Microsoft Teams for CUI in CMMC Level 2, a step-by-step hardening checklist (guest access, file sharing, meeting chat, recordings)

Microsoft Teams can feel like a conference room, a file cabinet, and a phone system all in one. That’s great for speed, but it’s also how Controlled Unclassified Information (CUI) quietly spreads into chats, meeting recordings, and shared links.

When I help defense contractors get ready for a CMMC Level 2 assessment, I treat Teams CUI hardening as a tenant-wide job, not a Teams-only job. Teams depends on Entra ID, SharePoint, OneDrive, Purview, and Defender, and your assessor will care about the full chain.

I do a lot of Small Business IT work (often as a Managed IT for Small Business partner), and the same discipline that protects everyday collaboration is what keeps CUI from slipping into the wrong hands.

Pick the right Microsoft 365 environment for CUI (Commercial vs GCC vs GCC High)

Before I change a single Teams policy, I document where CUI is allowed to live. In February 2026, many orgs handling CUI for DoD work choose GCC High, but I don’t treat that as a blanket rule. I verify contract language, flow-downs, and customer expectations, then I write down the decision.

Here’s the core idea: your environment choice sets guardrails for identity, audit, and data residency, which impacts NIST SP 800-171 practice families like SC (System and Communications Protection) and AU (Audit and Accountability).

A quick way to keep the conversation grounded is to compare at a high level:

Environment	Typical use case	CUI fit (verify in your tenant)
Commercial	Most SMB collaboration	Often not the target for CUI requirements
GCC	Gov-focused, many compliance features	Common for FCI and some regulated work
GCC High	Higher-regulated defense workloads	Common choice when CUI and strict controls apply

If you need context on feature timing and availability, I point clients to a Microsoft 365 Government roadmap deck and then validate what’s actually enabled in the tenant.

This is also where Cloud Infrastructure decisions show up. A clean Secure Cloud Architecture, a well-planned Office 365 Migration, and consistent Cloud Management reduce “shadow” storage paths. That reduces CUI sprawl and makes your Digital Transformation easier to defend in an assessment.

Lock down identity first (Entra ID, Intune, Defender)

If identity is loose, every Teams setting becomes a paper lock on a glass door. My baseline aligns to AC (Access Control) and IA (Identification and Authentication), and it’s built in Entra ID with device enforcement behind it.

At minimum, I enforce MFA for all users, block legacy authentication, and restrict privileged roles. Conditional Access is where the real protection happens: I require compliant, managed devices for Teams, SharePoint, and Exchange. If a device isn’t managed, it doesn’t touch CUI.

For assessor-ready alignment, Microsoft’s own guidance is useful, but I still validate what’s live: Microsoft Entra guidance for CMMC Level 2 access control and recommended Teams access policies help frame the control intent.

This is also where Endpoint Security and Device Hardening become non-negotiable. I commonly pair Intune compliance with Microsoft Defender signals (device health, malware risk, encryption status) so Conditional Access can block risky sessions. That supports SC goals too, because you’re controlling the endpoint-to-service path, not just the app.

Evidence I like to keep on hand: screenshots of Conditional Access policies, an export of named locations and authentication methods, and role assignment reports for Teams admin roles. This is the kind of Technology Consulting that pays off later, because it turns “we think it’s set” into “here’s the proof.”

Teams CUI hardening checklist for guests, sharing, chat, and recordings

This is the checklist I walk through when the goal is real Teams CUI hardening, not “best effort.” It maps cleanly to AC, AU, MP (Media Protection), and SC, and it gives you artifacts an assessor can test.

1. Separate “guest access” from “external access.” Guest access adds outside users into your tenant. External access (federation) can allow chat and calling with other domains. I decide which is allowed for CUI workstreams, then I document the business reason either way. A common misconfig is disabling guests but leaving open federation to any domain.
2. Lock guest access down hard (or turn it off). If guests are needed for a specific program, I use allow lists, expiration, access reviews, and Conditional Access where supported. I also verify SharePoint external sharing matches the decision, because Teams files live there.
3. Set SharePoint and OneDrive sharing links to safe defaults. I block “Anyone with the link” style sharing for CUI libraries. When external sharing is permitted for non-CUI areas, I still default links to “Specific people” and require sign-in.
4. Use Microsoft Purview sensitivity labels for CUI. I label the containers and content, then enforce encryption and usage restrictions where it fits the workflow. I test the user experience, because labels that break work get bypassed.
5. Turn on Purview DLP for Teams chat and files. Chat messages and attachments are a classic retention gap. I write DLP rules that alert and block when CUI is shared outside approved boundaries, then I capture the rule configuration as evidence.
6. Harden meeting settings. I disable anonymous join for CUI meetings, force the lobby for external participants (if any), and restrict who can present. I also set meeting chat to match risk. The common mistake is leaving meeting chat on while assuming “it’s just a meeting.”
7. Control recordings and transcripts like files, because they are files. I verify where recordings land (OneDrive for non-channel meetings, SharePoint for channel meetings) and I validate permissions after the meeting. Over-sharing happens when a recording inherits broad site access.
8. Set retention and eDiscovery holds intentionally. If you rely on default retention, you’ll miss CUI chat evidence when it matters. I set Purview retention policies, document durations, and align to contract needs.
9. Turn on auditing and prove it. I use the NIST National Checklist Program Teams checklist as a reference point, then I pull sample audit events (guest added, file shared, meeting recording accessed) to show AU coverage.
10. Capture assessor-ready artifacts as you go. I keep screenshots of Teams meeting policies, exports of SharePoint sharing settings, Purview label and DLP configs, and a short set of audit searches that reproduce key events.

This is where Business Continuity & Security meets day-to-day operations. It’s the same mindset I bring to Infrastructure Optimization, Data Center Technology validation, Restaurant POS Support, and Kitchen Technology Solutions: lock down the basics, test the edge cases, and document the “why.”

Conclusion

Teams won’t “hold CUI safely” by accident. If I want a clean CMMC Level 2 story, I have to line up Entra ID access controls, SharePoint and OneDrive sharing defaults, Purview labels and DLP, and Defender-backed device rules, then prove them with evidence. The fastest path is to pick clear boundaries, apply the policies, and run a few real-user tests so misconfigs show up early. If you want, I can help you turn these settings into a repeatable standard your assessor can validate.