Teams Voice Memos – Interesting Functionality with a Compliance Problem

Record Your Thoughts in Teams Personal and Group Chats

The Teams mobile clients allow users to record a voice memo and send it to personal or group chats. It’s a nice feature available since March 2019 that is popular with users. To record a voice memo, hold down the microphone icon (Figure 1) and speak. Release the hold to stop the recording and then send it as you would a normal message.

This only works for personal and group chats. You can’t send voice memos to channel conversations. Although the Teams desktop and browser clients don’t support voice memos, you can play back voice memos on either client. Figure 2 shows how a voice memo appears in a chat in the browser client.

The Compliance Issue

After recording and sending a number of voice memos, I looked at the compliance records generated by Office 365. As these memos are part of personal chats, the compliance records are stored in the mailboxes of everyone participating in the chat. In the example I use, Office 365 creates compliance records in two mailboxes – the sender and the recipient.

The first problem is that Teams does not capture any metadata for voice memos (not even that the message is a voice memo). No attempt is made to use language recognition to interpret and capture the contents of the voice memo to make it searchable, like the way that Stream generates automatic captions for videos. In saying this, I note that Stream only currently generates automatic captions for English and Spanish language videos; the task of voice recognition and transcription for all the languages supported by Office 365 is immense.

In short, to all intents and purposes, the compliance records captured for voice memos are blank. Office 365 content searches can find the compliance records, but the emptiness of the compliance record will disappoint any compliance officer or investigator (Figure 3).

The second problem is that because Office 365 captures no metadata or other information for voice memos, the only way to find that these items exist is to look for everything in a mailbox. But even when you find something, the emptiness problem means that you know that someone communicated with someone else, but have no idea of what was said.

The reason that this is a compliance problem is evident from the conversation in Figure 1 where a participant is told that they’re going to receive some information in a voice memo. That information could be instructions to commit some form of behavior that is prohibited by law or the organization. We don’t know because no trace is left about what was said. Even MFCMAPI reveals nothing except perhaps a link to some data in the Teams Azure storage (Figure 4), and that’s just speculation on my part.

What Microsoft Needs to Do

Voice memos are valuable functionality and no one wants to see them disappear. However, compliance is terribly important for any company or business that must operate in line with legal or regulatory guidelines. To fix the problem, Microsoft needs to capture metadata for voice memos posted to chats, ideally with some information about the voice content to help investigators find these items and understand what they contain. Without the ability to search voice memos, a real gap exists in the Office 365 compliance story.

In the meantime, if you’re worried about the compliance issue for voice memos, you can update the Teams messaging policies used in the tenant to disable voice messages (Figure 5). It takes a little while for the new policy settings to get to clients, but when the policy arrives users won’t be able to send any more voice memos.

---

Compliance is a difficult subject to master, especially across multiple Office 365 workloads. That’s why we spend a lot of time looking into the nooks and crannies of compliance and documenting it here and in the Office 365 for IT Pros eBook.