ITAR Technical Data in Microsoft Teams: A Guide to What GCC High Covers and What Your Meeting Settings Still Decide

By Michael Branson

Quick answer. As of September 2026, Microsoft’s ITAR offering lists Microsoft Teams among the Office 365 GCC High in-scope services, backed by contractual commitments on where stored data is located and on limiting access to US persons, but the same International Traffic in Arms Regulations (ITAR) compliance page also states that “there’s no compliance certification for the ITAR” and that “customers are ultimately responsible for the protection and architecture of their applications within their environments.” The regulator’s text at § 120.56 Release, up to date as of September 22, 2026, lists “Oral or written exchanges with foreign persons of technical data in the United States or abroad” as a release, so, in this guide’s reading, the people admitted to a Teams meeting and the people who can open its recording are the controls that matter, and those are set in your tenant: anonymous join, the lobby, cross-cloud and guest access, and OneDrive and SharePoint permissions. Azure Communication Services is available in Azure Government with calling, chat and call recording and holds FedRAMP High accreditation as part of the GCC High service offering, according to Azure Communication Services for US Government, but Microsoft’s ITAR pages do not name it, Microsoft’s Teams interoperability page says its interoperability “isn’t compatible with Teams deployments using Microsoft 365 government clouds (GCC) at this time”, and the application built on it is the customer’s architecture to secure.

The design review is on Teams. A supplier’s engineer joins from another company’s tenant, a drawing goes up on screen, and the organizer records the session so the people who missed it can catch up. The tenant moved to GCC High earlier, and everyone assumed the move settled conferencing too. Then someone asks whether a contractor on the call counts as a foreign person under the regulation, whether that made the discussion an export, and whether the recording in the organizer’s OneDrive can be opened by people who were never invited. This guide sets out what Microsoft states GCC High covers for ITAR data in Teams, what the regulator’s text says about meetings, which tenant settings decide who joins and who can replay a discussion, and where Azure Communication Services fits. It is not legal advice: whether a given person, meeting or data set involves an export is a determination for your empowered official and counsel.

What GCC High settles, and what Microsoft says it does not

If your tenant moved to GCC High for ITAR, the move bought specific, written commitments, and Microsoft states them on its International Traffic in Arms Regulations (ITAR) compliance page, last updated June 2, 2026: “Microsoft Azure Government and Microsoft Office 365 U.S. Government for Defense provide support for customers with data subject to the ITAR through additional contractual commitments to customers regarding the location of stored data, and limitations on the ability to access such data to US persons.” The same page lists Microsoft Teams, Exchange Online, OneDrive and SharePoint Online among the GCC High in-scope services, and it adds that “Customers must sign additional agreements formally notifying Microsoft of their intention to store ITAR-controlled data, so that Microsoft can comply with responsibilities both to our customers and to the US government.”

Microsoft’s Teams planning page, Plan for Office 365 Government – GCC High deployments, puts the platform commitments in two lines: “Your organization’s customer content is stored within the United States.” and “Access to your organization’s customer content is restricted to screened Microsoft personnel.” The service description, Office 365 GCC High and DoD, last updated August 3, 2026, adds: “Office 365 staff don’t have standing access to GCC High and DoD production.” It also says that support “isn’t included in the service accreditation boundary and doesn’t provide FedRAMP, DOD SRG, ITAR, IRS 1075, or CJIS data handling compliance assurances”, which in this guide’s reading means a meeting recording or chat content from a technical-data discussion never goes into a support case.

What Microsoft does not say matters as much. The ITAR page states: “While there’s no compliance certification for the ITAR, Microsoft designs and operates its in-scope services to be capable of supporting a customer’s ITAR obligations and compliance program.” And it draws the line of responsibility: “Microsoft provides these assurances for the infrastructure and operational components of these government cloud services, but customers are ultimately responsible for the protection and architecture of their applications within their environments.” The commitments cover where data sits and which Microsoft personnel can reach it. They do not decide who your organizers let into a meeting. The program-level export-control background, including document access and the encryption carve-out, is covered in Redesigning an ITAR Export-Control Compliance Program to Be Efficient, Not Just Compliant.

The planning rule this guide draws from Microsoft’s text: GCC High is the environment Microsoft scopes for ITAR data, not the control. The controls are the settings your team owns.

Why the meeting itself is the release point

When a design review runs on Teams, the risk is not only where the file is stored but who is in the room when it is discussed, and the regulator’s text explains why. Every quotation in this section is the text of 22 CFR Part 120 as the eCFR publishes it, up to date as of September 22, 2026.

On what counts as technical data, § 120.33 Technical data says, of information required for defense articles: “This includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation”. On how it is released, § 120.56 Release lists, among other means:

• “Visual or other inspection by foreign persons of a defense article that reveals technical data to a foreign person;”
• “Oral or written exchanges with foreign persons of technical data in the United States or abroad;”

On what a release in the United States amounts to, § 120.50 Export includes “Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)” and states: “Any release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency.” And § 120.54 Activities that are not exports, reexports, retransfers, or temporary imports lists “Transmitting or otherwise transferring technical data to a U.S. person in the United States from a person in the United States” among the activities that are not exports. Who is a U.S. person and who is a foreign person is defined in § 120.62 U.S. person and § 120.63 Foreign person; this guide does not restate either definition.

If encryption is offered as the answer, be exact about what the regulator’s text covers. The same § 120.54 Activities that are not exports, reexports, retransfers, or temporary imports treats technical data “Secured using end-to-end encryption” as part of a carve-out with further conditions, and states that “The ability to access technical data in encrypted form that satisfies the criteria set forth in paragraph (a)(5) of this section does not constitute the release or export of such technical data.” In this guide’s reading, that text concerns data in encrypted form. A person admitted to the meeting hears the discussion and sees the shared screen after it has been decrypted for them, so the carve-out does not reach who is in the room. The full carve-out and its conditions are covered in the export-control program guide linked in the previous section.

The table below is this guide’s reading of how the regulator’s text quoted above lines up with what happens in a Teams meeting. It is a planning aid, not a determination.

Who can join: the settings that decide it

If an organizer’s meeting policy lets anyone with the link join, the attendee’s own honesty becomes the only control left, and nothing in the choice of cloud changes that. Four groups of Teams settings decide who is admitted. Which values suit your technical-data meetings is this guide’s reading, set out after Microsoft’s text.

Anonymous join. Microsoft’s page Manage anonymous participant access to Teams meetings and events (IT admins), last updated July 9, 2026, describes an organization-wide toggle, “When this setting is turned off, anonymous users can’t attend meetings hosted by anyone in your organization.”, and then notes that “The Anonymous users can join a meeting organization-wide setting is going away.” Microsoft’s recommendation on the same page: “We recommend leaving this setting On and using the Anonymous users can join a meeting unverified per-organizer meeting policy to manage anonymous meeting join instead.” The lever for your technical-data organizers is therefore their per-organizer meeting policy.

The lobby. Microsoft’s page IT Admins – Manage lobby options in Microsoft Teams states: “The Teams meeting lobby prevents certain types of participants from joining a meeting until a meeting organizer, co-organizer, or presenter admits them.” The same page states: “Using the lobby settings in the Teams admin center, you can create defaults for which types of meeting participants can bypass the lobby and which participants must wait there until admitted to the meeting.”

External and unmanaged accounts. Microsoft’s page IT Admins – Manage external meetings and chat with people and organizations using Microsoft identities states: “Chats and meetings with external unmanaged Teams users isn’t available in Microsoft 365 Government Community Cloud (GCC), GCC High, or DOD deployments, or in private cloud environments.”

Cross-cloud meetings. A supplier on commercial Microsoft 365, as in the opening scenario, is this case, and Microsoft’s page Meet with people in other Microsoft 365 cloud environments lists three ways for them to join:

• “Authenticated access using a cross-cloud meeting connection”
• “Authenticated access using a guest account”
• “Anonymous access”

The same page states: “With cross-cloud meeting connections, you can allow or prevent meetings between your organization and an organization in another cloud.” and “The organization that you’re meeting with must also configure these settings for their organization.” Each connection is a decision your team makes, organization by organization, and the other side has to make a matching one. This is a meetings setting; the GCC High rules on sharing files with other organizations are a separate matter and are not restated here.

One more line from Microsoft’s Microsoft Teams service description, last updated July 8, 2026: in its feature table, the “Channels – Shared” row reads No in the GCC High column. Stopping your own users from joining other organizations’ meetings is a separate, outbound control and is not covered here. On voice, Microsoft’s Office 365 GCC High and DoD service description states that “PSTN Calling & PSTN Conferencing services are currently not available in GCC High and DoD.” and that “Phone System and Audio Conferencing for GCC High and DoD environments are being delivered via Direct Routing.”; choosing that route is a separate decision this guide does not cover.

The planning rule, in this guide’s reading: an organizer policy, not an attendee’s word, decides who is admitted. Identify the organizers and groups that hold technical-data discussions, and set their anonymous-join, lobby-bypass and presenter policies, and the cross-cloud and guest connections they rely on, with a written reason for each value.

Where the recording lands, and who can open it

When a design review is recorded, the discussion outlives the meeting as a file, and the file’s readers are set by storage and permissions rather than by who was in the room. Microsoft’s page Manage Teams recording policies for meetings and events, last updated July 22, 2026, says that when a meeting is recorded, “It gets uploaded to the meeting organizer’s OneDrive (private meetings) or SharePoint (channel meetings).” It continues: “People invited to the meeting have permissions to view the recording (guests and external attendees can view the recording only if the recording is explicitly shared with them).” It adds that “Microsoft Purview, OneDrive file storage, and access permissions apply to the meeting recording files the same as with other files.” and that the recording is linked from the meeting: “It’s linked in the chat for the meeting.”

The planning rule, in this guide’s reading: a recording of a technical-data discussion is a technical-data file. Its location, its sharing and its Purview labels deserve the same design as a drawing in a controlled SharePoint library, and the organizers who record technical-data meetings should know where their recordings land and who can open them before they press record. Policy-based compliance recording of every call, for retention, is a separate decision this guide does not cover. This guide also makes no statement about transcription, captions or Copilot meeting features in GCC High; confirm those against Microsoft’s current documentation for your environment before relying on them.

Azure Communication Services in Azure Government: what Microsoft states, and what it leaves to you

If your team wants its own calling application for technical-data sessions rather than Teams, Microsoft’s pages on Azure Communication Services in Azure Government set out what the service offers and what they leave to you. Read them with the warning Microsoft places at the top of Azure Communication Services for US Government, last updated September 23, 2026: “Azure Communication Services is introducing breaking changes, and some services are being retired.” This guide does not say which services that affects.

What Microsoft states on that page: “You can use Azure Communication Services within Azure Government to provide compliance with US government requirements for cloud services.” It describes customer content stored within the United States and access restricted to screened Microsoft personnel, and states that “Azure Communication Services in Azure Government has achieved FedRAMP High accreditation as part of the Microsoft 365 Government Community Cloud (GCC) – High service offering.” Microsoft’s compliance scope page, Azure, Dynamics 365, Microsoft 365, and Power Platform services compliance scope, says the same in its own words: “Azure Communication Services operates under the same infrastructure that powers Microsoft Teams and obtained FedRAMP High accreditation as part of the M365 GCC-High service offering.” The features Microsoft lists as available in Azure Government are:

• “Voice and Video Calling”
• “Chat”
• “Direct Routing”
• “Call Automation”
• “Call Logs”
• “Call Recording”
• “Email”

with the note that “SMTP endpoint is not supported in Azure US Government Cloud at this time.”

What Microsoft does not state. Neither of Microsoft’s ITAR compliance pages read for this guide names Azure Communication Services. Microsoft’s Teams interoperability page says: “Azure Communication Services interoperability isn’t compatible with Teams deployments using Microsoft 365 government clouds (GCC) at this time.” Microsoft places the responsibility for the application on the customer in two places. The first is the ITAR compliance page’s “customers are ultimately responsible for the protection and architecture of their applications within their environments”. The second is Compare Azure Government and global Azure, which states “You’re responsible for designing and deploying your applications to meet US export control requirements such as the requirements prescribed in the EAR, ITAR, and DoE 10 CFR Part 810.”

The planning rule, in this guide’s reading: scope an Azure Communication Services build for technical-data calls as your own application running under Azure Government’s commitments, with the participant controls designed into the application itself, because the application, not Teams, owns the participant list. Build on it when a custom calling workflow needs that ownership, and not as a way to reach Teams users in a GCC High tenant, since Microsoft’s interoperability page says that interoperability is not compatible with Teams in Microsoft 365 government clouds at this time.

When this guide is the wrong starting point

If any of these describes your situation, start somewhere else:

• If it is not yet settled that the data is ITAR technical data at all, or whether another export regime applies, that is a classification question for your empowered official and counsel, and it comes before any meeting setting. This guide is not legal advice.
• If the tenant is still commercial or GCC, the platform decision comes first; the export-control program guide linked in the second section covers that choice.
• If the requirement is to record every call for regulatory retention, that is policy-based compliance recording, a separate decision from the ordinary meeting recordings covered here.
• If the need is to stop your own employees joining other organizations’ meetings, that is an outbound control on your users, not the inbound meeting settings covered here.
• If the discussion involves classified information, this guide does not apply.

What to ask of whoever helps

Whether the work is done by your own team or with outside help, ask for these, in writing:

• Ask for an inventory of the teams, channels and organizers that hold technical-data discussions, since every setting below is scoped to them.
• Ask for the written meeting policies for those organizers, covering anonymous join, lobby bypass, who may present and who may record, with the reason for each value.
• Ask for a decision record for every cross-cloud meeting connection and every guest arrangement, naming the other organization and who approved it.
• Ask for a storage, permissions and Purview labelling design for meeting recordings and the files shared in meeting chats.
• For any Azure Communication Services build, ask for an architecture that states where media and recordings are stored, who holds the keys, and how participants are verified before they join.
• Ask who does the work, and expect senior, US-based people who can lawfully see the data in the tenant they configure.
• Refuse any claim that a cloud, a product or a configuration settles the ITAR question for your meetings; Microsoft itself says there is no ITAR certification.
• Ask for a plain statement that your team, your empowered official and counsel own the compliance determination, and that your team owns the tenant and its day-to-day operation after handover.

How i3solutions approaches it

When an aerospace and defense or federal organization takes this on, it needs a project with an end date: the inventory of technical-data meeting groups, the organizer policies and cross-cloud decisions, the recording storage and permissions design, and, where a custom calling workflow is needed, the Azure Communication Services application in Azure Government, followed by a handover of the settings and the code to the internal team, with embedded specialists where the team needs more hands for a period. The GCC High tenant itself comes through Microsoft’s GCC High eligibility process. i3solutions has deep experience implementing identity governance for enterprises in aerospace and defense manufacturing, financial services, and healthcare, including environments with CMMC and ITAR obligations. i3solutions has successfully delivered software development projects under CMMC, HIPAA, ITAR, and SOC 2 compliance frameworks with audit-ready documentation and governance practices built into our standard delivery methodology. i3solutions provides dedicated US-based Microsoft teams for aerospace and defense programs. i3solutions plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers. i3solutions has been a Microsoft partner since 1997 and has delivered 600+ implementations across aerospace and defense, financial services, and health sciences. An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. This work sits within i3solutions’ Embedding Governance into How the Enterprise Operates and Scales.

Key Takeaways

• Microsoft lists Microsoft Teams among its GCC High in-scope services for ITAR, with commitments on data location and US-person access, and states that there is no ITAR compliance certification.
• Microsoft states that customers are ultimately responsible for the protection and architecture of their applications within their environments.
• The regulator’s text counts oral or written exchanges of technical data with foreign persons as a release, so, in this guide’s reading, meeting admission and recording permissions are the controls that matter.
• Microsoft recommends managing anonymous join through the per-organizer meeting policy, since the organization-wide setting is going away, and cross-cloud meeting connections are allowed or prevented organization by organization, on both sides.
• Azure Communication Services is available in Azure Government, but Microsoft’s ITAR pages do not name it, its Teams interoperability is not compatible with Teams in Microsoft 365 government clouds at this time, and the application built on it is the customer’s to secure.

Frequently Asked Questions

Is Microsoft Teams ITAR compliant in GCC High?

No certification exists for it to hold: Microsoft’s International Traffic in Arms Regulations (ITAR) compliance page states that “there’s no compliance certification for the ITAR”. The same page lists Microsoft Teams among the GCC High in-scope services, backed by contractual commitments on data location and US-person access, and says that customers are ultimately responsible for the protection and architecture of their applications within their environments. Microsoft scopes Teams in GCC High for ITAR data; who joins your meetings and who can open their recordings are settings your team controls.

Is a Teams call with a foreign national an export under ITAR?

The eCFR text of § 120.56 Release lists oral or written exchanges with foreign persons of technical data in the United States or abroad as a release, and the eCFR text of § 120.50 Export states that a release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency. Who counts as a foreign person is defined in the eCFR text of § 120.63 Foreign person. Whether a particular call involved technical data and a foreign person is a determination for your empowered official and counsel; this guide is not legal advice.

Can people from commercial Microsoft 365 tenants join our GCC High Teams meetings?

Microsoft’s page Meet with people in other Microsoft 365 cloud environments lists three ways: authenticated access using a cross-cloud meeting connection, authenticated access using a guest account, and anonymous access. Cross-cloud meeting connections can be allowed or prevented organization by organization, and the other organization must also configure its settings. Separately, Microsoft states that chats and meetings with external unmanaged Teams users are not available in GCC High.

Where are Teams meeting recordings stored, and who can open them?

According to Microsoft’s page Manage Teams recording policies for meetings and events, a recording is uploaded to the meeting organizer’s OneDrive for private meetings or to SharePoint for channel meetings. People invited to the meeting can view it, guests and external attendees only if it is explicitly shared with them, and Microsoft Purview, OneDrive file storage and access permissions apply to it as to other files.

Can Azure Communication Services be used for ITAR-controlled calls?

Microsoft’s answer is partial. Its page Azure Communication Services for US Government lists calling, chat and call recording among the features available in Azure Government and states FedRAMP High accreditation as part of the GCC High service offering. Microsoft’s ITAR compliance pages do not name Azure Communication Services, its Teams interoperability is not compatible with Teams in Microsoft 365 government clouds at this time, and Microsoft places the application’s protection and export-control design on the customer.

Does GCC High Teams support phone calls to the public network?

Microsoft’s Office 365 GCC High and DoD service description states that PSTN Calling and PSTN Conferencing services are currently not available in GCC High and DoD, and that Phone System and Audio Conferencing for those environments are delivered via Direct Routing. Choosing and configuring that route is a separate decision from the meeting settings in this guide.

Planning the Decision

If your technical-data discussions already run on Teams in GCC High, start with the inventory of the organizers and groups who hold them, then review their meeting, recording and cross-cloud settings against the reasons you can write down for each. If a custom calling application is on the table, scope its Azure Communication Services architecture in Azure Government before any code is written.

Contact a senior architect