A meeting is four systems cooperating: Exchange holds the appointment, Teams holds the meeting object, policy gates every capability, and options fine-tune one occurrence. Every 'why can he but not me' resolves to which layer said no.
The flow — what actually happens
Plain-language first; the packet-level
view underneath each step is what you'd see in a Wireshark trace, and what healthy looks like.
-
Scheduling
Create a meeting and TWO things are born: a calendar item in Exchange (the invitation, the time, the audience) and a Teams online-meeting object (the join link's target, the options, the eventual chat thread). The join URL in the invite is the bridge between them.
On the wire Graph/EWS calendar write to Exchange + onlineMeeting creation in Teams. Proof of the duality: delete the calendar item and the meeting link often still works — the Teams object outlives the appointment.
-
The join gauntlet
A click on Join runs a chain of gates in order: is the meeting full (capacity)? → who are you (auth: tenant member / guest / federated / anonymous)? → does the LOBBY admit you (meeting options + org defaults per identity class)? → what ROLE do you get (organizer/presenter/attendee)? Only then does media negotiation start.
On the wire All signalling on HTTPS 443. A lobby hold is visible as an admitted-later timeline in the attendance report; an auth-class rejection never reaches the lobby at all.
-
Capabilities resolve per participant
Now the layered decision: the ORGANIZER'S policy sets the ceiling (can this meeting have recording at all?), meeting OPTIONS narrow it for this occurrence (who can present, mics off), your ROLE applies the last cut. A capability exists only if all three said yes.
On the wire No packets — this is config. The proof surface is the attendance report plus policy reads: organizer's TeamsMeetingPolicy vs the meeting options vs the user's role explain every greyed-out button.
-
The meeting lives, then leaves artifacts
During: roster, chat thread, sharing, reactions — each a service feature with its own store. After: the chat persists, the attendance report finalises, any recording/transcript lands in storage (next concept). The meeting object itself idles — reusable until cleaned up, which is why old links keep working.
On the wire Attendance report assembles from join/leave signalling events — it is the meeting's flight recorder and your first stop for any dispute about who was there when.
The four-layer capability model (the ticket-solving frame)
| Layer |
Set by |
Scope |
| Org defaults |
TeamsMeetingConfiguration + org settings |
Everyone, incl. anonymous-join rules |
| Organizer's policy |
TeamsMeetingPolicy assigned to the ORGANIZER |
The ceiling for every meeting they create |
| Meeting options |
Organizer, per meeting |
Narrows within the ceiling (never widens) |
| Role |
Organizer/co-organizer/presenter/attendee |
The per-person final cut |
The two rules people miss: the organizer's policy governs the whole meeting (an
attendee with a permissive policy gains nothing in a restrictive organizer's meeting),
and options can only restrict what policy allows — if policy blocks it, no option
resurrects it, which is why the option sometimes simply isn't rendered.
Identity classes at the door
Tenant member → guest (in your directory) → federated (their tenant) → anonymous
(a browser and a link). Each class has its own lobby default and its own switches; the
AnonymousUserAuthenticationMethod and anonymous-join toggles (all in our nightly
scan) decide whether the least-trusted class gets in at all. Meeting-join tickets
should start with "which class was the user that day?"
Failure signatures
| Symptom |
Layer |
| "Record" greyed for everyone incl. organizer |
Organizer's policy (AllowCloudRecording false) |
| Attendee can't unmute in one meeting only |
Meeting options (mics disabled) — not policy |
| External partner lands in lobby every time |
Their identity class's lobby default; fix options or org default for federated |
| Same link works on Tuesday, lobby on Wednesday |
Options changed between occurrences, or the organizer's policy changed (check serv365 drift log for that day) |
| Old meeting link mysteriously live |
Teams meeting object persistence — treat links as credentials |
What to watch (proofs)
- The organizer ceiling:
Get-CsTeamsMeetingPolicy -Identity <their policy> — read it
before touching options; serv365 keeps nightly versions so you can diff "Tuesday vs
Wednesday" definitively.
- One meeting's narrowing: Graph
GET /me/onlineMeetings/{id} shows the options object
(lobbyBypassSettings, allowedPresenters) — the per-occurrence truth.
- The flight recorder: attendance report (in-client or Graph attendanceReports) — join/
leave/lobby-admit timestamps per participant.
- Door policy for the untrusted: your scanned TeamsMeetingConfiguration +
AnonymousUserAuthenticationMethod values — the anonymous-join stance, provable.
Discussion
No messages yet — start the thread.
