Is Microsoft Teams chat end-to-end encrypted? No

The short answer

No. Microsoft's own documentation lists chat messages as standard encryption yes, end-to-end encryption no. Chats are encrypted in transit and at rest with keys Microsoft or your organisation holds, so compliance staff in your tenant can search, export and hold them. End-to-end encryption in Teams exists only for one-to-one calls and Premium meetings. To send a Teams chat your organisation cannot read, encrypt it on your phone in HushHush first and paste the ciphertext into Teams; the other person decrypts it in their HushHush.

What Microsoft Teams can and cannot see

Microsoft Learn's page "Encryption in Microsoft Teams" is unusually clear. Standard encryption applies to every chat by default: TLS 1.2 or later with AES-256 in transit, disk encryption at rest, and a service-encryption layer with keys Microsoft manages. End-to-end encryption is a separate layer "for one-to-one calls and for meetings configured to require it". Microsoft says that layer "covers audio, video, and video-based screen sharing. It doesn't cover chat." Its table of modalities spells it out: chat messages, standard encryption yes, end-to-end encryption no.

Even the calls need setting up. For one-to-one calls, end-to-end encryption "is disabled by default. An admin must enable E2EE, and both participants must then turn it on in their Teams client settings". Meetings need Teams Premium and the organiser must require it when scheduling. When it is on, recording, captions and transcription stop working "because the service can't decrypt media". That phrase is the whole story: when Microsoft cannot decrypt something, its features cannot touch it. Chat is not in that category.

Why is chat kept readable? Microsoft's security guide says data is encrypted at rest "so that organizations can decrypt the content if needed, to meet security and compliance obligations through methods such as eDiscovery". The compliance overview lists what that means: content search lets compliance admins "gather Teams data from all users, review it, and then export it"; eDiscovery exports chats; communication compliance policies examine "individual chats" for offensive language and sensitive information; legal hold keeps "immutable copies" even when users delete or edit. The retention page adds that a chat you delete under a retention policy "is stored in a secured location designed for eDiscovery searches by compliance administrators" until the period ends.

Customer Key lets an organisation encrypt chat messages with keys it controls. That is control for the organisation, not privacy from it: Microsoft notes that search, data loss prevention, retention, eDiscovery and Copilot "rely on access to stored content", so the chat stays readable to whoever wants those features.

What	Teams today	With HushHush
The words you type	Visible to your Microsoft 365 tenant	Ciphertext only
Who you message, and when	Yes	Still yes
Content search, eDiscovery and legal hold	Yes By staff with compliance roles, across all users' chats	Partly The search still finds the message, but returns ciphertext
Copies kept after you delete a message	Yes Under a retention policy or a hold, in a location you cannot see	Still kept, as ciphertext
Communication compliance scanning of one-to-one chats	Yes For offensive language and sensitive information	No readable text to match

Why this matters to ordinary people

This is not a manager reading over your shoulder. Only people with compliance roles can run these searches, usually for an investigation, a lawsuit or a data request. But the policy is the organisation's, not yours, and the copy outlives your delete. A chat about a medical appointment, a complaint about a colleague, a pay negotiation or a job offer elsewhere sits in your work account for as long as the retention rule says, and can be found and exported later by someone you have never met.

It cuts both ways. A contractor in a client's tenant writes into the client's archive. A lawyer on a client's Teams, a doctor on a hospital tenant, a union representative on the employer's system: in each case the tenant's owner, not the two people talking, decides who can read it and for how long.

How HushHush helps

HushHush encrypts the text on your phone before it goes into Teams. Teams carries only ciphertext: a block of characters it can store, search, hold and export, but nobody in the tenant can read. The other person copies it out of Teams and decrypts it in their HushHush. Both people need the app and pair once, in person, by scanning each other's QR code. No account, no sign-up, no server of ours; the keys live on the two phones and nowhere else, so there is nothing for a tenant admin, or for us, to turn over.

Step 1

Pair once, in person

Open HushHush, add a contact, and scan the QR code on the other phone. No account, no phone number, no server.

Step 2

Type it in HushHush

Write the message and tap send. It is encrypted on your phone and copied as ciphertext.

Step 3

Paste it into Teams

Teams carries the ciphertext. Your contact copies it and taps Paste in HushHush to read it. Automatic sending and decrypting exists for Telegram, Matrix and email; in Teams it is copy and paste.

What HushHush does not do. It does not hide who you talk to, when, or how often: Teams still records that you messaged that person at that time, how long it was, and the ciphertext itself, and an eDiscovery export still contains all of it. Both people need HushHush, so it does not help with a colleague who has not paired. It protects the text you type, not Teams calls or meetings. And it does not override your organisation's rules about what work chat is for.

Frequently asked questions

Is Microsoft Teams chat end-to-end encrypted?

No. Microsoft's encryption page lists chat messages as having standard encryption but no end-to-end encryption, and says the end-to-end layer "doesn't cover chat". Chats are encrypted in transit and at rest with keys Microsoft or your organisation holds, which is what lets the tenant search and export them.

Can my employer read my Teams chats?

People in your organisation with compliance roles can. Microsoft's documentation describes content search across all users' Teams data, eDiscovery export of chats, communication compliance policies that examine one-to-one chats, and legal hold. Your line manager does not get this in the Teams app; a compliance administrator gets it through Microsoft Purview.

Can you encrypt Teams messages yourself?

Not inside Teams. Microsoft's only end-to-end option covers one-to-one calls and Premium meetings, and Customer Key gives the organisation its own keys, not you. To make a Teams message unreadable to the tenant, encrypt it before it enters Teams, which is what HushHush does: you paste ciphertext, and the other person decrypts it on their phone.

Does deleting a Teams message really delete it?

Not if a retention policy or hold applies. Microsoft says users can still edit and delete, but the data is stored in a secured location for eDiscovery until the retention period ends, and a hold keeps immutable copies. What disappears from the app is not what the organisation keeps.

Encrypt it before Teams sees it.

HushHush is on the App Store and Google Play. Pair in person, then send in any app.

Download on theApp Store Get it onGoogle Play

Sources

Encryption in Microsoft Teams, Microsoft Learn, accessed 7 October 2026.
Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls, Microsoft Learn, accessed 7 October 2026.
Overview of security and compliance in Microsoft Teams, Microsoft Learn, accessed 7 October 2026.
Manage retention policies for Microsoft Teams, Microsoft Learn, accessed 7 October 2026.
Security guide for Microsoft Teams overview, Microsoft Learn, accessed 7 October 2026.

Is Microsoft Teams chat end-to-end encrypted? No. Here is what your organisation can read