Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Teams Premium is an add-on licence; the licensing page states 'Teams Premium licenses are not a replacement for Teams licenses. Users must have both a Teams license and a Teams Premium license', and the tenant must be commercial, worldwide public sector, EDU, GCC, GCC High, DoD or non-profit. The feature comparison table (checked 2026-09-27) places 'View and recap meetings you attended' in base Teams, while 'Intelligent Meeting Recap instant meetings', 'View AI-generated notes and tasks from meetings', 'View and recap meetings that you missed', 'Recap for transcript only meetings', multilingual recap, speaker timeline markers, auto-generated chapters and live translated captions and transcripts are Premium only. The same page records that from 1 April 2026 some previously Premium features moved into Teams Enterprise.
Ask: For our tenant as licensed today, which recap and translation features are enabled by our Teams Enterprise entitlement and which require the Teams Premium add-on, and does our purchase date fall before or after the 1 April 2026 licensing change?
Deployment and where recap data sits
Public claim only
Multi-tenant SaaS inside the customer's own Microsoft 365 tenant. Microsoft's data, privacy and security page for intelligent recap (checked 2026-09-27) states transcripts are stored in the meeting organiser's Exchange Online account, and with recording also in OneDrive with the recording; AI-generated notes, tasks, speaker markers and personalised markers are stored in an Exchange folder in participants' mailboxes, and chapters, topics and screen-share markers in OneDrive or SharePoint with the recording. No on-premises or private-cloud option is described.
Ask: Confirm that no recap artefact for our tenant is stored outside our Exchange, OneDrive and SharePoint tenancy, and name any Microsoft-side store or cache that holds prompts, transcript extracts or model outputs.
AI features in the licence
Public claim only
The Premium column of Microsoft's feature comparison (checked 2026-09-27) names, as AI-powered communication: intelligent meeting recap for instant meetings, AI-generated notes and tasks (including for VoIP and PSTN calls), recap of meetings the user missed, recap for transcript-only meetings, multilingual meeting support, speaker timeline markers, auto-generated chapters, join and leave markers, name-mention markers taken from the transcript, and live translated captions and transcripts. The same licence bundles features that are not AI, including end-to-end encryption for meetings up to 200 participants, watermarks, 'who can record and transcribe', sensitivity labels for meetings, meeting templates and themes, advanced collaboration analytics and the Queues app.
Ask: Which named Premium features will be switched on for which user groups in our firm, and can the AI recap features be left off while the meeting-protection features are used?
Jurisdiction and legal content
Public claim only
Teams Premium is a general-purpose meetings product with no legal content set, no citator and no jurisdictional legal material; the pages read describe no Australian legal features. Live translated captions are described as covering 40 languages. Its relevance to Australian legal work is that recap operates over recordings and transcripts of whatever is conducted on Teams, which in practice includes remote hearings, mediations, examinations and client conferences.
Ask: Confirm there is no legal-content or legal-advice component, and state whether recap output is treated by Microsoft as customer content of our tenant for the purposes of the subscription terms.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Recording consent and client authority
Not confirmed
The Teams settings and policies reference (checked 2026-09-27) lists 'Meeting recording' default On and 'Require participant agreement for recording and transcription' default Off; when that second setting is On, participants' audio, video and content sharing are turned off until they agree to be recorded and transcribed. Recap cannot run unless transcription is enabled, so the firm's recording and consent posture is a configuration decision, not a vendor control. Microsoft's Premium feature list includes an organiser-level 'who can record and transcribe' restriction.
Ask: What notice and consent will we require before a Teams meeting involving a client, witness or court is transcribed, and will we turn on 'Require participant agreement for recording and transcription' tenant-wide?
Foundation-model provider
Public claim only
Microsoft's data, privacy and security page for intelligent recap states: 'Currently, only AI-generated notes and AI-generated tasks in intelligent recap use a GPT model from Open AI through Azure OpenAI Service. However, more AI-based features might leverage GPT in future versions of Teams Premium.' It adds that 'Customer data isn't shared with non-Microsoft parties, including with Open AI' and that Microsoft runs the GPT-based models internally using a dedicated Azure OpenAI service within the Microsoft 365 compliance boundary, alongside 'other internal AI models' that are not named. No model version, region or endpoint is published, and no customer model choice is described.
Ask: For our tenant, name the model and version behind AI-generated notes and tasks, the Azure region the inference endpoint runs in, the other internal models used for markers, chapters and translation, and the notice we get if the model or provider changes.
Subprocessors
Public claim only
Microsoft's supplier management page (checked 2026-09-27) states that, per the Microsoft Products and Services Data Protection Addendum, Microsoft gives customers at least six months' notice before a new subprocessor processes Customer Data, 'except for subprocessors that support artificial intelligence functionality, where Microsoft provides at least 30 days' notice and customers have the ability to disable use of that subprocessor for at least 6 months after notice', and that notice is given by updating the Microsoft Online Services Subprocessor List. A separate AI subprocessors page states AI subprocessors are disclosed on that list and that customers can subscribe to change notifications; that page is written for Microsoft Copilot and does not name Teams Premium. The subprocessor list itself was not opened, so no subprocessor is recorded here for intelligent recap.
Ask: Which entries on the Microsoft Online Services Subprocessor List apply to Teams Premium intelligent recap and live translation for an Australian tenant, and how do we exercise the AI-subprocessor disable right in practice?
Training on customer content
Public claim only
Microsoft's data, privacy and security page for intelligent recap states plainly: 'Customer data isn't logged or used for any AI model training or testing.' The same page states customer data is not shared with non-Microsoft parties including OpenAI, and that recap inherits the organisation's Teams security, compliance and privacy policies. This is product documentation, not a contract clause; the Data Protection Addendum and Product Terms were not opened.
Ask: Point to the clause in our agreement or the DPA that carries the documentation statement that customer data is not logged or used for AI model training or testing, and confirm it covers transcripts, recap outputs and translation text.
Feedback and telemetry sent to Microsoft
Public claim only
Microsoft's Teams feedback page (checked 2026-09-27) states that the 'Report a problem' and survey features are on by default and that 'Data sent through Report a problem is considered "Feedback Data" under your Microsoft 365 or Office 365 agreement, including information that would otherwise be considered "customer data" or "personal data".' Admin controls exist through the Cloud Policy service and the Teams feedback policy cmdlet, including log and screenshot collection. The Microsoft 365 feedback page states Microsoft reviews all submitted feedback and uses it to improve product experiences 'including by improving the quality of AI-generated responses'.
Ask: Will we disable in-product feedback, surveys, screenshot and log collection for fee earners, given that feedback data may include meeting content that would otherwise be customer data?
Retention of transcripts, recordings and recap outputs
Public claim only
Microsoft's recap page states all the recap features follow the meeting recording retention policy. The Teams admin documentation sets the default expiration time for recordings and transcripts at 120 days, configurable from 1 to 99,999 days or set never to expire by PowerShell, with changes applying only to newly created items; the policy reference shows 'Recordings automatically expire' default On and 'Default expiration time' 120. The compliance page warns that 'End users can modify the expiration date of any recordings they control, so you shouldn't rely on meeting expiration settings for legal protection', and that Purview retention takes precedence over expiry. No separate retention period is published for recap notes and tasks stored in mailboxes.
Ask: State the retention actually applied to our transcripts, recordings, recap notes and tasks, and how the mailbox-stored recap artefacts are covered by our Purview retention and disposition policies.
Deletion and destruction
Public claim only
Microsoft's data retention, deletion and destruction page (checked 2026-09-27) states that for active deletion customer content is deleted within at most 30 days and, on subscription end, customer data is retained in a limited-function account for 90 days and deleted no later than 180 days after expiry or termination, after which it is 'rendered commercially unrecoverable'. The privacy and data management page adds that a subscriber may request expedited de-provisioning, after which Microsoft deletes all user data three days after the administrator enters a lockout code, including data under hold. On expiry an individual recording goes to the recycle bin, and is unrecoverable once purged.
Ask: Confirm in writing the deletion path and timescale for transcripts, recordings and mailbox-stored recap artefacts on a matter-by-matter basis, and whether Microsoft will certify deletion on exit.
Microsoft personnel access to content
Public claim only
Microsoft's service engineer access control page (checked 2026-09-27) states all access to Microsoft 365 systems and customer data is brokered by an internal Lockbox system on a just-in-time, just-enough-access model, requiring role eligibility, business justification, manager approval and a time limit, with requests logged and retrievable through the Office 365 Management Activity API. The Purview Customer Lockbox page states 'no Microsoft personnel have permission to access customer content on an ongoing basis' and that, where a customer licenses and enables Customer Lockbox, a tenant administrator must approve any service-engineer attempt to access customer content.
Ask: Is Customer Lockbox included in our licensing and enabled, and will approval of any Microsoft access request to mailboxes or sites holding recap artefacts be routed to a named partner?
Access control, policy control and audit
Public claim only
Recap access follows Microsoft 365 identity and permissions: artefacts sit in participants' mailboxes and in the organiser's OneDrive or the channel's SharePoint site, and attendees have permission to view the recording by default. Recording and transcription are governed by Teams meeting policies, and Premium adds organiser control over who can record and transcribe, restriction of copying or forwarding of captions, transcript and recap, prevention of screen capture, and sensitivity labels for meetings (the label feature requiring an E5 or compliance subscription). Several Premium features require admin configuration in the Teams admin centre before users can use them.
Ask: Which Teams meeting policies, templates and sensitivity labels will we enforce for matter meetings, and can we export a complete audit trail of who opened a recap or transcript?
Encryption in transit and at rest
Public claim only
Microsoft's encryption overview (checked 2026-09-27) states customer data at rest is encrypted by service-side technologies including BitLocker, Distributed Key Manager, Azure Storage Service Encryption and service encryption in Exchange, OneDrive and SharePoint, with a customer-managed key option (Customer Key, keys held in Azure Key Vault) available for Exchange, SharePoint, OneDrive and Teams files; for data in transit all customer-facing servers negotiate TLS, defaulting to TLS 1.2. Separately, end-to-end encryption for online meetings of up to 200 participants is listed as a Teams Premium feature requiring admin configuration. No statement was found on encryption of the transcript text on the path to the Azure OpenAI inference service.
Ask: Confirm encryption and key management for transcripts, recordings and recap artefacts in our tenant, whether Customer Key covers them, and whether end-to-end encrypted meetings can be recorded or transcribed at all.
Independent assurance and Australian government assessment
Public claim only
Microsoft's SOC 2 compliance page lists Microsoft Teams, Customer Lockbox, Exchange Online and Service Encryption with Customer Key among the commercial in-scope services, and states that an existing subscription or trial account is needed to download SOC 1 and SOC 2 attestation reports and bridge letters from the Service Trust Portal. The ISO/IEC 27001 page links a Microsoft 365 ISO 27001:2022 certificate for 2024-2027 on that portal. The IRAP page states Office 365 completed an IRAP assessment and that in April 2018 the ACSC announced certification of Azure and Office 365 at the PROTECTED classification, with scope in the assessment reports. None of those certificates, reports or scope statements was opened, and none of the three pages names Teams Premium or intelligent recap as a separately assessed component.
Ask: Provide the current SOC 2 Type 2 report, ISO 27001 certificate and IRAP assessment letter, and state whether Teams Premium intelligent recap and its Azure OpenAI dependency are inside the audited and IRAP-assessed scope.
Contract, terms and Australian contracting entity
Not confirmed
The licensing page states Teams Premium 'is licensed on a per-user subscription basis and is subject to the Universal Terms for Online Services', and Microsoft's compliance pages name the Microsoft Products and Services Data Protection Addendum and the Product Terms as the governing data-protection documents. None of those documents was opened for this profile, and no page read names the Australian contracting entity, an ACN or ABN, a governing law or a liability position; the Australian page footer carries only a copyright line. Trial terms on the licensing page state Microsoft may terminate or modify the trial at any time without notice or liability.
Ask: Name the Microsoft entity that will contract with our firm in Australia, with its ACN or ABN, and provide the executed Product Terms, Universal Terms for Online Services and Data Protection Addendum as they apply to Teams Premium.
Australian data residency and cross-border processing
Public claim only
Microsoft's recap page states 'Data in Teams resides in the geographic region associated with your Microsoft 365 (or Office 365) organization' and that recap is multi-geo capable. The Microsoft 365 data locations page lists Australia as a Local Region Geography with Advanced Data Residency available, and names Microsoft Teams, Exchange Online and SharePoint and OneDrive as ADR-eligible. The Teams residency page conditions the Product Terms commitment on the tenant's sign-up country being in a Local Region Geography, and the ADR commitment on holding an ADR subscription for all users; it also states the actual data location can be read in the tenant admin centre. A Teams policy 'Store recordings outside your country/region' exists and is Off by default. Where the GPT inference runs is not stated on any page read.
Ask: Confirm our tenant's committed data location for Teams, Exchange and OneDrive, whether Advanced Data Residency is required for it, and in which country the Azure OpenAI inference for AI-generated notes and tasks is executed.
Incident notification
Public claim only
Microsoft's security incident management page (checked 2026-09-27) states that whenever Microsoft becomes aware of a breach of security involving unauthorised loss, disclosure or modification of customer data it notifies affected customers within 72 hours as set out in the Data Protection Addendum, with the clock starting at the official security incident declaration, and that notification describes the nature of the breach, approximate user impact and mitigation steps. The DPA itself was not opened and no Teams Premium incident history was found on any page read.
Ask: Confirm the 72-hour notification applies to our Australian subscription and to AI subprocessor incidents, how it interacts with our Notifiable Data Breaches obligations, and provide any incident affecting Teams transcripts or recap in the last 24 months.
Change notice for features, models and processors
Not confirmed
For processors, Microsoft's supplier page states DPA notice periods of at least six months for new Customer Data subprocessors and at least 30 days for AI subprocessors with a right to disable for six months. For product change, the licensing page shows Microsoft moved features between Teams and Teams Premium effective 1 April 2026 and states trial terms may be modified at any time without prior notice, and the recap page states 'more AI-based features might leverage GPT in future versions of Teams Premium'. The two sit uneasily together: subprocessor change carries a published notice period and objection mechanism, while feature and model expansion within the product does not.
Ask: What advance notice will we receive before a new AI feature, a new model or a new inference region is introduced into Teams Premium, and can we pin the recap feature set for a defined period?
Export and exit
Public claim only
Because recap artefacts are stored in Exchange mailboxes and in OneDrive or SharePoint, they exit with the tenant rather than through a product export. Microsoft's documentation states that during an active subscription a subscriber can access, extract or delete customer data, that data is retained in a limited-function account for 90 days after a paid subscription ends to allow extraction, and is deleted no later than 180 days after termination. The licensing page states that when trial licences expire users lose all Teams Premium functionality with no grace period, and that uploaded Premium assets remain in the tenant but are unusable.
Ask: If we drop the Teams Premium add-on but keep Microsoft 365, what happens to existing recap notes, tasks, chapters and markers, and can they still be read, exported and placed under legal hold?
Connectors and third-party apps
Not confirmed
The pages read do not describe intelligent recap reaching outside Microsoft 365: its inputs are the meeting transcript, the recording, the attendance report, PowerPoint Live content and the user display name, and its outputs are written to Exchange, OneDrive and SharePoint. Teams itself supports meeting apps and third-party apps, which are governed by separate Teams app policies not covered by any page read for this profile, so a firm's exposure depends on which meeting apps it permits.
Ask: Which Teams meeting apps and third-party integrations will be permitted in matter meetings, and can any of them read the transcript, captions or recap content?
Open-web retrieval
Public claim only
The recap page names the sources recap is built from and none of them is the open web: meeting transcript, meeting recording, attendance report, PowerPoint Live and the user display name. The pages read describe no web grounding, retrieval or browsing for recap, and no Bing or search connector for the feature. Base Teams features that do use public web data are documented separately and are not part of this add-on record.
Ask: Confirm that intelligent recap, live translated captions and live translated transcription perform no open-web retrieval for our tenant, and that no recap content is sent to a web-grounded service.
Agent actions
Public claim only
Recap produces read-only artefacts: notes, suggested tasks, chapters, topics and timeline markers, described as insights shown on the Recap tab and in the Meeting Recaps app. The pages read describe no autonomous action, no sending of messages or email, no file changes and no external system writes by the feature. Suggested tasks are described as suggestions with an assignee, not as tasks created and dispatched by the product.
Ask: Can any Teams Premium AI feature create, assign or send anything outside the recap surface without a user action, and are suggested tasks ever written into Planner, To Do or Outlook automatically?
Human review of AI output
Not confirmed
None of the pages read states an accuracy rate for AI-generated notes, tasks, chapters, markers or live translation, and none sets out a vendor expectation that a person verifies recap output before it is relied on. The recap documentation describes the feature as helping users 'quickly find the most important information, even if they miss the meeting', with no caveat about verification against the transcript. There is therefore no published vendor position to record for a firm that wants to rely on a recap of a hearing or a client conference.
Ask: What accuracy measurement exists for AI-generated notes, tasks and live translated transcripts on Australian-accented speech and legal terminology, and what does Microsoft say about relying on recap output without checking it against the transcript?
