The policy model: Global, custom, and who wins

Teams governance is ~140 policy types (our scanner sees every one of them in your tenant), and they all follow the same shape:

• Global (Org-wide default) — applies to everyone not covered by something more specific. Its real name in PowerShell is Global.
• Custom policies (Tag:<name> in PowerShell output) — created by you, assigned to users directly or via group policy assignment.
• Precedence: direct user assignment → group assignment (by group rank) → Global. The most specific assignment wins; there is no merging. A user with a custom meeting policy ignores the Global meeting policy entirely — every setting comes from their policy.

The operational trap: changing Global does nothing for users with custom policies. When Microsoft announces a behaviour change "controlled by policy X", you must check every instance of that policy type, not just Global — which is exactly what our verdict engine does when it reports "7 of 11 instances hold the affected value".

Effective-policy debugging order:

1. Get-CsUserPolicyAssignment -Identity user@domain — what is actually assigned, and by which route
2. Get-CsTeamsMeetingPolicy -Identity <that policy> — what the winning policy says
3. Group assignments: Get-CsGroupPolicyAssignment — rank decides between multiple groups