Fix Teams Screen Sharing Is Disabled on a Corporate VPN

Screen sharing in Teams suddenly stops working when you connect to your corporate VPN. You see a grayed-out share button or an error that screen sharing is disabled. This usually happens because the VPN restricts UDP traffic or the Teams policy blocks external sharing. In this article, I will show you how to diagnose the VPN network path and adjust Teams meeting policies to restore screen sharing.

The root cause is often a network firewall that blocks the UDP ports Teams uses for real-time media. When UDP is blocked, Teams falls back to TCP, which can cause screen sharing to fail or be disabled. I will explain how to test your VPN connection, change Teams policies, and configure firewall rules so screen sharing works reliably.

Why Teams Screen Sharing Fails on a Corporate VPN

Teams uses the media stack to transmit screen share content. The media stack relies on UDP ports 3478 through 3481 for real-time transport. When you connect to a corporate VPN, the VPN tunnel often encapsulates all traffic and sends it through a single gateway. Many corporate firewalls block UDP traffic at the VPN concentrator or on the internal network. When UDP is blocked, Teams attempts to use TCP as a fallback. TCP can carry screen share data, but it is slower and more prone to latency. In some cases, Teams detects the degraded path and disables screen sharing entirely because it cannot guarantee a stable stream.

Another cause is a Teams meeting policy that restricts screen sharing. The default policy allows screen sharing, but an administrator may have set the Screen sharing mode to Disabled or Single application. When this policy is applied to a user, the share button is grayed out regardless of the network. The policy is enforced by the Teams service, so even a perfect VPN connection will not override it.

A third cause is the VPN client itself. Some VPN clients use full tunnel mode, which routes all traffic through the corporate network. This can cause Teams to think it is on a restricted network and block certain features. Split tunneling, which sends only corporate traffic through the VPN, is often the recommended solution for Teams media.

Steps to Restore Screen Sharing on a Corporate VPN

Follow these steps in order. Start with the network test, then move to policy changes, and finally adjust firewall rules.

Test the VPN Network Path for UDP Connectivity

1. Open Command Prompt as administrator
   Press Win + R, type cmd, then press Ctrl + Shift + Enter to run as administrator.
2. Run a UDP connectivity test to Teams media servers
   Type the following command and press Enter: Test-NetConnection teams.microsoft.com -Port 3478. This checks if UDP port 3478 is reachable. If the test fails, the VPN is blocking UDP.
3. Repeat the test for ports 3479, 3480, and 3481
   Run the same command for each port. Note which ports fail. If all fail, you have a network-level block.
4. Check if TCP fallback is active
   In Teams, start a screen share and open Task Manager. Go to the Performance tab and look at the network usage. If you see TCP connections to Teams, the fallback is active.

Adjust Teams Meeting Policies to Allow Screen Sharing

1. Open the Teams admin center
   Go to admin.teams.microsoft.com and sign in with an admin account.
2. Navigate to the meeting policies page
   In the left navigation, go to Meetings > Meeting policies.
3. Select the policy assigned to the affected user
   Click on the policy name. The default Global (Org-wide) policy applies to everyone unless you have created custom policies.
4. Set Screen sharing mode to Entire screen
   Scroll to the Content sharing section. Set Screen sharing mode to Entire screen. This allows users to share their full desktop, which is necessary for presentations and demos.
5. Allow external participants to share
   In the same section, set External participants can give or request control to On. This ensures that users outside your organization can still receive screen share content.
6. Save the policy
   Click Save. Changes can take up to 24 hours to propagate, but usually apply within minutes.

Enable Split Tunneling on the VPN Client

1. Open your VPN client settings
   This depends on the VPN client you use. Common clients include Cisco AnyConnect, Palo Alto GlobalProtect, and FortiClient.
2. Locate the split tunneling option
   Look for a setting called Split Tunnel, Split Tunneling, or Route Based VPN. Enable it.
3. Add Teams media domains to the bypass list
   If the VPN client allows you to define which traffic goes through the VPN, add these domains to the bypass list: teams.microsoft.com, teams.microsoft.com (all subdomains), skype.com (all subdomains), and office.com (all subdomains).
4. Reconnect the VPN
   Disconnect and reconnect the VPN to apply the new settings. Then test screen sharing in Teams.

Configure Windows Firewall to Allow Teams Media Ports

1. Open Windows Defender Firewall with Advanced Security
   Press Win + R, type wf.msc, and press Enter.
2. Create an inbound rule for Teams
   In the left pane, click Inbound Rules, then click New Rule in the right pane.
3. Select Port and click Next
   Choose Port as the rule type.
4. Enter the UDP ports
   Select UDP and enter 3478-3481 in the Specific local ports field. Click Next.
5. Allow the connection
   Select Allow the connection and click Next.
6. Apply the rule to all profiles
   Keep Domain, Private, and Public checked. Click Next.
7. Name the rule and finish
   Type a name like Allow Teams UDP Media and click Finish.

If Screen Sharing Still Fails After the Main Fix

Teams Shows “Screen Sharing Is Disabled by Your Administrator”

This error means the meeting policy is blocking screen sharing. Even if you changed the policy, the user may be assigned to a different policy. Check the effective policy for the user. Go to Teams admin center > Users > Manage users, select the user, and look at the Policies tab. Verify that the assigned meeting policy has Screen sharing mode set to Entire screen.

Screen Sharing Is Grayed Out for External Participants

External users from other organizations may not be able to share because their own organization’s policy blocks it. You cannot change another tenant’s policy. Ask the external user to contact their IT admin and enable screen sharing in their meeting policy.

Screen Share Stutters or Freezes Over VPN

If screen sharing works but is choppy, the VPN is still causing latency. Disable the VPN for Teams media using split tunneling. If split tunneling is not possible, ask your network team to allow UDP 3478-3481 on the VPN concentrator.

Teams Uses TCP and Screen Share Is Unavailable

When UDP is blocked, Teams may fall back to TCP but still disable screen sharing. This is a known behavior. The only fix is to open UDP ports on the firewall. Do not rely on TCP fallback for screen sharing.

New Teams Desktop vs Teams on the Web: Screen Sharing Behavior on VPN

Item	New Teams Desktop	Teams on the Web
UDP port usage	Uses UDP 3478-3481 for media	Uses WebRTC UDP ports 3478-3481
Split tunneling support	Works with any VPN client	Works but may require browser network settings
Firewall rules	Need Windows Firewall inbound rule	No Windows Firewall rule needed
Policy enforcement	Applies meeting policies from admin center	Same policies apply
Screen share quality on VPN	Better with UDP open	Depends on browser and VPN

After following these steps, you can restore screen sharing on your corporate VPN. Test the UDP ports first to confirm the network path, then adjust the Teams meeting policy, and finally enable split tunneling or open firewall ports. If the problem persists, check the effective policy for the specific user. For advanced troubleshooting, use the Teams Call Quality Dashboard to view media path details. Always verify that the VPN client is up to date, as older versions may not support modern Teams media requirements.