Disabling Teams chat encryption

You can configure Teams to not encrypt chat messages with external users while retaining the decryption of calendar appointments when using eperi sEcure Platform for email protection. However, unlike messages, files uploaded to Teams chats and channels will remain encrypted.

1. Log in to your Microsoft 365 admin center and navigate to the Microsoft Entra admin center by selecting the Identity icon in the toolbar.
   
2. Under Applications > Enterprise applications > All applications, locate the application you registered for the eperi sEcure Platform described in the procedure Registering a new app in Azure Active Directory by finding the Application ID in the list that matches the Client ID in your eperi sEcure Platform M365 Settings:
   
3. Open the details of the application by clicking its hyperlinked name, then list its permissions to verify that it has the required ChatMember.Read.All permission.
   
4. In your Teams forward proxy app, make sure the following options are enabled:
   • Enable Calendar Encryption
   • Invert User Exclusion List

   Note: After enabling Invert User Exclusion List, all new chats to any user listed in Teams Exclusion List Users will be encrypted.
5. Navigate to Services > Proxies and assign the Teams forward proxy app and the Office365 Substrate forward proxy app to your forward proxy.
6. Restart your forward proxy.
7. Ensure that your current m365.pac configuration still has the default, unaltered configuration for Microsoft Teams:

       var useTeams = true;
       var teamsMessages = "*.ng.msg.teams.microsoft.com";
       var teamsPastePictures = "*.asyncgw.teams.microsoft.com";
       var teamsNotifications = "*.notifications.teams.microsoft.com";
       var teamsPresence = "presence.teams.microsoft.com";
       var teams = "teams.microsoft.com";
       var teamsTrouter = "*.trouter.teams.microsoft.com";
       var isTeams = useTeams && (shExpMatch(host, teamsMessages)
       || shExpMatch(host, teamsNotifications)
       || shExpMatch(host, teamsPastePictures)
       || shExpMatch(host, teamsPresence)
       || shExpMatch(host, teams)
       || shExpMatch(host, teamsTrouter));
       if (isTeams || isOneDrive || isSharePoint || isMail || isSubstrate || isGraph || isPlanner || isExchangeAdminHost)

8. If your m365.pac configuration required any changes, upload the the updated PAC file to the location where it is being served.