Microsoft Teams – Calls

Teams calls are one of the clearest signals of active collaboration, and WorkSights captures them directly from Microsoft’s audit logs. The result is a precise, privacy-first record of call activity without ever touching meeting content.

What WorkSights Receives

WorkSights ingests metadata delivered by Microsoft 365 whenever a user joins or leaves a Teams call. The data includes:

• Start time
• End time
• Duration (calculated from start/end)
• Call identifier
• Partial attendee metadata when Microsoft provides it
• Location/IP information tied to the join event

WorkSights never receives:

• Audit or video content
• Screen share content
• Transcripts, chat logs, reactions
• Meeting notes or descriptions

Only the structural metadata required to confirm that a call took place.

How Teams Calls Appear in WorkSights

WorkSights represents Teams calls as timeline entries with:

• A clear call icon
• Start and end timestamps
• Duration automatically calculated
• Internal/external labeling inferred from available attendee metadata
• A distinct color category consistent with other communication events

If the same call generates multiple Microsoft audit records (e.g., join, leave, join again), WorkSights consolidates them into a single call block during overnight processing.

Calendar events remain separate. If a Teams meeting was on the calendar, you may see:

• A calendar meeting event
• A Teams call event

These coexist intentionally. The calendar event reflects scheduled time, while the Teams call reflects what actually happened.

How WorkSights Classifies Teams Calls

WorkSights applies the same logic used across all integrations:

Internal Call

All detected attendees share your Microsoft 365 domain.

External Call

At least one detected attendee is outside your organization.

Because Microsoft’s audit stream does not always supply a full attendee list, WorkSights may classify some calls as likely internal or internal with missing metadata. This ensures consistency without making assumptions about who participated.

Data Notes

WorkSights does not ingest call content or any communication exchanged during the call.

Some attendee lists may be incomplete because Microsoft does not expose full participant metadata for every call type.

Multi-join scenarios (joining from mobile and desktop, or reconnecting after a drop) are automatically condensed into a single call entry.

If Microsoft delivers delayed audit entries, WorkSights adjusts the call duration retroactively during nightly processing. 

Next Steps

For a platform-level explanation, see Microsoft 365 Overview.

For configuration steps, see Connecting Microsoft 365.

For scheduling metadata, see Outlook Calendar.