Woodgrove Capital: Why the Board Policy Did Not Apply
Woodgrove Capital, 1,100 users, has a regulatory obligation to protect board communications. A new 'Board-Restricted' meeting policy is supposed to enforce: no anonymous join, no lobby bypass for anyone not invited, recordings allowed only for the organizer, watermarks on shared content, and labeled meetings. Two weeks after rollout, the 14 board members report they can still record meetings and external guests join without waiting in the lobby. An audit finds 11 of the 14 also carry a direct 'Executive-Voice' meeting policy assigned during an earlier voice project, and 4 belong to a second security group that has a broader, older meeting policy. Separately, the CEO asks for end-to-end encryption on board meetings, and Legal states that every board meeting must still be recorded and discoverable for seven years.
1. Explain why the Board-Restricted policy is not taking effect and describe the fix, including how you would validate it.
Read the worked answer
This is a policy precedence problem, not a broken policy.
Teams resolves meeting policy in this order: a direct policy assigned to the user wins over any group-assigned policy; among group assignments the policy from the highest-priority (lowest rank) group wins; the tenant-wide default applies last. So:
- The 11 users with the direct 'Executive-Voice' assignment ignore the group-based Board-Restricted policy entirely. No amount of re-ranking the group changes that.
- The 4 users in two groups are governed by whichever group has the better rank, which may be the older, broader policy.
Fix:
- For the 11, either remove the direct assignment or merge every required setting into a direct Board-Restricted policy - but only one policy is effective, so the correct move is a single direct policy that carries both the voice and meeting requirements, or removal of the direct assignment if voice settings can be expressed at the group level.
- Re-rank the two groups so Board-Restricted outranks the legacy policy, and remove overlapping group memberships where possible.
- Freeze unannounced direct policy assignments and add them to change control - direct assignments are invisible in the group view, which is why this was missed.
Validate: confirm the effective policy per user in the Teams admin center or with Get-CsUserPolicyAssignment, then test as two real board members: one external anonymous joiner must hit the lobby, and recording must be unavailable. Allow propagation time; test with a canary account before the next board meeting.
2. Which of the required controls are policy settings, which have licensing dependencies, and how do you sequence them?
Read the worked answer
Sort the controls by where they are enforced.
- Base meeting policy, no add-on needed: anonymous join disabled, lobby bypass restricted, who can record, who can present, IP audio/video restrictions.
- Purview dependency: meeting sensitivity labels require the labels to be published and the users licensed for the labeling capability; a label with no published policy is invisible to the organizer regardless of the meeting policy.
- Add-on dependent: watermarking of shared content and recordings, and several label-driven meeting options such as preventing copy/paste of chat, typically require Teams Premium for the organizer. Verify each against the current licensing matrix - this is the most frequently wrong assumption in designs.
- End-to-end encryption: available in the base commercial service, but it is architecturally incompatible with recording, transcription, and live captions.
Sequence: publish the label first, then assign the meeting policy, then enable the add-on-dependent settings on a pilot of two board members, then widen. Enforcing in the reverse order is what produces 'we turned it on and nothing changed' tickets. License only the board organizers for Premium; do not license 1,100 users to protect 14.
3. The CEO wants end-to-end encryption, and Legal wants every board meeting recorded and discoverable for seven years. Resolve the conflict.
Read the worked answer
The two requirements are mutually exclusive - say so explicitly rather than shipping a compromise nobody agreed to.
End-to-end encryption prevents recording, transcription, and live captions by design; if the client cannot be decrypted server-side, there is nothing for eDiscovery to collect. It also constrains who can participate: participants on older clients, dial-in, or unsupported endpoints cannot join an E2EE meeting, which explains client-side join failures when someone joins from a mobile device with an outdated client.
Recommend a tiered model:
- Tier 1 - all scheduled board and committee meetings (the 14 users): sensitivity label with restricted recording, watermarks, no anonymous join, lobby enforced, DLP applied to chat and shared files, standard meetings recorded and retained seven years. This satisfies Legal by default.
- Tier 2 - E2EE, exception-only: limited to specific discussions agreed with Legal, scheduled ad hoc, no dial-in, updated clients required, recording disabled. Because nothing is recorded, Legal must accept a substitute business record - minutes, a post-meeting summary, participant list, and the meeting metadata - and sign that acceptance in writing.
Also worth flagging to Legal: E2EE protects media in transit through Microsoft, but the board's real leak risk is a forwarded deck from SharePoint - label-driven protection and DLP on the shared files matter more than E2EE for most of these meetings.