through the file details pane (selecting preset values of 14, 30, or 60 days, a custom date, or Never Expire). Organizations can set a default expiration period for newly created TMRs using the Teams meeting policy assigned to user accounts. For example, to set the default expiration period for recordings of meetings made by people assigned the VIP User Meeting Policy, run the command:

Set-CSTeamsMeetingPolicy -Identity "VIP User Meeting Policy" -NewMeetingRecordingExpirationDays 120

Originally, Microsoft’s documentation described a maximum expiration period is 99,999 days (273 years). Subsequently, problems emerged when tenants set such a high value and the safe limit was found to be 9,999 days, which should be more than enough to keep any normal recording (remember, you can apply a retention label to keep recordings for longer). The minimum is 1 day, and you can set the value (in PowerShell) to -1 to set meeting recordings to never expire. The expiration period for A1 users can only be reduced from the default 30 days.

You can also update the auto-expiration period for meeting policies through the Teams admin center (November 2021 update). Interestingly, the Teams admin center allows a range of between 1 and 99999 days! I’ve asked Microsoft to clarify whether the supported period is 9,999 or 99,999 days. If you want to go higher than 9,999 days, maybe the best approach is to set expiration to never expire.

Background processes run to evaluate TMRs in ODSP to check their expiration date. If the expiration process detects an expired file, the process moves the file into the recycle bin and clears the expiration date field. Recording owners receive email notifications when OneDrive moves expired recordings into the recycle bin (Figure 2). If necessary, they can rescue important recordings from the recycle bin for up to 90 days after deletion. Once moved back from the recycle bin, the recording has no retention date set and will therefore not be evaluated for deletion again.

To help users understand when a recording approaches expiration will see visual indications in:

• Beside the link to the meeting recording in the meeting chat. Anyone with view access to the recording sees the expiration notice.
• Two weeks before expiration, a red icon appears beside the MP4 files for TMRs in the Recordings folder of OneDrive for Business accounts (personal meetings) or SharePoint Online sites (channel meetings).

Auto-expiration applies only to new TMRs. Existing TMRs stored in either ODSP or Stream do not have an expiration period. Auto-expiration is only available for TMRs and cannot be used with other file types held in ODSP. Expiration dates are kept if users move recording files to a different site (it’s the same file). They are not when users copy recording files (it’s a different file). Downloading and uploading a recording creates a new file with no expiration date. If you want to be sure that the expiration process does not remove a Teams meeting recording, apply a retention label to the file.

Tenant administrators can track the creation of TMRs in OneDrive for Business and SharePoint Online by using PowerShell to extract and analyze audit events.

Auto-Expiration and Retention

Auto-expiration is a good housekeeping rather than a compliance feature. It will help organizations cope with a swelling collection of TMRs in user OneDrive for Business accounts and SharePoint Online sites but will do nothing to help with data governance. Two interesting developments due to arrive soon are automatic transcription for TMRs and indexing of transcripts. From a compliance perspective, this means that it will be possible to search for words spoken during a meeting and be able to put those words in the context they were spoken. Obviously, this is a big advance in compliance capabilities.

To take advantage of spoken word retrieval and make sure that transcripts and videos are available to eDiscovery investigators, you obviously need to retain TMRs. For this reason, a retention label on a TMR prevents the auto-expiration process removing recording files until the retention period assigned in the label lapses. Also, a retention label mandating deletion after a period takes precedence over auto-expiration, meaning that if the retention label has a shorter retention period than the auto-expiration date, that’s when SharePoint will remove the file.

Precedence applies for retention labels assigned manually or via an auto-label policy (available to tenants with Office 365 E5). Organizations which leverage retention labels to preserve the recordings of important Teams meetings might not see much change after Microsoft introduces the new auto-expiration feature.

Make sure that you’re not surprised about changes which appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

7 June 2024: See this article for updated coverage of this topic.

How Administrators Can Find Out When Recordings Occur

Recently, I published two posts explaining how auto-label retention policies for Teams meeting recordings work and how to validate that an auto-label policy works. All is well, and the auto-label policy apply the right retention labels to the right files in the right locations, which is what you want.

The inevitable question then arose: how can administrators know when someone records a Teams meeting? The book answer is that neither Teams nor Office 365 offer an obvious way to know when a new recording happens. Recording is, after all, a personal action decided by the meeting organizer or a presenter (or invoked automatically by a meeting setting). Once the meeting policy assigned to the organizer or presenter allows them to use “cloud recording,” Teams records the meeting and captures the MP4 file in OneDrive for Business (personal meetings) or SharePoint Online (channel meetings).

Recording a meeting is not an auditable activity so it’s not captured in the Office 365 audit log. However, the creation of a new file in OneDrive for Business or SharePoint Online is auditable, so we can examine those events to see if we can track new recordings.

Audit Events for a Teams Meeting Recording

First, let’s consider what happens on the creation of a new Teams meeting recording. Three events appear in the audit log:

• Creation of a temporary MP4 file in a FileUploaded event.
• Modification of the temporary file in a FileModified event. This is likely when Teams updates the properties of the file to add the programmatic identifiers Media and Meeting which mark the file as a Teams meeting recording.
• Renaming the file name of the temporary file to its final form. This is also in a FileModified event. The temporary file has a prefix of “~tmp.” Teams removes the prefix to create the final file name in the form meeting name, date, and “meeting recording.” For example, the file called H2 FY2021 Review 20210615_140058-Meeting Recording.mp4 is for a Teams meeting on June 15, 2021, starting at 14:00:58 (local).

Equipped with this knowledge, we can search the audit log with the Search-UnifiedAuditLog cmdlet and parse the audit events to extract data for analysis.

PowerShell Script to Find Creation of Teams Meeting Recordings

The PowerShell code is straightforward:

• Use the Search-UnifiedAuditLog cmdlet to retrieve the set of audit events for FileModified and FileUploaded actions over a set period (I used 14 days).
• Parse the AuditData content in each audit event to figure out if it’s a Teams recording. The basic test used is that the file is an MP4 stored in the /Recordings folder.
• Extract information about the recording and write to a PowerShell list. For instance, it’s good to know the title of the meeting.
• Finally, extract the records for the temporary file to create a set for the final creation of Teams meeting recordings. Output this data to the screen with Out-GridView and to a CSV file.

Here’s the main processing loop:

$StartDate = (Get-Date).AddDays(-15)
$EndDate = Get-Date
[array]$Records = Search-UnifiedAuditLog -Operations FileUploaded, FileModified -StartDate $StartDate -EndDate $EndDate -Formatted -ResultSize 5000 -SessionCommand ReturnLargeSet

If (!($Records)) {Write-Host "No audit records found - exiting!"; break}

$Records = $Records | Sort-Object Identity -Unique

$TaggedRecordings = [System.Collections.Generic.List[Object]]::new() 	
ForEach ($Rec in $Records) {
   $AuditData = $Rec.AuditData | ConvertFrom-Json
   If (($AuditData.SourceFileExtension -eq "mp4") -and ($AuditData.SourceRelativeUrl -like "*/Recordings")) { 
      $A = $AuditData
      $RecordingFileName = $AuditData.SourceFileName
      $DateLoc = $RecordingFileName.IndexOf("-202")
      If ($DateLoc -eq -1) {$Topic = $RecordingFileName} Else {$Topic = $RecordingFileName.SubString(0,$DateLoc)}
      $DataLine = [PSCustomObject] @{
         Workload            = $AuditData.Workload
         Date                = $Rec.CreationDate
         User                = $Rec.UserIds
         Recording           = $RecordingFileName
         "Meeting title"     = $Topic
         Site                = $AuditData.SiteURL
         FullURL             = $AuditData.ObjectId
         Folder              = $AuditData.SourceRelativeURL
         Operation           = $Rec.Operations }
    $TaggedRecordings.Add($DataLine) 

   } #End If
} #End For

Figure 1 shows the output as viewed through Out-GridView.

You can download the complete script from GitHub.

Search-UnifiedAuditLog can return up to 50,000 audit events from the log. In large tenants where many document events accrue daily, you might exceed this number of audit events in a couple of days or even sooner. In this situation, you’ll need to fetch audit events and store them in another repository and analyze them from there.

Exploit the Audit Log

People sometimes complain when they can’t find a simple off-the-shelf option in a Microsoft 365 administration GUI to do something. The Office 365 audit log contains lots of interesting information which answers many questions, like who’s creating Teams meeting recordings. You only have to look. Or rather, know where to look.

Learn how to exploit the Office 365 data available to tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Opening the Black Box

My article about how to create an auto-label policy to apply retention labels to Teams meeting recordings resulted in several questions. As I noted in the article, tracking the progress of auto-labeling can be challenging due to the black-box nature of the background processes which search for recording files to label. One suggestion was to use the technique explained in this blog post to use the SharePoint Online PnP PowerShell module to connect to sites and retrieve information about retention job activity. For example:

$SiteURL = "https://office365itpros.sharepoint.com/sites/Office365Adoption/"
Connect-PnPOnline -Url $SiteURL -Interactive
get-pnppropertybag -key "dlc_policyupdatelastrun"
get-pnppropertybag -key "dlc_expirationlastrunv2"
2/23/2021 11:18:42 PM
2/2/2021 8:02:41 PM

The first value (dlc_PolicyUpdateLastRun) is the date when the background job to evaluate retention dates for items last ran. The second (dlc_ExpirationLastRunv2) tells you the last time the background job ran to execute the retention action defined in labels when retention periods expire.

The background jobs which evaluate retention dates and execute actions are not directly connected to auto-label processing, but they give an insight into how SharePoint Online processes sites. In a nutshell, if a site is active, the background jobs process its content. If not, the site is ignored. This makes a lot of sense because it avoids SharePoint doing a bunch of work to check items in sites where no work is necessary. I don’t know if another value stores a date when action must be taken to process expired items, but it would make sense if it did.

These values date back to legacy management processing in SharePoint on-premises and while they still work, Microsoft introduced a new retention processing engine last year which might eventually nullify their use.

Off to the Audit Log

Interesting as these values are, they don’t tell us anything about the application of labels. In the last article, I mentioned that the Office 365 audit log captures the TagApplied event when a person or policy applies a retention label to an item. The audit events are available roughly 15 minutes after they occur, so this source seemed like a good place to investigate.

I ended up writing a script to do the following:

• Find audit records for the TagApplied event in the last 14 days.
• Filter the records to find those which apply the retention label used by the auto-label policy. The same filter makes sure to only select records for policy rather than user application.
• Find the date of the recording from the file name generated by Teams. For instance, a recording named Call with James Ryan-20210217_141123-Meeting Recording.mp4 started at 14:11 on 17 February 2021.
• Calculate how long it took to auto-label the recording file (the difference between the date the call started and the audit record).
• Write the details to a SharePoint list to make the data available for additional analysis.

Here’s the main loop of the code to process the audit records. You can download the complete script from the Office 365 for IT Pros GitHub repository.

[array]$Records = (Search-UnifiedAuditLog -Operations TagApplied -StartDate $StartDate -EndDate $EndDate -Formatted -ResultSize 2000)
$TaggedRecordings = [System.Collections.Generic.List[Object]]::new() 
ForEach ($Rec in $Records) {
   $AuditData = $Rec.AuditData | ConvertFrom-Json
   If (($AuditData.DestinationLabel -eq $RetentionLabel) -and ($AuditData.UserType -eq "CustomPolicy")) { 
      $RecordingFileName = $AuditData.DestinationFileName
      $DateLoc = ($RecordingFileName.IndexOf("-202")+1)
      $RDate = $RecordingFileName.SubString($DateLoc,8)
      $TimeLoc = $DateLoc + 9
      $RTime = $RecordingFileName.SubString($TimeLoc,4)
      $RecordingDateTime = $RDate + $RTime
      [datetime]$RecordingDate = [datetime]::ParseExact($RecordingDateTime,"yyyyMMddHHmm",$null)
      [datetime]$TaggingDate = Get-Date($AuditData.CreationTime)
      $TimeToTag = ($TaggingDate - $RecordingDate)
      $TotalSeconds = $TotalSeconds + $TimeToTag.TotalSeconds
      $TimeToTagFormatted = "{0:dd}d:{0:hh}h:{0:mm}m" -f $TimeToTag
# Add the data about our record          
      $DataLine = [PSCustomObject] @{
         Workload            = $AuditData.Workload
         Recording           = $AuditData.DestinationFileName
         "Retention Label"   = $AuditData.DestinationLabel
         "Tagging Date"      = Get-Date($AuditData.CreationTime) -format g
         "Recording date"    = Get-Date($RecordingDate) -format g
         "Days to label"     = $TimeToTagFormatted
         Site                = $AuditData.SiteURL
         FullURL             = $AuditData.ObjectId }
    $TaggedRecordings.Add($DataLine) 
   } # End if
} # End ForEach

The Final Answer

After processing all the audit records, I know what Teams meeting recordings the auto-label policy has labelled and how long it took on average for an item to receive a label.

25 audit records found for auto-applying the Teams recordings retention label between 09/06/2021 19:36:43 and 23/06/2021 19:36:43
Average elapsed time to auto-label recordings: 02d:13h:28m
The report file is available in C:\temp\TaggedTeamsRecordings.csv.

The average time between creation and labeling depends on the gap between the meeting and when the labeling job runs. This seems to be on a weekly workcycle and usually runs over the weekend, so labeling a recording can take anything up to a week. An average of between two and four days is normal given that Teams captures new meeting recordings over the work week.

The same technique can be applied to track the progress of any auto-label policy.

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new development as they happen.

Just Another Meeting Option

Message Center notification MC263666 published on June 22 discusses the introduction of Teams meeting auto recording. This topic surfaced in May when TechRadar reported that “The video conferencing service will soon automatically record all Microsoft Teams meetings at the start of a call for the first time, adding a function that has been strangely absent.” As reported, the implication was that tenant administrators could enable automatic meeting recording to start at the commencement of each call, which created a bunch of adverse feedback from those worried about the prospect of every Teams meeting being recorded, not least because of the retention challenge of managing so many recording files in OneDrive for Business.

Microsoft didn’t do anything to tone down the coverage or say what will really happen until now. The real story is:

• Automatically recording a meeting is a new meeting option, just like the options which control if meeting attendees can turn on their cameras or chat during the meeting.
• The meeting organizer must set the option for each meeting. It’s not something which will be the default for every meeting.

In effect, the new option preconfigures an action that a meeting organizer can take today after they join their meeting. The new option simply ensures that the organizer doesn’t forget to start recording for important meetings.

The new option will appear in meeting options in late June to complete in late July. GCC High and DOD tenants will see the feature in late July.

Obviously, the meeting policy assigned to users must allow them to use cloud recording before they can initiate either manual or automatic recording. In addition, the tenant must have switched recording storage from Stream to OneDrive for Business (ODSP), a process which is now approaching completion. The option isn’t available to users with Office 365 A1 licenses.

Setting the Option to Auto-Record a Teams Meeting

There’s no way to configure a policy to set auto record for every meeting. There might be a way to do this programmatically using the Graph API, but I can’t find a suitable call (the update meeting call doesn’t allow access to meeting options). For now, if you want automatic recording to happen, you’ll have to select meeting options and set the checkbox (Figure 1).

Recording the Teams Meeting

When a meeting with auto-recording set starts, a short delay occurs between the organizer (or the first user holding the presenter role from the home tenant) starting the meeting and the recording beginning. This allows the recording bot to join the meeting.

As is the norm for personal meetings recording stored in OneDrive for Business, Teams creates the recording file in the OneDrive for Business account of the person who starts the recording. With automatic recording enabled, if someone other than the organizer starts the meeting, the recording is in their OneDrive for Business account rather than the organizer’s. However, the organizer has edit access to the recording while other people from the tenant invited to the meeting have read access. Obviously, organizers need to be sure to join their meetings first if they want full control over the recording file.

Recordings for channel meetings are stored in the Recordings folder for the channel in the document library of the team site. Anyone in the team has access to the recording. Everything works as expected when automatic recording is enabled for a channel meeting, with the exception that if the first person to join the meeting isn’t a member of the team. In this case, Teams records the meeting but can’t post the recording to SharePoint. Instead, the recording is available in meeting chat and can be uploaded to SharePoint by a team member.

Value in the New Option

Allowing organizers to set up meeting recording ahead of time is a good thing. I’ve been in the situation where I failed to record a meeting that I should have and regretted the lack of a recording afterwards. Whether I remember to update meeting options before important meetings in the future is entirely debatable, but at least I now can.

Make sure that you’re not surprised about changes which appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Picking Up Support for Retention Labels

Updated: 10-Nov-2021

We’re approaching the end of the transition for the storage of Teams meeting recordings from “classic” Stream to OneDrive for Business and SharePoint Online (ODSP). From August 16, 2021, Microsoft will begin the process of moving any tenant who has not yet transitioned to store new meeting recordings to ODSP. When Microsoft announced their intention to move away from the Azure-based storage used by classic Stream, they emphasized the advantages gained by storing recordings in ODSP. Among those advantages is the ability to apply retention policies to meeting recordings. Others include the ability to share recordings with external people and an increase in storage quota over the limited amount made available for Stream.

Building an Auto-Label Policy

The sad fact about meeting recordings is that they tend to age rapidly. After a month or so, the need to refer to the recording of any meeting is greatly diminished. And indeed, many organizations don’t want recordings kept for any great length of time. An auto-label retention policy is the best way to find and remove Teams meeting recordings. The policy contains some conditions to identify items stored in ODSP and a retention label to apply. The retention label specifies the retention period (for example, two months), and the retention action (for example, permanently delete the item).

When Microsoft originally discussed the movement of Teams meeting recording to ODSP at Ignite 2020, they referenced a special retention policy to control recordings (see 15:00 in the recording) to be available in H1 CY21. That functionality hasn’t been delivered yet, and it’s important because it covers all licensing plans (SKUs). For now, Microsoft documents how to create an auto-label retention policy to remove recordings. Conceptually, the policy is very simple:

• Find Teams recordings: When Teams uploads a recording to ODSP, it stamps the MP4 file with ProgID attributes. This means that an auto-label policy can use a keyword search for ProgID:Media AND ProgID:Meeting to find recordings (Figure 1). Teams sets the ProgID (programmatic identifier) values for recordings when uploading the files to ODSP.
• Select the target locations: Most Teams recordings are from private meetings and end up in the meeting organizer’s OneDrive for Business account. Channel meetings end up in the channel folder in the SharePoint Online document library of the host team. The important thing here is to choose Microsoft 365 Groups as the target location type. You can also choose SharePoint sites if you expect to move or copy recordings around, but selecting Microsoft 365 Groups ensures that the auto-label policy finds recordings captured in the SharePoint sites connected to teams.
• Apply a retention label: Any retention label can be used, including those which require manual disposition.

Auto-label policies which run against ODSP locations depend on the indexing process to find matching items. As the process runs to populate the indexes used for Microsoft Search, it matches items using the criteria set in retention policies and applies the label specified in the policies.

The indexing process runs on an ongoing basis to detect new items and usually tags new recordings within a couple of days, depending on the overall load on the indexing service. My experience is that labels appear sooner in OneDrive for Business than they do in SharePoint Online. Frustratingly, it can happen that a policy labels some items in a location but not others, which might make you think that a policy isn’t working instead of reflecting how index updating proceeds. Eventually, everything gets caught up and all recordings have labels.

The Need for Licenses

Creating and applying an auto-label policy sounds like a good idea, until you realize that auto-label policies require Office 365 E5 or a Microsoft 365 E5 compliance license for all accounts covered by the policy. Many other licensed accounts generate Teams meeting recordings who can’t use auto-label policies. In these cases, users can apply retention labels manually (this function is covered by Office 365 E3 and E1 and Microsoft 365 Business Premium among other licenses). Manual application of retention labels is certainly feasible but this strategy relies on the discipline and thoroughness of user behavior, which isn’t always reliable. A generalized org-wide retention policy usually applies a longer retention period than desirable for Teams meeting recordings, so isn’t a good answer.

If you don’t want to use an auto-label policy, from January 2022 you should be able to apply a Teams-specific auto-expiration period to meeting recordings. The advantage of this approach is that retention is controlled by Teams meeting policies and is available to all Microsoft 365 plans which include Teams. And if you choose to use an auto-label policy, the retention labels assigned to meeting recordings will take precedence over Teams auto-expiration.

Interpreting the Effect of Black Box Policies

An auto-label policy is an impenetrable black box when it comes to reporting progress in processing items. Once you create or edit a policy and publish it to target workloads (ODSP in this case), all you can do is hope that the policy has the desired effect and labels the correct items. The compliance center gives no hint about when the policy last scanned a location, how many items matched, or overall totals for the tenant.

Three methods exist to check the effectiveness of an auto-label policy. The quick and easy method is to check the recordings in individual sites and accounts to verify if they have the correct retention label (Figure 2).

Checking individual recordings quickly becomes boring and there’s no guarantee when ODSP will process an auto-label policy against files. The Office 365 E5 and Microsoft 365 E5 licenses include access to the Activity explorer in the Data classification section of the Microsoft 365 compliance center. You can check there to see if the policy applies retention labels to recordings. Figure 3 shows the information captured for an auto-labelling action as viewed through the Activity Explorer.

The Office 365 audit log captures the same data for auto-labeling actions. You can search using the Audit log feature in the compliance center or by running the Search-UnifiedAuditLog cmdlet to look for TagApplied events. Here’s an example of the data available in an audit record:

Search-UnifiedAuditLog -StartDate 11-Jun-2021 -EndDate 12-Jun-2021 -Formatted -ResultSize 5000 -Operations TagApplied

RecordType   : SharePointFileOperation
CreationDate : 11/06/2021 15:39:17
UserIds      : 6909d419-3589-4d38-85e3-d65e8c9aa408
Operations   : TagApplied
AuditData    : {
                 "CreationTime": "2021-06-11T15:39:17",
                 "Id": "63ee2402-1400-42bf-89e8-08d92cef12fc",
                 "Operation": "TagApplied",
                 "OrganizationId": "b662313f-14fc-43a2-9a7a-d2e27f4f3478",
                 "RecordType": "SharePointFileOperation",
                 "UserKey": "6909d419-3589-4d38-85e3-d65e8c9aa408",
                 "UserType": "CustomPolicy",
                 "Version": 1,
                 "Workload": "OneDrive",
                 "ClientIP": "",
                 "ObjectId":
               "https://office365itpros-my.sharepoint.com/personal/tony_redmond_office365itpros_com/Documents/Recordings/Transcription for All-20210609_131449-Meeting Recording.mp4",
                 "DestinationFileName": "Meeting with Ivan-20210609_131449-Meeting Recording.mp4",
                 "DestinationLabel": "Teams Recordings",

A more extensive discussion about how to use audit log events to track the progress of auto-labeling is in this post. You can also use audit events to know when new Teams meeting recordings are created in OneDrive for Business or SharePoint Online.

If you don’t have the licenses needed to use an auto-label policy to manage Teams meeting recordings, you can at least find out when recordings are created and use that information as the basis to remove the recordings manually or programmatically.

To Keep or to Remove?

It’s hard to recommend a suitable retention period for Teams meeting recordings. The pressure which existed previously due to the limited storage quotas imposed by Stream doesn’t apply anymore, so you could keep all recordings if you wanted. But given that most recordings are not very useful after a month or so, the right thing to do is to remove them. That is, if you have the licenses for auto-label policies!

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s really important across the Office 365 ecosystem.

Automatic Compliance Recording Solutions Available for Companies Which Need This Capability

On May 3, TechRadar reported that Teams would soon record all meetings. The report is based on a Teams user voice response to a request looking for the ability to enable recording to start automatically when a meeting begins. Microsoft has decommitted from User Voice, but TechRadar took Microsoft’s response that they’re “working on this request” to mean that organizations would be able to configure Teams to record every meeting automatically and noted that this would add a feature “strangely absent” from Teams. The prospect of automatic recordings didn’t sit well with many organizations, who cited concerns about privacy and the general undesirability of recording every Teams meeting.

But updated documentation released by Microsoft reveals that the report is inaccurate. What TechRadar interpreted as automatic recording for all Teams meetings is really the introduction of ISV-driven recording capabilities for specific companies who need to capture interactions to comply with industry regulatory or local laws. For example, an oversight authority might compel a financial services company to record all interactions with customers.

Organizational recording allows tenant administrators to create compliance recording policies which invoke recorders (bots) to record meetings. The bots run as Azure services and use the Teams calls and meetings communications API to access the Teams platform to ingest media content. Most tenants will continue to use ad-hoc or convenience recordings as outlined in Figure 1.

ISV Compliance Recording Solutions

ISVs incorporate recorders into their solutions and have their solutions certified by Microsoft. Only the bots need to run on Azure. Other components can run elsewhere. See this link for more information about the certification program and the ISVs currently certified or going through the certification process.

Before an organization can record Teams meetings automatically, it needs:

• A recording solution (most likely sourced from an ISV but possibly built in-house).
• An application instance identifying the solution to Teams.
• A compliance recording policy created in Teams using the New-CsTeamsComplianceRecordingPolicy cmdlet. The administrator then runs the Set-CsTeamsComplianceRecordingPolicycmdlet to link the policy to the appliance instance.
• Assignment of the compliance recording policy to target user accounts using the Grant-CsTeamsComplianceRecordingPolicy cmdlet.

It’s highly unlikely that enterprises which don’t have a compelling reason for automatic meeting recording will go to the expense of buying an ISV solution and the overhead of setting up and managing one or more compliance recording policies. If they do, the good news is that they won’t need any additional licenses as the regular E3/E5 and Microsoft 365 Business Premium licenses cover compliance recording.

Storm in a Teacup

I think Microsoft’s user voice response means that they want to update meeting settings to allow an organizer to choose automatic recording along with other settings like auto-muting attendees. This is a good idea as it simply automates what a meeting organizer can choose to do today during a meeting.

Unless you have a regulatory or legal need to do it, automatic recording for all Teams meetings is a horrible idea. Although some recordings are useful, the sad fact is that people don’t commonly access recordings after a meeting. Instead, the MP4 files for meeting recordings accumulate in OneDrive for Business and SharePoint Online, consuming storage and generally cluttering things up. Of course, the huge storage available for OneDrive for Business accounts means that keeping unwanted recordings around for a long time doesn’t really matter (except to Microsoft, who pays for the storage), but it would be nice if tenants could build a retention policy targeting meeting recordings to remove them after a period. Those recordings which users need to keep could receive an appropriate retention label while the retention policy removes the rest. Wouldn’t that make much more sense than automatic meeting recording?

Possible to Protect Sensitive Meeting Recordings with Some Downsides

Although it’s listed as one of the applications which support sensitivity labels, the only way that Stream uses sensitivity labels is when it creates a new Microsoft 365 group. At that point, you can assign a sensitivity label with container management settings to the new group. Container management is good, but it doesn’t protect the data owned by the group.

This situation creates the question of how best to protect confidential videos. Because sensitivity labels control access to files using fine-grained rights management, they are an attractive choice. Stream “classic” doesn’t support the option to protect files in this manner, but the transition of Stream storage to SharePoint Online and OneDrive for Business creates a potential solution. As we’ll discuss, the basic technology works, but some implementation issues generate more friction than you’d like, possibly because Microsoft hasn’t figured out how the components should work together.

Unified Labeling Client and OneDrive

Microsoft touts the ability of SharePoint and OneDrive to store just about any type of file up to 250 GB, which makes it easy to store recordings of even the longest meeting. However, no user interface exists in the browser interface for SharePoint or OneDrive to assign sensitivity labels to files. Office (online, desktop, and mobile) applications can apply sensitivity labels, including encryption if needed. Exchange Online mail flow rules can also assign sensitivity labels to messages. Outside these implementations, writing some PowerShell or Microsoft Graph code or using Microsoft’s unified labeling client are the only ways to assign sensitivity labels to files.

The unified labeling client runs only on Windows workstations. It integrates with File Explorer to add a Classify and protect option to make it simple to add protection to any file which File Explorer can access. Applying protection to PDF files is a popular use case for the unified labeling client.

The OneDrive sync client can synchronize online folders and files to local copies, so it doesn’t take much lateral thinking to put two and two together and conclude it should be possible to assign sensitivity labels to meeting recordings stored in OneDrive. And as it turns out, it’s true. The only downside is that the unified labeling client requires Azure Information Protection P1 licenses. These licenses are part of the Enterprise Mobility and Security suite, but not bundled in any Office 365 plans.

Protecting Meeting Recordings

Figure 1 shows a set of MP4 video files (and a Word document) in the Recordings folder of my OneDrive for Business account. This is the location where Teams stores its meeting recordings. A label already protects one of the recordings (bottom right), as shown by the Azure Information Protection padlock icon. To protect another file, select it, and choose File Explorer’s Classify and protect option.

The unified labeling client launches to allow the user to select the sensitivity label they wish to apply. Some sensitivity labels apply markings to files without encryption, but as the MP4 format doesn’t support headers, footers, and watermarks like those used in Office documents, the only labels offered for selection in Figure 2 are those which encrypt content.

After selecting the label to apply, click Save to allow the client to encrypt the file. On my i7 Surface Book 2, the client took twelve seconds to process the 358 MB recording (for a meeting lasting 46 minutes). The size of the file is in line with the expected storage consumption for Teams recordings.

Downsides

We now have a protected MP4 file. The downsides are:

• The link posted in Teams for the recording as part of the meeting resources breaks. The recording is still listed as a resource, but the link points to the original MP4 file which no longer exists because it is replaced by the encrypted file (which has a .pfile extension). Protecting the recording also removes the sharing links for the file, so even if you reverse course and remove the label, Teams can’t access the file.
• Because the encryption process creates a new file without sharing links, the owner of the file must share the file with those permitted to view the recording.
• The OneDrive MP4 file viewer can’t open the protected file.
• The only way to view the protected video recording is through the Azure Information Protection viewer (part of the unified labeling client), meaning that those who want to view the recording must install the unified labeling client. Their account also needs an Azure Information Protection license.

In a nutshell, the unified labeling client treats Teams meeting recordings like any other MP4 file it protects. Encryption breaks any special connection between Teams to OneDrive for Business. The result is a protected recording, but the file owner needs to allow access to those to view the recording.

Maybe Not Completely Ready

Just because you can do something doesn’t mean that you should do something. Although you can protect Teams meeting recordings with sensitivity labels, the downsides indicate that the Microsoft engineering teams involved (Teams, SharePoint, Stream, and Microsoft Information Protection) have not yet worked through the issues to come up with a more seamless implementation. To be fair, Stream is in the middle of its switchover from Azure to SharePoint storage, and Microsoft might work through this point as that process unfolds. Service encryption with customer key is one of the work items listed for the migration to the New Stream, but support for sensitivity labels isn’t mentioned.

Until a more seamless integration is available, it’s reasonable to conclude that using sensitivity labels to protect Teams meeting recordings stored in OneDrive is possible with downsides.

Information protection is an important topic covered by the Office 365 for IT Pros eBook. That’s why we think about and test this kind of stuff. Benefit from our work by subscribing to the book. Its monthly updates keep everyone informed about what’s happening inside Office 365.

Switching Storage from Stream to ODSP

Following on from the change in timing for the general switchover of Teams meeting recordings from Stream Classic to OneDrive for Business and SharePoint Online (ODSP for short) to July 2021, Microsoft is leveraging SharePoint permissions to have better control access to recordings. This wasn’t possible in Stream Classic, but it is now that Teams is adopting SharePoint-based sharing.

After you switch Teams meeting recordings to ODSP, new meeting recordings are not stored in Stream. Instead:

• Recordings for personal and group chats and personal (private) meetings are stored in the OneDrive for Business account of the user who starts the recording. This user is the owner of the recording.
• Recordings for channel meetings are stored in the channel folder of the document library in the SharePoint team site owned by the team.

In both cases, the MP4 files for the recordings are in the Recordings folder.

No Downloads Please

In message center MC230505 (updated February 18), Microsoft makes the important clarification that the only person allowed to download a recording for a personal chat or meeting is the owner. Everyone else is assigned view-only permission to the file.

A change due to roll out in early April and finish in June will block users with view-only permission from downloading the file. Only those with edit access to recordings can change the permissions to allow others to download the files. The change is described in Microsoft 365 roadmap 70543. Organizations cannot override the assignment of permissions to meeting recordings or the way the permissions work.

Channel Meetings are Different

Channel meetings are treated differently. Once someone uses the Teams calendar app or the channel calendar app to create a channel meeting, the team which owns the channel becomes the owner of the event. The person who schedules the meeting can still update meeting settings, but they are not the owner.

This is important because the Microsoft 365 Groups access model which underpins Teams dictates that team members have equal access to group resources. The simplicity of the Groups membership model makes it easy to understand, but sometimes its lack of granularity is regrettable and forces change, such as the introduction of private channels in Teams to support confidential access to resources for a subset of team members. Because team members enjoy the same level of access to group resources, they have edit permission for meeting recordings stored in the document library of the SharePoint site owned by the team.

Don’t Discuss Sensitive Information in Channel Meetings

The devil is always in the detail. In this case, Microsoft recommends that organizations do not use channel meetings to discuss confidential or sensitive information. The reason why is simple: if you do, any team member can access files shared in the meeting or download the meeting recording, which is probably not what you want to happen with sensitive material.

Instead, use private meetings when you need control over who can join the meeting and who will be able to access information shared in the meeting. Recent changes to meeting settings allow precise control over who can join a meeting automatically, meaning that you can be sure that someone can’t sneak in using a meeting link shared by another participant.

So much change, so much detail. Stay abreast of developments by subscribing to the Office 365 for IT Pros eBook and receive monthly updates (a completely new book). It’s the best value in IT!

Recording, Transcript, and Attendance Report at Organizer Fingertips

A Teams meeting is an online space where people can come together with audio and video feeds. Each space or thread has a unique identifier to allow people to connect to the right meeting, and each space has its own set of resources. Chat is the most basic resource and is available for all meetings; other resources include a transcript, shared files, attendance roster, notes, whiteboard, and recordings (a single meeting can have several recordings for different parts of the meeting).

Meeting Recap

Microsoft is overhauling the way tenant users access resources for meetings through the calendar app with what they refer to as a “meeting recap” (Office 365 notification MC233470, 9 January, roadmap item 68729). On February 23, Microsoft adjusted roll-out dates from the end of January to early March to be completed worldwide by early April.

Meeting recap is only available for private meetings. These are meetings which are not published in a channel or organized on an impromptu basis using the Meet Now feature. In a nutshell, the details tab for a meeting viewed through the calendar app highlights three important resources to make it easier for meeting participants to access. The resources are:

• Meeting Recording (if available).
• Transcript (if available).
• Attendance report (only meeting organizers can access the attendance report).

Figure 1 shows details of a private meeting where the recording, transcript, and attendance report are available.

Because the meeting recap is a new interface for existing data, it also applies to old meetings. For Meet Now or channel meetings, the resources are accessible through the meeting chat.

Meeting Attendance Update

Microsoft published MC221432 on 3 September to say that a new version of the attendance report is coming (roadmap item 66459). The notification was updated on 12 November with a new deployment date set for early February.

The old attendance report contains basic information and is only available during a call. The new attendance report contains more detail about participants joining and leaving online meetings and can be downloaded as a CSV file after the meeting is over (it takes a little time for the report to be generated). Only organizers can access the attendance report

Live Transcription and Recording

Announced in MC220987 on 26 August and later updated 10 November, Teams will offer meeting organizers and presenters the options to create a transcript of a meeting or a recording with an automatic transcript. This is Microsoft 365 roadmap item 65967 and roll-out is due in mid-February. It’s another example of Microsoft using its Azure Cognitive Services capabilities to generate text from speech (as available in Word).

Unlike today, recording a meeting will also generate a transcript captured from conversation during the meeting (Figure 2). Linking a recording and transcript is likely being done to replicate what’s available when Stream generates an automatic transcript for Teams meeting recordings kept in its Azure-based store. This feature doesn’t work when Teams stores recordings to OneDrive for Business, so managing the transcript in Teams is a direct replacement for functionality which used to be delivered by Stream.

Transcription is currently only available when a meeting is held in English. Stream supports transcripts formed from automatic captions generated for Chinese, French, German, Italian, Japanese, Portuguese, and Spanish, so there’s some work to do for Teams to catch up.

Meeting participants can view the live transcript during and after the meeting and download it when the meeting completes in either Word (DOCX) or Web Video Text Track (VTT) format. If necessary, the meeting organizer can delete the transcript. Unlike Stream, you can’t currently edit the online transcript to correct obvious mistakes. You can correct errors in the Word or VTT file and share that version.

Recordings for Teams meetings recently received an update to support the 3×3 gallery view instead of the previous 2×2 view. The new view is available for recordings of meetings with more than five people with video feeds whether the recording is stored in OneDrive for Business or Stream.

The ability for organizers and presenters to generate a transcript or create a meeting recording is controlled by the Allow transcription and Allow cloud recording settings in the meeting policy assigned to their accounts (Figure 3). Both need to be on to enable the full range of resources available for a meeting.

Transcription shouldn’t be confused with live captions, which is a per-user feature intended to allow participants who need some assistance to follow discussions in online meetings to know who’s talking and what they are saying.

Guest Access

Guest users don’t have access to the calendar app, so they can’t use the meeting recap. Guests can participate in meeting chat, but they’ll need permission to access files shared in the meeting.

Guests can be assigned permissions to view meeting recordings, but only if the files are stored in OneDrive for Business rather than Stream. As advised in MC230505 (17 December), Microsoft is changing the access to recordings in February to allow users with view-only permissions to view recordings stored in OneDrive without being able to download the files.

If needed, an organizer can download the attendance report and transcript and make them available to guest users through OneDrive for Business.

User interface details like this help people exploit application capabilities more fully. In-depth coverage of technology like that in the Office 365 for IT Pros eBook helps tenant administrators understand and exploit Office 365 more fully. Need we say more?

Teams Meeting Recordings a Big Demand on the System

Microsoft is in the middle of building Stream for SharePoint (the new Stream). Part of the transition is to move video storage away from a dedicated Stream repository in Azure to SharePoint Online and OneDrive for Business. Office 365 tenants can move recordings of new Teams meetings to OneDrive for Business now with the transition of existing videos to the new Stream when it becomes available during 2021.

Update: Migration from Stream Classic to Stream based on SharePoint is still not generally available.

Because it has its own repository, the classic Stream controls its storage. Tenants receive a base amount of 500 GB plus 0.5 GB per licensed user (all Office 365 enterprise users are licensed for Stream). A tenant with 1,000 users therefore receives 1.5 TB of Stream storage. If more storage is needed, it can be bought from Microsoft.

Teams Recordings Drive Stream Storage

According to Microsoft sources, a large percentage of Stream storage is consumed by Teams meeting recordings. With over 500,000 users, Accenture runs the world’s largest Teams deployment, consuming 350 million minutes of audio meetings and 90 million minutes of video meetings monthly. Heavily influenced by the change of working habits due to the Covid-19 pandemic, the growth in online meetings is representative of many organizations, and 115 million monthly active Teams users generate lots of meetings. Many meetings are recorded, and the amount of Stream storage used by Teams continues to grow. This is one of the reasons why Microsoft chose to move Teams recordings to OneDrive for Business as the first step in the transition to the new Stream.

Removing Old Recordings

Meeting recordings are most useful soon after an event. Once people have had a chance to review a recording, the value of keeping most recordings declines over time. Classic Stream has no way to age out old recordings, and while Microsoft is working on a policy to expire Teams meetings automatically after a set period, that feature isn’t yet available.

The net result is that quota consumption continues unabated unless meeting organizers (the owners of the recordings) proactively remove old recordings. This doesn’t happen in the real world.

Quota Management in Stream for SharePoint

In Stream for SharePoint, recordings are stored in the OneDrive for Business account of the person who initiates the recording. The question then arises about what happens to the storage quota assigned to tenants for classic Stream?

The answer is that the quota doesn’t transfer. Videos stored in SharePoint Online or OneDrive for Business count against the tenant’s SharePoint storage quota (for videos owned by a Microsoft 365 group) or an individual’s OneDrive storage quota. Although this seems unfair, it’s not in practice because Microsoft makes large amounts of storage available to OneDrive for Business accounts, including “beyond 1 TB, to unlimited” for enterprise users. Given that most Stream storage is consumed by Teams recordings and these files will now be in OneDrive for Business, no need exists to transfer the classic Stream quota.

You might still want to run reports to check on OneDrive for Business storage, just in case some users need an increase in their assigned quota. The demand on quota should reduce after Microsoft introduces the policy to age out old recordings. In the interim, you can make sure that everyone can store all the meeting recordings they need by bumping the default OneDrive storage quota from 1 TB to 5 TB by editing the setting in the SharePoint admin center (Figure 1).

Keep up-to-date with the transition from Classic Stream to Stream for SharePoint by subscribing to the Office 365 for IT Pros eBook. We make sure that you master the detail.

Microsoft Introduces New Control Effective Mid-April 2021

Message center notification MC227292 posted on 26 November (subsequently updated February 10 and March 9) advises of a change to how Teams controls the ability of individual users to record 1:1 calls. This feature, which allows people to make recordings of calls with other individuals, was introduced in April 2020.

Recordings are stored in Stream or OneDrive for Business, depending on whether the tenant has switched the storage location for Teams recordings (from March 1, commercial and GCC tenants store all new recordings in OneDrive). If OneDrive is used, the recording is stored in the account of the person who starts the recording. In Stream, the originator is the owner of the recording. OneDrive for Business is a better option for people who record calls with others outside the tenant because they can share the recording afterwards. Stream doesn’t allow its files to be shared outside the tenant.

Controlling Teams Recordings

Up to now, the AllowCloudRecording setting in the Teams meeting policy assigned to accounts has controlled if a user can initiate recording. If True, the user can record a call. If False, they can’t. However, the setting is really intended to control whether people can record meetings instead of personal calls, and the change introduces a new setting called AllowCloudRecordingForCalls to differentiate between the two types. In addition, the new setting is in the Teams calling policy applied to accounts rather than the Teams meeting policy (editorial comment: policies is one thing Teams is not short of).

What’s important to realize is that the default state of the setting is False, which means that once Microsoft switches the policies in mid-April 2021, users won’t be able to record their personal 1:1 calls unless action is taken to update calling policies. The quick fix is to update the setting in all calling policies to True until the organization assesses if it’s a good idea to allow people to make recordings of this nature. According to the notification, tenants should update their calling policies by April 12 if they want to be sure that users can continue to record 1:1 calls.

Updating the Calling Policy with PowerShell

The ability to update the setting in calling policies isn’t currently available in the Teams admin center. To make the change with PowerShell, connect to Microsoft Teams and then create a session with the endpoint used for managing policies. The cmdlets to do this are all in the Microsoft Teams PowerShell module. Connect to Teams and then Check the current situation by running the Get-CsTeamsCallingPolicy cmdlet:

Connect-MicrosoftTeams
Get-CsTeamsCallingPolicy | Format-Table Identity, AllowCloudRecordingForCalls

Identity                                 AllowCloudRecordingForCalls
--------                                 ---------------------------
Global                                                         False
Tag:AllowCalling                                               False
Tag:DisallowCalling                                            False
Tag:AllowCallingPreventTollBypass                              False
Tag:AllowCallingPreventForwardingtoPhone                       False

The policies prefixed with Tag: can’t be updated. These are special policies controlled by Microsoft. You can update the Global calling policy and any custom calling policies created by the tenant. For example:

Set-CsTeamsCallingPolicy -Identity Global -AllowCloudRecordingForCalls $True

Users not allowed to record Teams personal calls because the policy assigned to their account has AllowCloudRecordingForCalls set to False might be frustrated at the new development, but perhaps the question needs to be asked what business purpose justifies the recording of personal calls?

The Office 365 for IT Pros eBook contains lots of information about Teams calling and meetings. Subscribe to receive monthly updates about important changes like the one described here.

Teams Meeting Recordings Moving from Stream Classic to ODSP

Updated: June 9, 2021

Announced at Ignite 2020, the move for Teams video recordings to use OneDrive storage is now in place (the move is really to store Teams meeting recordings in both OneDrive for Business and SharePoint Online, or ODSP for short). Tenants have been able to opt-in to use OneDrive to store recordings of Teams meetings since mid-October 2020.

The timeline for the roll-out has gone through several revisions but is currently:

• October 19, 2020: Tenants can opt to use OneDrive to store new recordings of Teams meetings. (Complete).
• January 7, 2021: All new recordings of Teams meetings are stored in OneDrive unless the organization explicitly choses to continue using Stream by updating their meeting policies. (Complete).
• August 16, 2021: An incremental roll-out begins to switch tenants to store new recordings of Teams meetings to OneDrive even if their meeting policies are set to use Stream.

The most recent change removed the March 1, 2021 deadline for commercial and GCC tenants to move to OneDrive. Microsoft is also now saying that the roll-out in July to switch all tenants over to OneDrive will be incremental rather than a hard date. Commercial and GCC tenants now share a common date with education tenants, to which Microsoft had previously extended support until July to accommodate the school year.

Updating Teams Meeting Policies

Control over the choice of storage location is accomplished by updating Teams meeting policies to switch the RecordingStorageMode setting from Stream (the default) to OneDriveForBusiness. This currently can’t be done through the Teams admin center, but it’s an easy update to do in PowerShell using the latest Teams PowerShell module. This module contains the old Skype for Business Online cmdlets needed to update policies. With the module installed we can do the following ($O365Cred is a variable populated using the Get-Credential cmdlet). In this example, we update a single meeting policy to instruct Teams to store the recordings started by the users assigned the policy in OneDrive for Business.

# Connect to Teams and update the meeting policy
Connect-MicrosoftTeams -Credential $O365Cred
# Update the Teams meeting policy for US employees so that their meeting recordings are stored in OneDrive
Set-CsTeamsMeetingPolicy -Identity "U.S. Region Workers" -RecordingStorageMode OneDriveForBusiness

Update May 13, 2021: The latest version of the Teams PowerShell module is 2.3.1.

OneDrive Means SharePoint as Well

Saying that the storage is OneDrive for Business is a little misleading, but it might be explained because recordings for personal and group chats as well as meetings organized by a person and not tied to a channel end up in OneDrive. Channel meetings end up in the document library SharePoint team site for the team. In both cases, a folder called Recordings is used.

When the switch is effective, users see that recordings are being saved to OneDrive rather than Stream (Figure 1).

One thing I noticed is that those who record meetings do not receive email to tell them that their recording is ready to view. This might be linked with the lack of post-processing currently done when videos are stored in OneDrive for Business.

In this instance, the meeting is in a channel, so the recording is saved in SharePoint. We can see the MP4 file for the recording through the Teams Files channel tab, or by opening SharePoint. Figure 2 shows three recording files stored in the Recordings folder for a channel. Because SharePoint treats recordings like any other file, you can amend their properties, assign retention labels (but not yet sensitivity labels), and share them with other users, including people outside the tenant (subject to the restriction capability for the site).

Permissions for meeting recordings stored in OneDrive are limited to internal users, even if guests participate in the call. If it is necessary to share a recording with an external user, the owner (the person who started the recording) must update the sharing list to include that user. Channel recordings stored in SharePoint can be accessed by any team member.

Teams Meeting Recordings and Storage

Only new recordings are stored for now, but Microsoft says they will deliver facilities to move old recordings over from Stream to OneDrive. When this happens, the storage currently charged against the Stream storage quota for the tenant will be absorbed by OneDrive and SharePoint quotas. You might then have to pay more attention to reporting the amount of storage consumed in SharePoint and OneDrive for Business.

Ups and Downs, but Mostly Up

Being able to share meeting recordings outside the tenant is a major change over the capabilities available in classic Stream that will be welcomed by many. Some downsides do exist. For instance, the automatic transcript and captions created by Stream and features like video trim and noise suppression aren’t yet available for videos stored in OneDrive. Microsoft is working to close any functionality gaps and are confident that everything will be in place to allow a complete switchover from classic Stream as scheduled.

The Office 365 for IT Pros eBook will cover the transition of video content from classic Stream to Stream 2.0 as it unfolds. Being able to change to reflect the actual state of Office 365 is a big advantage of an eBook.

When Stream Refuses to Store a Teams Meeting Recording

Stream is the video service for Microsoft 365. A lot of the activity in Stream is driven by processing and viewing of Teams meeting recordings. Microsoft’s advice about how to record a Teams meeting gives all the details of how to record a meeting and save the recording in Stream. What it doesn’t tell you is how to deal with the situation where a recording can’t be stored in Stream (Figure 1).

No Stream License, No Recordings Saved

The most common reason why this happens is when the person who records the meeting isn’t licensed to use Stream. Microsoft bundled a Stream license into all Office 365 enterprise plans, so it’s unusual to have a situation like that shown in Figure 2 where an account is assigned an Office 365 E5 license, but Stream is disabled. Nevertheless, based on the number of questions about why recordings fail, it’s obvious that some tenants remove Stream licenses from accounts (maybe using PowerShell as explained in this article).

It’s possible that tenants disabled Stream in the past because they didn’t think that Stream was needed. However, if you want to capture recordings for Teams meetings, you need a Stream license. Accounts also need Stream licenses to view videos stored in Stream. including when links to Teams meeting recordings are posted in chats or channels.

Restricted Uploads for Stream

Another reason why people can’t upload to Stream is that the tenant has restricted the set of people allowed to create new videos in Stream (Figure 3). This control might have been set at a time when Stream acted as the repository for company-produced videos and only official videos ended up in the portal. It’s inappropriate when you want users to store Teams recordings in Stream.

Stream’s Connection to Teams

The process of recording a Teams meeting goes like this:

• Stream regards whoever records the meeting as the owner. The owner is the account that can set permissions on a video once it is processed and stored in Stream.
• When recording starts, a bot joins the meeting to capture the media stream.
• When recording finishes, the media stream is saved in Stream for further processing, like adding the automatic transcript and generating recordings in different formats.
• Stream then tries to save the recording in the owner’s account. This fails because the account is not licensed.
• Instead of posting a link to the processed recording in the conversation, Teams posts a link to the raw video. This is what has happened in Figure 1.

Rescuing Unsaved Meeting Recordings

The solution to the problem is to make sure that anyone who records Teams meetings is assigned a Stream license. To fix the problem with an unprocessed recording, for up to 21 days after the meeting ends, any team member can download the video (an MP4 file) from Teams and save it to their workstation (Figure 4). Teams automatically removes the video after 21 days.

Next, the user can upload the recording to Stream (they’ll need a license to do this), add the necessary properties (Figure 5), and Stream will process the recording as normal.

The person who uploads the recording to Stream is now its owner. They can share the recording with the people who need access. They can also get a link to the video from Stream and post the link to Teams to allow team members to access the recording (Figure 6).

As reported in this article, some Office 365 datacenter regions do not support the Stream service, which prevents users from being able to record meetings. Microsoft plans to allow tenants to opt for storage in the closest region which supports Stream. That plan should have come into effect by now but has been delayed.

The Office 365 for IT Pros eBook is full of practical advice like this. Subscribe to receive monthly updates to refresh your knowledge and keep it current.

Closes Gap in Teams Meetings Recording Spectrum

In a surprise announcement (MC210451), Microsoft said that Teams “convenience recording” is now available for 1:1 calls. The feature seems to be already available, but this might depend on some software reaching your tenant, a process that can take some time given the distributed nature of Office 365.

Support was already available to record group calls (more than two people), but now you can record Teams calls with just one other person. I have no idea why Microsoft calls this convenience recording.

There doesn’t seem to be a Microsoft 365 roadmap item for this development, which might account for why Microsoft apologizes “for not communicating sooner.”

How 1:1 Call Recording Works

Recording happens with any other Teams call. One of the two people on the call selects the Start Recording option in the call menu. For now, the Allow Cloud Recording setting in the meeting policy assigned to the account must allow them to record, but Microsoft says that they’re working on a separate policy setting to control 1:1 calls.

When the call completes, the recording is processed in Stream (Figure 1), from where it can be shared or added to a channel. The person who starts the recording is deemed to be the owner of the recording, which is important because they’re the only one who can manage the recording in Stream. They also receive the email notification the recording is processed.

Recording Posted in Chat

The call is also posted to the 1:1 chat and both participants can access it there (Figure 2) by opening the file stored in Stream. This works well when both participants have accounts in the same tenant, but the lack of external sharing capabilities in Stream is one of the reasons why Teams is moving its storage for recordings to OneDrive for Business.

However, only the owner can share the recording from the chat. At first glance, the only sharing option seems to be to make the recording available to the entire organization, which seems bizarre given that 1:1 calls tend to be private. The … link brings you to the Stream Manage permission dialog, which is where you can apply some granular permissions.

Known Limitations

Microsoft document a couple of limitations in the current implementation.

• Calls can only be recorded between two Teams clients. You can’t record calls if they involve people dialing in or if the call is federated to Skype for Business Online or Skype consumer users.
• If you add extra people to a 1:1 call (thus creating a group call), the recording is posted in the 1:1 chat where the call starts instead to the expanded chat. To make the recording available, the owner must share the Stream recording with the added participants (or the file in OneDrive for Business, if that’s where the recordings are stored).

Rushed for Now

Although welcome, the oddly branded convenience recording seems a little rushed. Perhaps Microsoft is responding to a need to help people working from home who must record calls for certain topics, like financial transactions. In any case, it’s good to have the feature.

New developments come thick and fast in Office 365. This one affects two or maybe three chapters of the Office 365 for IT Pros ebook. Luckily we release an update every month to make sure our subscribers are always up to date.

Location of Stream Data Could Cause Data Sovereignty Issue

Office 365 Notification MC200501 published on January 17, 2020 gave some important information for tenants who cannot currently use the facility to record Teams meetings and store the recordings in Stream because the Teams and Stream services are not co-located in the tenant’s Office 365 datacenter region.

Update (May 26): Microsoft posted Office 365 notification MC214327 to advise about the new AllowRecordingStorageOutsideRegion setting in Teams meeting policies to control how Teams stores its meeting recordings in Stream. The new setting rolls out at the end of June and should be deployed worldwide by mid-July.

Update (Sept 23): Office 365 notification MC222640 of 23 September announces that tenants will be able to switch recordings of Teams meetings processed by Stream to be stored in SharePoint Online and OneDrive for Business. Among other benefits, this means that recordings will be stored in the same datacenter region as the video owner.

Teams Meeting Policy Settings

Apart from having licenses for Office 365 and Stream, the recording of Teams calls and meetings is controlled by the Allow cloud recording setting (AllowCloudRecording in PowerShell) in Teams meeting policies assigned to user accounts. If the policy setting is On (the default), meeting participants can initiate recordings. The sole caveat is that the meeting organizer (the account which created the meeting) must also be able to record meetings. Guest users in the tenant or federated and anonymous participants can’t record meetings because they don’t have the necessary licenses.

Allow transcription (AllowTranscription in PowerShell) is another important setting in the Teams meeting policy. If you allow users to record meetings, you should allow Stream to generate automatic transcripts for the meetings as well. Originally, Stream could only generate transcripts in English and Spanish, but Microsoft recently increased the number of languages to include Chinese, Japanese, French, and German.

Co-location of Teams and Stream

Up to now, tenants have only been able to store recordings of Teams meetings in Stream when the Teams and Stream services are co-located in the same Office 365 datacenter region. The idea is that tenants probably want to keep all their data in the same Office 365 region, especially if they use one of the country-level regions deployed to satisfy customer requirements for data sovereignty.

To check where a tenant’s Teams service is located, check the Data location under Settings in the Microsoft 365 Admin Center (Figure 1)

To check the location for Stream, open the app, click the question mark in the menu bar, and select the About Microsoft Stream link (Figure 2)

In this case, both services are hosted in the European Union datacenter region, so the tenant has always been able to store recordings of Teams meetings in Stream. This is the situation for tenants in the U.S., European Union, Asia Pacific, Australia, India, United Kingdom, Canada, and GCC regions. Microsoft plans to deploy Stream in the sovereign (China and Germany), GCC-high, and other “go local” country-level regions in the future. According to Office 365 notification MC214327, Stream will be available in Japan, Norway, France, UAE, Singapore, South Korea, South Africa, Germany, Switzerland, and Sweden by the end of 2020.

Storing Teams Meeting Recordings Outside Your Region

Teams meeting recordings are currently disabled when Stream is not co-located with Teams. The new AllowRecordingStorageOutsideRegion setting is set to False in all Teams meeting policies to ensure that current behavior continues. After the change is rolled out, you’ll be able to make a tenant-wide change in the Teams admin center to update the setting to True. Teams will then be able to use Stream services outside your country running in the nearest geographic datacenter region to store videos for call and meeting recordings. For example, if your tenant belongs to the French Office 365 region, the recordings will be stored by Stream in the European Union region. Put another way, the recordings will physically reside in Ireland, Finland, Austria, or the Netherlands because that’s where the Office 365 datacenters are for the European Union region. The change does not affect the recording of Teams Live Events.

Microsoft stresses that if a tenant chooses to store Teams call and meeting recordings outside their local region, they will not be able to transfer recordings once Stream begins operates in the local region. For example, if a French tenant decides to use Stream in the EMEA region, the recordings stored there will not be transferred to Stream running in the French datacenter when that service starts later in 2020. However, new recordings taken after Stream starts in France will be stored in France.

Enabling Teams Recording for All

After the change is deployed, tenants will have to choose to allow users to record Teams calls and meetings or change the Teams meeting policy to block recordings. If your organization is not concerned about data sovereignty, this change offers the chance to use Teams meeting recording without having to wait for local deployment of Stream, which could be good news for some organizations.

Controlling Who Can Record Teams Calls and Meetings

For those who don’t want to allow recordings, the easiest approach is to block recordings by setting Allow cloud recording to Off in the global Teams meeting policy.

If you want to allow some users to record meetings, create a new Teams meeting policy with the setting On and then assign that policy to the accounts you want to record meetings. You can assign the policy to accounts in the Teams Admin Center or by running the PowerShell Grant-CsTeamsMeetingPolicy cmdlet. For instance, this code assigns a specific Teams meeting policy to a set of mailboxes selected based on a value stored in their CustomAttribute1 property:

$Mbx = Get-Mailbox -RecipientTypeDetails UserMailbox -Filter {CustomAttribute1 -eq "Meetings"}        
ForEach ($M in $Mbx) {
      Try {
       Grant-CsTeamsMeetingPolicy -PolicyName "Allow meeting recording" -Identity $M.UserPrincipalName
       Write-Host $M.DisplayName "is allowed to record Teams meetings" }
      Catch {
        Write-Host "Problem occurred when assigning the Allow meeting recording policy to" $M.DisplayName } }

Ask Before Proceeding

But before anyone affected by this change takes the plunge and starts recording, it would be wise to seek advice about whether data sovereignty should include the recordings of Teams meetings. If yes, you should continue to block Teams meeting recording until Microsoft deploys Stream in the local datacenter. If not, happy recording!

Keeping up with small but important changes like this can be terribly time-consuming. We do it without breaking sweat because we’ve been tracking Office 365 for years. Subscribe to the Office 365 for IT Pros eBook and benefit from our insight.