French Security Company Highlights Stealing Teams Access Tokens from the Local State File

On October 23, 2025, a French security company called Randorisec, published an article about stealing Microsoft Teams access tokens in 2025. Over the next few hours, I received several messages asking if the news as reported was serious and required action. My response was “Nope.”

I don’t think that the article surfaces any new information. More importantly, the compromise as described is only possible if attackers first manage to gain control over a workstation running Teams. In that scenario, the problem is more serious than fetching a few access tokens to use to send messages with the Graph API. Let’s discuss what the article reveals and why I’m sanguine about its findings.

The Teams Local State File

The discussion centers on fetching content from the local state file used by Teams, which is found in:

%LocalAppData%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State

The article explains how to fetch and decrypt cookies protected using the Chromium Data Protection API (DPAPI), which in turn are used to fetch access tokens. I’m not sure that there’s anything new here because I found several articles to explain the process (here’s a good example). Chromium-based browsers use JSON-formatted local state files to store information needed for browser sessions, including encrypted keys used to protect sensitive information like user passwords.

Why Does Teams Use a Local State File?

What people might not understand is why Teams uses a local state file to hold information about the current client configuration, software version, other client settings, and encrypted content (Figure 1). The answer is that the Teams V2 client architecture depends on the WebView2 component. WebView2 uses the Edge rendering engine to display content within apps, including Teams, the new Outlook for Windows, and features shared between Outlook clients like the Room Finder. Microsoft includes the WebView2 component with Office and other products.

Because the Teams clients are deeply integrated with WebView2, it makes sense to adopt other Chromium constructs, like the local state file and DPAPI, and that’s probably why you end up with a Teams-specific local state file that behaves much like the local state file used by Chromium browsers.

Access Tokens for Teams

Eventually, the researchers end up with access tokens that can be used to interact with Teams via the Graph API. Getting to the access tokens requires fetching them from the cookies SQLlite database. This file is found in the %LocalAppData%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network folder and is locked when a Teams client is active.

The assertion that they can use the tokens to send email is erroneous. As pointed out in the article, the tokens are for use with Teams, not Exchange Online, so the permissions granted in the tokens do not permit use of the Mail Send API.

Local State File is Inaccessible Unless a Device is Compromised

Don’t get me wrong. Security researchers do a great job of finding weaknesses in products before attackers figure out how to use those weaknesses to do damage. I applaud the efforts of the Randorisec team, but I just don’t think that there’s anything surprising to become too concerned about. The attempt to hype the problem by Cyber Security News is also regretable. I wonder if either the researchers or reporter actually know anything about how Teams works, but hey, all publicity is good.

I keep on going back to the simple fact that before an attacker can access the Teams local state file and cookies database, they’ve broken into the workstation and therefore have full access to whatever’s on that device. In all probability, they can start the Teams client and can send chats and channel messages without needing to fetch and decrypt information.

The best defence is to stop attackers from compromising user accounts by deploying strong multifactor authentication. If you can do that, you shouldn’t need to worry about the details of Teams, WebView2, and the cookies file.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.

The Need to Make Teams Chat Section Names into Visual Anchors

Still amazed by the news that Teams reactions to chat and channel conversations support up to 20 emojis (apparently to convey nuanced responses), the news delivered in MC1166877 (6 October 2025, Microsoft 365 roadmap item 503300) that Teams will support emojis in section names for chat and channels quite blew my mind.

Microsoft says that they’re introducing the feature to allow “users to personalize and visually organize their workspace more expressively, aligning with familiar experiences from other collaboration platforms like Slack.” In other words, because Slack plasters emojis around its interface, Teams must follow. In this case, the desktop and browser clients get the feature first followed by mobile clients, with deployment scheduled to targeted release tenants in early November 2025. If all goes well (and what can go wrong with an emoji?), general availability will follow in late November 2025 to all commercial and education tenants. Think of it as a thanksgiving present.

Chat and Channel Sections

Teams introduced sections as part of the new Chat and Channels experience in late 2024. Sections allow users to organize chats and channels into convenient groupings that make sense to the user, For example, I have a section for chats with the individual members of the Office 365 for IT Pros author team. I have another session for chats with people who work at Microsoft, and I use another section for the channels that I think most important in terms of checking for new messages daily, and so on.

Until now, section names are confined to simple text. When the update lands in your tenant, you’ll be able to enliven the section names with emojis. You can create a new section or rename existing sections and insert as many emojis as you like up to the 50-character limit for a section name (Figure 1).

To access the set of available emojis, use the Windows icon and . (period sign) combination. I believe this is the method to insert emojis with MacOS.

Figure 2 shows the kind of “visual anchors” that emojis create for sections. Beauty is in the eye of the beholder, but I’m not sure that the emojis add much to my ability to navigate. Maybe the new section names will grow on me.

Although it will take a little longer for the Teams mobile client to be able to include emojis when creating or editing section names, changes to introduce emojis made in the desktop or web clients show up in the mobile client.

No Custom Emojis

Disappointingly, Teams doesn’t support custom emojis for section names. When I wrote about custom emojis last year, I created several new emojis, including a rather good Mickey Mouse. However, it seems like the set of emojis revealed for picking is limited to emojis supported by the operating system rather than Teams emojis.

No Administrator Control Over Teams Chat Section Names

I know that some tenant administrators will see emojis in section names as a mere frippery, something that Microsoft is wasting time on instead of fixing other problems, so let me note that there’s no control over allowing emojis to be used. Adding emojis to sections is base functionality that cannot be switched off, so the only thing a tenant can do is keep their users in a state of blissful ignorance and hope that no one ever finds out what they can do to create “visual anchors” to navigate through Teams chats and channel conversations.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.

Trust Indicators Indicate the Level of Trust in External Users

Unfortunately, social engineering attacks designed to confuse and trick unwary users into doing something that leads to account compromise (and potentially to tenant compromise) continue unabated. According to the last number for monthly active users provided by Microsoft, 320 million people use Teams. That audience represents an attractive target for attackers to go after, and many of the social engineering attacks occur through federated chats from unknown externals users.

The original design for Teams envisaged an open collaborative environment where Teams users from Microsoft 365 domains could connect to Teams users in other domains. Attackers duly signed up trial tenants and used trial Teams licenses to reach out and attempt to connect with targets. Given that the SIP address for most Microsoft 365 users is the same as their primary SMTP address, once an attacker has an email address, they can try to institute a federated chat to that address and hope that the person at the other end responds.

Visual Clues About the Trustability of External Users

Microsoft clamped down on the ability of trial tenants to use federated chat in 2024. But attackers adapt to changed circumstances and keep on trying. This brings us to the announcement of trust indicators for Teams users published in MC1162276 (29 September 2025). Like the external tag applied to email from external sources, a trust indicator is a badge displayed alongside an external user’s name to give tenant users a visual clue about their status.

Public preview for trusted indicators has already started and is expected to be completed in late November. General availability will then roll out the feature to all tenants in all clouds for completion in early January 2026. The documentation for trust indicators describes the different badges used by Teams and where the badges appear, so I won’t go into the details here. However, here are some examples of where you’ll probably see trust indicators in action.

First, Figure 1 shows the participant list for a group chat. I’m a guest user in this chat and the badge and tooltip show that status. A guest user has a high level of trust because they are using an account added to the tenant directory to access Teams. Some might argue that this really doesn’t indicate a high level of trust because guests can be added to the tenant directory without administrative oversight. For example, by sharing a document with an external user.

Figure 2 shows another important point. In this case, we’re viewing the membership of a team and two of the members have no trust indicators. This is because they’re tenant members, so their status makes these members very trustworthy.

Build an Allow List for Teams Communications

Trust indicators are a nice addition to Teams, but I fear that they don’t address an issue that many Microsoft 365 tenants ignore, and that’s the need to control external access for Teams. I accept that it’s nice to be open and collaborative and willing to communicate with anyone in any tenant, but I also consider this to be a dangerous approach to use without question. An open tenant is an invitation to connect, but that allows unwanted visitors to attempt to connect to users.

Tenants can control the tenants that users are allowed to communicate with by establishing an external access allow list. You can build an allow list manually, but it can be difficult to know all the domains that people wish to use. It’s possible to construct the allow list programmatically with PowerShell using sources like the home domains for guest accounts or federated chats with external people. Either source is a good start for an allow list that can then be tweaked to add whatever domains are missing.

The downside of using an allow list to control Teams external access is that anytime someone wants to connect with a user in a domain that’s not in the allow list, they must seek approval for the addition of that domain. That’s regrettable, but it might be better than allowing external connections from any other Microsoft 365 domain, including those controlled by the bad guys.

Small but Important Step

Trust indicators are a small but important step to help Teams users recognize the status of external collaborators. It’s good to have these visual clues, and I hope that the clues help users to be more wary in their external communications. However, maybe it’s even better to close off the holes in Teams external access where undesirable connections can creep in.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!

Hiding Inactive Channels Automatically was a Terrible Idea

One of the oft-repeated tropes about Microsoft is that they need several attempts to get software right. This might certainly be true for the Teams feature designed to help users focus on active work by hiding unused channels. First introduced in Fall 2024 with the aim that: “Teams will automatically detect inactive channels you haven’t interacted with in a while, and automatically hide them for you,” the feature soon ran into problems. Initially, Microsoft said that Teams will automatically detect inactive channels that a user hasn’t interacted with for 45 days. The number was revised upward to 120 days in MC804771 (March 21, 2025). Apart from these statements, Microsoft hasn’t given any further details about the criteria used to determine the level of activity needed to regard a channel as active.

The way that Teams suppressed notifications from hidden channels didn’t help either. Although cleaning up a channel list to highlight active channels might be a good idea, it’s not so good when someone misses an important notification about an event posted in a channel that’s inactive because it’s reserved for discussing critical issues.

Offering Suggestions about Channels to Hide

Microsoft duly reversed course and acknowledged that automatically hiding inactive channels without user oversight was a bad idea. They promised to clean up the mess by announcing in MC804771 that Teams would offer suggestions about inactive channels and leave it to users to decide if the suggestions are valid and should be accepted.

Six months later, MC1141958 (25 August 2025, Microsoft 365 roadmap item 325780) announces that the update to give user control over hiding inactive channels is available in targeted released and will be generally available very soon. You’ll know if the update is available by checking the Settings app to see if the control for hiding inactive channels now mentions “suggestions” (Figure 1).

Opting for Get suggestions now forces Teams to show its current list of inactive channels. When I chose the option, it revealed five channels (Figure 2). The interesting thing is that similarly inactive channels in the same teams are not in the list. This underlines the general lack of information available from Microsoft about how Teams chooses inactive channels.

Automatic Maintenance and Coach Mark Messages

If the setting to hide inactive channels is On, Teams performs a periodic check to find channels that could be hidden. This doesn’t happen when a user has less than or equal to 25 visible channels.

If Teams finds some inactive channels, it notifies the user with a “coach mark message.” I was unfamiliar with this term, but apparently a coach mark is a user interface element intended to educate users about a new feature. Now that I know what these messages are called, I’ll stop referring to them as the annoying pop-up messages that infest Teams (or maybe not, because the overuse of these messages is still annoying especially when there’s no way to turn them off).

In any case, the message will prompt the user with “Looks like you haven’t visited some channels lately. Hide them to help you focus.” If the user opts to be distracted from doing whatever they were busy with before Teams launched its coach mark, they see the same dialog as shown in Figure 2.

There’s no administrative control over the hiding inactive channels feature. Its only control is at user level through the Settings app.

Hurrah for Sanity

The simple fact is that sanity has now been restored to the attempt to unclutter user views by removing inactive channels. Software, even Copilot at its best, has a hard job of understanding why some channels exist and how people use those channels. Given that a single team can support up to 1,000 channels, some inactive channels are likely to be floating around in everyone’s client. Making polite suggestions that some channels can be hidden is a much better approach than automatic clean-up, especially when the criteria used to select inactive channels are so fuzzy.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.

Keep the Default Accent Color or Choose New One

I thought that life was complete when Teams delivered multiple emoji reactions for messages. Now I know I was mistaken because MC1115312 (14 July 2025, Microsoft 365 roadmap item Microsoft 365 roadmap item 497139) announces the arrival of customizable accent colors, which begin to roll out for Teams desktop and browser (but not mobile) clients in late July 2025. Worldwide deployment is scheduled to be complete by the end of August 2025.

I’m unsure of quite how many people have ever woken up saying how nice it would be if Teams supported a selectable accent color – or how many people understand the purpose of an accent color. Mozilla documentation explains that an accent color is a cascading style sheet (CSS) property that sets the color of certain user interface controls.

Selecting a Theme Accent Color

Given that the Teams UX is basically a big browser app, it doesn’t come as a surprise that a style sheet property is involved, but what does it do? Well, users can select a color from a set presented in the Appearance section of the Settings app (Figure 1). According to Microsoft, this is a “visual customization” of the Teams interface that “enhances the user experience.”

The ten colors in the set range from the default (a wishy-washy light blue) to Red to Teal to Pink to Grey. You can’t add extra colors, so Teams can’t comply with expensive corporate brandings that feature an exact shade defined in a Pantone code. There is no administrative control available to set an accent color for users or to disable the option to select an accent color. Choosing an accent color is a purely cosmetic change that is user-driven to reflect personal rather than corporate choice.

You might scoff about the need to respect corporate branding, but I remember a heated debate inside Digital Equipment Corporation when a new CEO decided to refresh the iconic logo with new colors. Cue a surprisingly vicious fight between people who liked different shades of burgundy…

How Teams Uses an Accent Color

When you select a new accent color, Teams uses that color for many different elements in its user interface. The best example I could come up with is from the new threaded layout for channels where the accent color is used to highlight the base topic for a thread. I chose Red as my account color, and you can see the effect in Figure 2. Other elements that use the color include the count of notifications at the top of the screen, hyperlinks, and the display names of conversation participants.

After selecting such a bold color, you can appreciate why the Teams developers chose a muted color as the default (the first color in the list of available accent colors). Figure 3 shows an even more garish appearance using a yellow accent. Of course, beauty is in the eye of the beholder, and you might consider this to be just the kind of thing you want to see when browsing conversations.

Teams uses the chosen accent color in both home and host tenants, so if you’re a guest member of teams in other tenants, your selected color shows up there too. However, the color choice is specific to a workstation, and if you use Teams on another device, you’ll get whatever color is selected there.

One oddity I noticed is that selecting a color in Teams affects the display of other applications. For example, this blog is hosted by WordPress, and the Jetpack stats view (of page views, etc.) changed its color when I selected a new color in Teams. This might just be coincidence, but that’s less likely when the same thing happens on two PCs.

Customization is Good

I don’t think anyone can argue that the provision of options to allow users to customize their working environment is a bad thing. However, sometimes I wonder why effort is expended on developments like selectable accent colors when so much else could be done to address other issues.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

The Teams Discover Feed and Its Settings

The Discover Feed is shown at the top of the teams list and is available to users with more than five channels. Its intention is to highlight unseen messages that might otherwise be missed. A setting to enable or disable the Discover feed is in the Chats and Channels section of Teams settings (Figure 1).

After selecting a message in the Discover feed, users can also customize how the feed selects messages in the future by using the more options menu to opt not to see posts from the person who posted the message or the channel that they posted to. Clicking the settings (cogwheel) icon in the top-right corner of the feed shows the users and channels that the feed currently ignores (Figure 2).

The Discover feed sounds like an excellent feature, but I don’t use the feed very often. The reason is that Teams doesn’t support the Discover Feed for guest users. Most of my work with Teams is as when signed in as a guest into other tenants. In some of those tenants, where I am I am member of several teams with many channels, I would use the Discover feed if it was available to me, but it’s not.

I assume that the reason why guests are not supported is that some data relating to the feed is stored in the user mailbox (where most settings are located). Guest accounts have cloud-only special mailboxes, but maybe the work to hold these settings in those mailboxes hasn’t been done. All speculation on my part!

Users Must Have At least Five Channels to see the Discover Feed

All of which brings me to message center notification MC1066160 (1 May 2025) where Microsoft announced that they are limiting access to the feed unless users are part of five or more channels (including hidden channels). It’s an example of a change to tweak an existing feature, just like the change to introduce calendar notifications in the Activity Feed made last year.

This change is already active for Teams desktop and web clients. There’s nothing that tenant administrators need to do (or can do) relating to the change. Everything happens in client code and there’s no way for administrators to disable the Discover feed feature or control how it works on either a user-specific or tenant-wide basis.

Microsoft says that the change will “help to ensure the Discover Feed includes meaningful updates and conversations and avoids showing an empty or low-activity feed.” Their logic is simple. The Discover feed exists to highlight information that you might otherwise miss because of a lack of time to scan every channel available to you. If you can only access three or four channels, you don’t need this help because it’s as easy to check which channel names are bolded in the channel list. If you find a channel with new content, you can open it.

And Even if You Have More Than Five Channels

Even if someone can access more than five channels, the Discover feed might not be much good if only one or two of the channels are active because the only messages that end up in the feed will come from the active channels. Again, it’s often easier to check what’s going on in a small set of active channels.

No Real Interest from Me for Now

To be honest, I had forgotten that the Discover feed existed. It was only the appearance of MC1066160 that made me look at the feed again. Even in its new focused mode, I don’t think the feed will do much for me until Microsoft updates the Discover feed to support guests.

More information about the Discover feed is available in this Microsoft support article.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Teams Can Have a General Channel Just Like Before

In July 2024, Microsoft announced that team owners would be able to rename the General channel (or local language value) of teams. The idea was that “General” is just too general in nature and that it would be better if team owners could assign a more meaningful name to the first channel created in a team. Once

Now Microsoft has reversed course a tad. Message center notification MC1048628 (updated 9 April 2025) says that team owners can choose General as the name for the first channel. The new channel creation UI even has a button to set the channel name to “General” (Figure 1). The change is already effective in targeted release tenants and will roll out worldwide in mid-May 2025.

The big thing about using General as the default channel name is that the General channel is always listed first in the channels for a team. If you use a different name for the first channel, Teams orders the channel list alphabetically. You can see the effect of renaming the General channel in Figure 2.

Channel Creation Made Easier

MC1053645 (11 April 2025, Microsoft 365 roadmap item 479744) describes another channel-related change that will roll out to targeted release tenants in early May. The option to create a new channel is now present in the New Items menu (Figure 2).

Recent conference appearances by the Teams development group have emphasized that users should create channels rather than new teams. With 1,000 channels available in a team, there’s lots of room to avoid creating new teams with the attendant overhead that comes with a team. The more teams in a tenant, the higher the likelihood for digital debris. That wasn’t such a problem years ago, but digital debris can influence the accuracy and usefulness of AI-generated content, so it’s a real issue now.

No More Code Snippets

In other Teams news related to channels, MC1055554 (15 April 2025) announces the retirement of the code snippets feature in chat and channel conversations starting May 30, 2025. Microsoft is replacing code snippets with code blocks. Type /code in the editor or click on the code block icon in the menu bar to insert a new block, and then select the type of code so that the block displays the code appropriately (Figure 4).

Microsoft believes that code blocks are faster and more efficient. Line numbers aren’t current available in code blocks but will be soon, and code blocks will also be viewable on mobile clients.

You might ask what’s driving the change. I think it’s a matter of Teams dropping an older component that doesn’t probably get much use for a shared component that’s under active development. Microsoft says that the change will allow users to “create, edit, and share code directly in the compose box without needing a title.” That’s true when someone composes a message, but if you want channel or chat members to be able to edit code in a code block, considering using the Loop paragraph component and format it as code (Figure 5).

Posting a Loop component to a channel allows team members to edit the content, so it’s possible to have real-time collaboration to discuss code issues and potential solutions. Loop components posted in this manner are stored in the channel folder in the document library of the SharePoint Online site belonging to the team.

Adieu Classic Teams

Another change that’s coming up is that the classic Teams client will be unavailable after July 1, 2025 (MC1059667, 21 April 2025). Microsoft will block attempted access to Teams with the classic client after that date. It really is time to embrace the new (well, slightly used) Teams client.

Learn about using Teams and the rest of Microsoft 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Launched Just Prior to Covid, Private Channels Lost Impetus when Teams Changed Gears

To much excitement at the time, Microsoft introduced private channels for Teams at the Ignite conference in Orlando in November 2019. Teams was a very different proposition then. The Covid pandemic was still a few months away and less than 20 million people used Teams regularly. Private channels were the first major development in Teams since its launch in early 2017. They were a response to the misgivings voiced in many customers that all members of a team enjoyed equal access to channel conversations and the team’s SharePoint Online site.

Roll forward five years and Teams is in a very different place. The pandemic generated huge demand for online collaboration in general and online meetings in particular. Microsoft had to continually strengthen the Azure-based Teams infrastructure to cope with demand as the number of users swelled continually. Growth has slowed recently, but Teams now has 320 million monthly active users, or roughly 80% of the Office 365 installed base based on the latest numbers released by Microsoft.

After their launch, the initial excitement around private channels soon began to fade. In 2021, Microsoft began to hype shared channels (eventually released in 2022). Focus shifted to the possibilities of trans-tenant collaboration rather than the inward-nature restrictions offered by private channels. You can tell where the latest craze exists by counting the number of sessions offered for a specific technology by large conferences.

ESPC in Stockholm

The agenda for technology conferences like ESCP 2024 in Stockholm (December 2-5) is currently dominated by artificial intelligence because that’s what people want to talk about, despite the fact that AI is still not widely used across the Office 365 base. I’ll still enjoy ESPC, where I speak twice about non-AI topics (Mastering the Microsoft Graph PowerShell SDK and Decoding the Microsoft 365 Audit Log), and I’ll happily listen to the latest propaganda telling me how to work with AI.

Private channels don’t feature on the ESPC agenda, nor did I see anything on the topic at the Microsoft 365 conference in Orlando last May. I suspect that private channels won’t receive much coverage at the upcoming Ignite conference in Chicago. That’s no reflection on the importance or usefulness of the technology. After all, Microsoft 365 conferences usually avoid allocating sessions to cover Exchange Online, despite the essential role that Exchange plays in the overall ecosystem and the massive changes Microsoft is making for hybrid organizations, like forcing tenants to upgrade servers and the introduction of Exchange Server subscription edition next year.

Odd Session Selection at Some Technology Conferences

If conference programs were selected based on the importance of a technology to Microsoft 365 sessions would be dominated by Exchange Online, SharePoint Online, OneDrive for Business, Entra ID (including security), and Teams, with some sessions to cover PowerShell and the Microsoft Graph.

However, that’s not what happens, perhaps because the folks who select sessions are overly influenced by Microsoft marketing (including sponsorship dollars). What else accounts for conferences giving valuable time to cover everything in the Viva Suite, Loop, and the like? Far too many conference sessions are given over to technologies that are marginally interesting in terms of overall usage within tenants. There will always be the need for sessions to cover emerging technologies (AI is firmly in this category), but some conference selections are just odd.

The Worth of Private Channels

Back to private channels. My interest was reawakened the other day when discussing a problem a university had. Like most institutions, the university has a program to allow people to file complaints that are then investigated by the relevant facility. They were advised that they’d need to set up a separate team for each facility to store details of investigations in a secure SharePoint site. No one had considered creating a single team with separate private channels for each facility. Private channels limit access to the subset of the team membership who become channel members. No one else, not even team owners, can access the content in the private channel, including its separate SharePoint Online site.

The advantage of using private channels is the avoidance of team sprawl. Creating a new private channel is as easy as creating a regular channel (Figure 1). After creating a private channel, the only other task is to add members to the channel.

In the case in question, all the people in the university who work on complaints can be members of the team with subsets becoming members of the private channels created for the facilities. Team members share common knowledge such as program announcements and guidelines without compromising the integrity of their investigations in any way.

Another advantage is that people won’t create a group chat to take a discussion to a more limited forum. In fact, people should be discouraged from using group chats for anything that involves sensitive information.

An individual team can support up to 1,000 channels, of which up to 30 can be private channels. Being able to segment confidential and sensitive work across private channels within a team is a nice way to protect information. And if you want information to remain even more private, consider creating a sensitivity label that limits access to the members of a private channel and assigning the label to every document stored in the channel. That way, even if a document “escapes” outside the channel, its content will remain inaccessible.

I use private channels daily. They’re a great host for private collaboration on a need-to-know basis. It’s just a pity that so few people seem to know about private channels.

People Insights from LinkedIn and Viva Insights Appear

Following up last week’s news about the ability to add pronouns to the user profile card, the change announced in message center notification MC521886 (1 March) to bring insights about people to profile cards displayed in Teams is rolling out. This is Microsoft 365 roadmap item 116006. Microsoft expects to finish the deployment worldwide by the end of March.

Teams has been able to display information about LinkedIn contacts in user profile cards for a year or so. What’s changing is that instead of the basic information about someone such as their current job, experience, skills, and education, you now see “insights” about a person such as a notice when their birthday arrives (Figure 1).

Reaching Out to Your Contact

As this is the Teams version of the profile card, it should come as no surprise that you can send a chat message to your contact to congratulate them about their advanced age. Alternatively, the Say happy birthday button is a drop-down menu with options to start a chat, have an audio or video call, or send email. The latter option launches the OWA compose message screen with an oddly uppercased recipient address (Figure 2). Given the widespread use of machine learning and artificial intelligence within Microsoft 365, you’d expect that Teams would compose the congratulatory message too! Alas, you’ll have to come up with some suitable text.

Once you respond to the prompt for your contact’s happy birthday, the insight disappears.

Other People Insights for the User Profile Card

Apart from birthdays, the insights you see include posts a contact makes to their LinkedIn account (shown in the LinkedIn tab), career changes, and pending meeting invitations. Microsoft emphasizes that the same insights are available in other Microsoft 365 apps, like OWA and Outlook.

I have never seen a birthday notification in Outlook for Windows, OWA, or the latest build of the Monarch client, but maybe I use the wrong versions. Microsoft’s documentation describes how Microsoft 365 generates people insights from LinkedIn and Viva Insights and how apps display the insights. Some delay occurs before Viva Insights generates information to show like “RSVP nudges” for outstanding invitations. The page shows OWA highlighting a contact’s birthday. Perhaps it’s a case where if you deal with an insight in one app, Microsoft 365 hides the insight for the other apps.

More Integration Everywhere

I’m beginning to think that Microsoft rewards engineers for finding ways to stitch different Microsoft 365 components together. Adding people insights to the user profile card is an example. Some of the information added recently, like someone’s local time zone, is very useful. I’m not sure about the latest batch.

Another example of stitching components together is the appearance of the Storyline post option in the new item menu for the latest OWA and Monarch clients (Figure 3). This action posts a text message to Viva Engage (aka Yammer) to appear on a user’s storyline.

I don’t think any great demand exists in the ranks of Outlook users to do such a thing but obviously the powers-that-be inside Microsoft consider this to be a very good thing. Hopefully, Microsoft’s famed telemetry will reveal the truth and persuade Microsoft to quietly drop the notion.

A common complaint I hear from Microsoft 365 administrators is that they wish Microsoft paid more attention to making the apps bulletproof instead of delivering new functionality that no one wants. But it’s important to keep engineers and product managers busy, and that’s why we see some of the changes that appear in message center notifications. I like some of the people insights I see, but know that other won’t. Beauty lies in the eye of the beholder.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Users Can Decide What Pronoun to Display in Profile Card

Updated March 30, 2023

Announced in message center notification MC515531 (last updated 21 February 2023), the ability to enable pronouns in Microsoft 365 profile cards is available in the Microsoft 365 admin center. Once enabled, users can set their preferred Microsoft 365 pronouns using the preview version of Teams. The pronoun feature is covered by Microsoft 365 roadmap item 86352 (Teams) and 115511 (OWA).

I have been able to update pronouns in Teams, OWA, and the latest build of the Monarch (“One Outlook”) client.

Employee Engagement

Microsoft’s documentation for the pronoun feature says that “the simple act of using the right pronouns for one another can help build trust and improve communication among colleagues.” Microsoft goes on to highlight that “Whether or not to share or publicly display pronouns is always up to an individual. Pronouns should never be assigned to one person by another person. It should be up to the person using them to decide when, where, and which pronouns are used – including whether to use this feature.”

In other words, organizations should do some thinking and employee engagement before they implement pronouns for profile cards.

Implementing Pronouns on the Microsoft 365 Profile Card

The first step is to enable pronouns for the organization. Go to Org settings in the Microsoft 365 admin center and select the Security & privacy tab. Pronouns is one of the listed options (Figure 1).

Microsoft says that it can take up to 7 hours before users can change their pronouns. In practice, expect the change to take a day before it is effective. If you disable pronouns, it will take the same length of time before pronouns disappear from view for all users. Microsoft 365 removes pronoun data if an organization disables the feature. Like most deletions in Microsoft 365, deletion is not immediate and if you reenable pronouns, previously set values will reappear.

After the software change is effective, users will see the option to update pronouns on their profile card. For instance, I clicked on my photo for a message posted to a Teams channel to reveal my profile card and see the option to add pronouns (Figure 2).

Remember Microsoft’s point that pronouns are a personal decision for users? To enable freedom of choice, you can add whatever text you like for a pronoun. The profile card suggests the commonly-used values such as “She/Her,” but you can ignore these values and use whatever text you prefer (up to 30 characters).

The important thing to remember is that pronouns are visible to all members of the organization. There’s no way to restrict pronoun display to a certain segment, such as members of a group. Guest members and external members of shared channels can’t see pronoun information on profile cards.

Building the Profile Card

Microsoft 365 stores user pronouns in a hidden folder in user Exchange Online mailboxes. Apps that support the profile card retrieve the information from the mailbox along with other properties (including custom attributes) to display the profile card (Figure 4).

A Change to Plan

Microsoft’s FAQ for pronouns contains some other useful information to consult before implementation. Displaying pronouns in the profile card is obviously something that an organization should think through before implementation. For example, some organizations also add pronouns to account display names, meaning that the information shows up in address books and other places where people see display names, like email headers, listings of documents in SharePoint Online and OneDrive for Business, and so on. Don’t rush to deploy just because someone (maybe a vocal proponent) thinks that pronouns are a good idea. Pause, consider, and then decide.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Even pronouns deserve analysis…

Add Group Chat Participants to Keep Up with Fast-Paced Communications

When you spend as much time as I do in reviewing the changes that occur across Microsoft 365, sometimes you meet an update that’s good but should have been there a long time ago. This is the case with message center notification MC481196 (December 6 – Microsoft 365 roadmap item 97736), which proudly starts off with “Teams Chat is for fast-paced communication, and we want to ensure nothing gets in the way” before going on to describe how it’s now possible to add someone to a group chat by mention them in the compose box. The change is rolling out now and is due to complete in late December 2022.

Adding People to Group Chats

It’s not as if it is difficult to add another person to a group chat (if you add someone to a 1:1 chat, it becomes a group chat). Click on the participant icon at the top of the chat (Figure 1) and you have the chance to add another participant.

When you add someone to a group chat, you can allow them to see the previous chat history, a certain number of days of the chat history, or none of the prior history. It’s all very straightforward.

Using the Compose Box to Add New Group Chat Participants

The new feature kicks in when someone enters a @mention in the compose box (where you enter the text for chat messages). This has always been the case as Teams would suggest a name based on whatever was entered in the compose box. Now an extra choice is present to add someone to the chat (Figure 2).

When adding a new chat participant, the normal option to allow access to the chat history are available (Figure 3). You don’t see this dialog if you are adding participants to a new group chat. You can go back 999 days when including chat history or simply allow the new participant to see everything.

Generally everything worked as expected and new participants joined the group chat. However, you must make sure that you pause after typing a couple of characters after the @ sign to let Teams recognize that you’re including an at mention that you want to add as a chat participant. It’s easy to keep on typing and miss out the chance. In that case, you’ll need to go back and re-enter the @ mention in the compose box to prompt Teams into action.

Good Change That Saves Clicks

I like this change but I’m not sure how often I will use the new feature. Microsoft says that being able to add a new chat participant from the compose box saves two clicks over navigating to the participant control. I’m sure that saving two clicks will be a big thing for some, but I think that this is a fit and finish update that should have existed earlier. Other changes in the same area, like being able to initiate a group chat from a distribution list, Microsoft 365 group, or tag released in summer 2022 are more important.

But don’t let me stop you saving all those clicks. Exploit the compose box to add new participants to group chats and be happy that the feature exists.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Search in Outlook Has Never Been Great

On January 11, MC313286 brought the news that Outlook searches might return no result if messages are stored in PST and OST files. I’ve zero sympathy for those who store email in PST files, but the loss of search in OST files handicaps offline operation for those of us who keep email in Exchange Online mailboxes. I realize that some persist in using POP3 and IMAP4 to access mailboxes (hopefully, the loss of basic authentication in October 2022 will stop this), but it’s time to move on use more modern messaging protocols.

In any case, the problem affects people who upgrade PCs to Windows 11 because the upgrade removes the search index. Over time, Windows rebuilds the search index, and all is well. At least, it’s as well as Outlook searches ever are. Over the years, my expectation that Outlook delivers reliable search results has never been high, so my level of disappointment is never severe. To be fair, searches performed by latest version of Outlook desktop (click to run) are better than before, but force of habit makes me depend on OWA when I need to search for something.

New Search Capabilities Include Outlook and Teams

Behind the scenes, Microsoft Search powers the search facilities in Outlook and OWA. Microsoft Search indexes and can search the Microsoft 365 substrate, meaning that it can find documents, email, tasks, and the compliance items for Teams, Planner, and Yammer. Recently, Microsoft upgraded the search UI in Office.com and SharePoint Online to add a “Conversations” tab to search results. This tab reveals Teams and Exchange Online messages (Figure 1) while other tabs deal with news, people, sites, files, and so on. The change is documented in MC299210 (last updated December 8) and Microsoft 365 roadmap item 68779.

If you select an item, a deeplink takes you to the original message in the underlying workload. For example, if you find a Teams message you want to see, the deeplink offers to open the Teams browser client but will open the item in the desktop client if that client is available. Outlook items open in OWA.

According to the roadmap item, the new search became generally available in January 2022. It should therefore be available in all tenants now.

Microsoft 365 Search in Bing Now Covers Outlook

The roadmap item refers to Bing.com too, which covers the scenario when Microsoft 365 results are integrated with results from Bing searches. It’s long been possible to see Teams and Yammer messages in Bing results. Now Outlook messages are included (Figure 2). As in other features powered by Microsoft Search, filters make sure that the person performing the search only sees the information they can access. This means that a search covers the user’s own mailbox but won’t reveal items in shared mailboxes or other user mailboxes they have delegate access to.

The presentation of Outlook content differs in Bing. In the past, Bing had a Conversations tab covering Teams messages and Yammer. Now, Teams and Outlook show up under Messages and Yammer is moved out to its own tab. I’ve heard speculation that this is because Yammer messages are slower to index. Curiously, the search results available in neither SharePoint Online nor Office.com include Yammer content, so perhaps Microsoft is doing some work to integrate Yammer better.

Integrated View is Best

The obvious advantage of using Office.com or SharePoint Online for searching is access to integrated results. OWA delivers good results for Outlook messages. However, given that we live in a world where communications aren’t restricted to email, the integrated search across SharePoint, OneDrive, Teams, and Outlook is very attractive. It’s now my favorite way to look for Microsoft 365 content.

Make sure that you’re not surprised about changes which appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

$22.1 Billion Revenues in FY22 Q2 Results

Microsoft closed out their FY22 Q2 results with revenue of $51.7 billion. Of this, Microsoft Cloud (mainly Office 365, Azure, Dynamics 365, and LinkedIn) accounted for $22.1 billion, up 32% year over year. It’s a very healthy outcome which underlines the importance of cloud services to Microsoft.

In remarks to analysts, CFO Amy Hood attributed the growth to “large, long-term Azure contracts, as well as increased usage of Teams and our advanced security and identity offerings.” She noted that the gross margin for Microsoft Cloud decreased slightly year-over-year to 70%. However, after excluding the impact from a change in how datacenter assets like servers and network controllers are accounted for over their useful life, she said that Microsoft Cloud gross margins increased by roughly 3%.

Office 365 Revenue and Numbers

In terms of Office 365, Microsoft failed to give specific user numbers for either active or paid seats. They said that Office 365 commercial revenue grew by 19% and cited higher average revenue per user (ARPU) and installed base expansion as driving factors. Microsoft noted that customer movement to higher-based plans such as Office 365 E5 to access better security (Microsoft Defender for Office 365 Plan 2), compliance (many features from auto-label policies to trainable classifier), and voice (calling plans, etc.) drove “continued momentum.” The increases in Office 365 and Microsoft 365 monthly subscriptions from March 1, 2022 will give another boost to cloud revenues.

Microsoft said that “paid Office 365 commercial seats increased 16% year-over-year.” In their Q3 FY21 results, Microsoft said that they had “nearly 300 million” paid seats. Nine months later, that number is probably around 330 million. However, that doesn’t mean that this is the number of monthly active users, with or without paid licenses. It could be that Microsoft has sold licenses that are not yet used but are still counted.

Interestingly, Microsoft said that growth was “driven by another strong quarter of growth in our small and medium business and frontline worker offerings. Later, in a response to an analyst question, Amy Hood noted that growth in SME tenants and those buying services for frontline workers “often come(s) at lower revenue per month than we would see in our enterprise businesses buying the full suite of products.” In other words, Microsoft can’t generate a high ARPU from SME customers.

Teams

In July 2021, Microsoft claimed 250 million monthly active users for Teams. At the time, I wondered if the number was believable. Now Microsoft has increased the figure to 270 million (Figure 2), a small percentage increase compared to recent large spurts in growth. The same doubts exist simply because Microsoft doesn’t give sufficient detail to understand how such a large percentage of the Office 365 base uses Teams. For instance, how many Teams users are in education versus enterprise? How many people use Teams consumer, even after the roll-out of chat interconnectivity between the consumer and enterprise versions? How many of the users logged as active are there because Windows 11 loads the Teams consumer client or Office loads the Teams enterprise client (both easy to turn off).

Instead of hard data, we get snippets designed for quotations, such as learning that Teams is “at the center of this digital fabric,” or that “over 90 percent of Fortune 500 companies used Teams Phone this quarter” (maybe they like the unlimited dial-in capabilities and Teams Phone plans). Or even that Walmart chose Teams for their “more than 2 million frontline users” (surely a Teams Walkie-Talkie case study in the making…). Huge customers like Walmart underpin the credibility of the Teams user number, while also underlining the point about lower profitability from frontline worker contracts (you can bet that Walmart got a good deal).

Viva

Microsoft launched Viva almost a year ago and rolled out Viva Insights, Viva Connections, Viva Learning, and Viva Topics since. Of all the offerings, I think Viva Topics has the most interesting technology. Microsoft has also rebranded MyAnalytics to bring it under the Viva brand, which is why Outlook and OWA now have the Viva Insights add-in.

Given the hype surrounding the launch and the importance of the “employee experience category” emphasized to the Microsoft sales force and partners, it was striking how little mention it received in the results briefing. Satya Nadella said that “Viva is being used by more than 1,000 paid customers… to help address challenges like employee burnout and retention.”

With the size of the Office 365 customer base and the emphasis on Teams as the delivery vehicle for Viva, I’m surprised that this number is so low. In July 2021, Microsoft said that 124 organizations had more than 100,000 Teams users and 3,000 organizations had more than 10,000 Teams users. You’d imagine that these organizations would be prime candidates for Viva. Perhaps the U.S.-centric approach often seen in Viva is an inhibiting factor for deployment in the rest of the world?

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new developments as they happen.

No Action Visible

I had a problem with actionable messages generated by Microsoft Teams not working properly in Outlook desktop. In the overall scheme of things, this isn’t a huge issue, but it became an irritation because nothing was obviously wrong. The problem was that I could interact with actionable messages using any other client than Outlook desktop. Here’s the story.

Actionable Messages in Yammer and Teams

Actionable messages contain a JSON payload in the message body to allow the recipient to respond to an application based on the content (hence the name) using “action buttons” associated with the commands necessary to execute an action, like respond to a message. The technology has been available for several years. For example, a Yammer actionable message allows the recipient to react to a message posted to a community or post a response of their own (Figure 1).

Much the same happens for Teams Missed Activity messages, where recipients can respond to chats or channel conversations (Figure 2). Teams generates these messages based on the option selected by the user in the Notifications section of Teams settings.

Apart from the magic involved in interpreting the JSON payload and presenting it in an attractive manner in Outlook desktop, OWA, and Outlook mobile, the other major technology needed is the HTTP response to update the target application with the action chosen by the recipient.

Deploying the Actionable Message Debugger

The problem I had was that Outlook desktop stubbornly refused to allow interaction with Teams missed activity messages while OWA and Outlook mobile worked properly. Instead of being able to reply to Teams conversations from Outlook desktop, the messages offered to use a deeplink to launch the application positioned in the conversation (for instance, Teams missed activity messages included only a Reply in Teams button). Although Teams actionable messages had problems, Yammer actionable messages worked normally.

I found a mention of a similar problem happening in another context. Unfortunately, the recommended check against the system registry to uncover permission issues with the Office add-in store produced no joy. However, it led me to install the Actionable Messages Debugger for Outlook and deploy it as an integrated app via the Microsoft 365 admin center (Figure 3).

Soon afterwards, the debugger showed up in Outlook. I don’t know why, but suddenly things started to work properly. Apparently, the mere presence of the debugger or using the add-in to examine the properties of a message (Figure 4) resolved the problem. Or did it?

I

Of course, software doesn’t work on a whim (or maybe it does, which would explain some oddities observed over the years). Authentication is a more fundamental reason. After all, an actionable message must be capable of posting its command for the magic to work. I had switched my Teams desktop client to another tenant (I have guest accounts in too many tenants; shared channels should help, when they become available).

It’s logical to assume that if Outlook desktop finds that the same account used to connect to Exchange Online is not connected to Teams, it will assume that it cannot process actions and so revert to the Reply to Teams command. If the user takes this option, they must authenticate to access Teams. OWA and Outlook Mobile seem to use connections to the home tenant, so they’re unaffected by switching to other host tenants. The issue doesn’t affect Yammer: its browser client probably works like OWA.

I hate not understanding why features do not work as they should. At least now I have a reasonable explanation and can go and do something more productive.

Debugging Information

You probably will not use the debugger unless you’re developing an Outlook add-in or need to gather information for a support call. The information presented by the debugger will mean a lot to those who understand what the JSON content should look like and how it should behave, but maybe not for others. To demonstrate what you might find, here’s an example of an actionable card error captured by the debugger:

{
-
"ActionableMessageStamping": {
-
"Errors": [
"Adaptive card signature validation failed - Sender of the email does not match sender in the signed card. Originator:78c6dd9c-1fe2-40ba-ae94-19729f11547d, OAMAppName:xxxGroup"
],
"Infos": [ ]
},
   "CardEnabledForMessage": false,
   "ClientName": "Outlook",
   "ClientVersion": "16.0.14827.20088",
   "InternetMessageId":           
   "<DB9PR04MB8445D745EBCC517C2CA20D8EFD509@DB9PR04MB8445.eurprd04.prod.outlook.com>",
   "EntityExtractionSuccess": true,
   "SignedAdaptiveCard": true,
-
"MessageCardPayload": {
"found": false,
"type": null
},
-
"AuthHeader": {
"results": "dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=office365itpros.com;",
"authAs": "Internal"
}
}

Organization Control for Actionable Messages

The Exchange Online organization configuration contains a setting (SmtpActionableMessagesEnabled) to control the use of “action buttons.” The default is True, meaning that email clients allow users to respond to buttons inserted in email by Microsoft 365 applications. If you wanted, you can run Set-OrganizationConfig to set the value to False to disable actionable messages.

Set-OrganizationConfig –SmtpActionableMessagesEnabled $False

I can’t think of a good reason to disable actionable messages, but you never know when the need might arise. That’s I can’t think of a good reason to disable actionable messages, but you never know when the need might arise. That’s the joy of discovering poorly documented parts of Microsoft 365, just like finding out why Teams missed activity messages won’t work when you switch to use a guest account in another tenant.

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Teams External Access for Chat and Calling

Teams users have been able to chat and call people in other Teams tenants for some years. This is a very useful capability because it means that you don’t need to have a guest account in a tenant to communicate with its users. Microsoft added the capability to chat with Skype consumer users in 2020. Both features are enabled by external federation, the component which manages user ability to communicate outside the tenant. By default, the tenant external federation configuration allows communication with Teams users in any tenant. Administrators can manage the configuration through the External access section under Users in the Teams admin center. For instance, an organization might decide to limit external federation to a subset of tenants considered necessary for business communications.

Bringing Teams Consumer into the Chat Fold

Message center notification MC296208 (updated January 4, Microsoft 365 roadmap item 88381) expands external federation to cover chat (but not calling) with Teams consumer users. Given the presence of a Teams consumer client in Windows 11 and Microsoft’s fervent hope that people will embrace Teams consumer, it’s unsurprising that consumer and enterprise Teams users should be able to communicate. Up to now, any attempt to chat with a Teams enterprise user from Teams consumer results in an exchange of email, which is not quite the immediate connection delivered by chat.

According to MC296208, roll-out of Teams external access for Teams consumer starts in early January and should complete in mid-January. As always, this timing might change. Unlike external federation with Skype consumer users, Teams consumer supports both 1:1 and group chats. Another interesting aspect is that Teams enterprise users can find Teams consumer users with their email address or phone number (obviously, this must be the phone number registered by the user when they signed up for Teams consumer). But then again, you can also search for Teams enterprise users with their phone number, if you really must…

Tenant Controls for Teams External Access with Teams Consumer

Settings in the tenant’s external federation configuration control the communication with Teams consumer users (also called “Teams accounts not managed by an organization”). Two controls are available in the External access section of the Teams admin center:

• People in my organization can communicate with Teams users whose accounts aren’t managed by an organization: Set On to allow your users to communicate with Teams consumer users.
• External users with Teams accounts not managed by an organization can contact users in my organization: Set On to allow Teams external users to search for and contact users in your tenant using their SIP address (usually the same as their primary SMTP address and user principal name). Set Off to stop this happening and prevent unsolicited contact from Teams consumer users. Figure 1 shows that this setting is Off.

By default, both settings are On, meaning that if you don’t update them, full bi-directional chat is available between Teams enterprise and consumer users.

You can also update the Teams consumer controls with PowerShell by running the Set-CsTenantFederationConfiguration cmdlet. For example, this command disables both settings.

# Disable both outbound access (AllowTeamsConsumer) and inbound access (AllowTeamsConsumerInbound) for Teams consumer users
Set-CsTenantFederationConfiguration -AllowTeamsConsumer $False -AllowTeamsConsumerInbound $False

Other settings in the external federation configuration include:

• AllowFederatedUsers: Set to False to stop chat and calling with Teams users in other tenants.
• AllowPublicUsers: Set to False to stop chat and calling with Skype Consumer users.

Per-User Control for External Federation

The Teams external access policy assigned to an account controls the level of external access a user has.

Get-CsonlineUser -Identity Jane.Sixsmith@office365itpros.com | Select ExternalAccessPolicy  

ExternalAccessPolicy            : FederationAndPICDefault

Get-CsExternalAccessPolicy -Identity FederationAndPICDefault

Identity                          : Global
Description                       :
EnableFederationAccess            : True
EnableXmppAccess                  : False
EnablePublicCloudAccess           : True
EnablePublicCloudAudioVideoAccess : True
EnableOutsideAccess               : True
EnableAcsFederationAccess         : True
EnableTeamsConsumerAccess         : True
EnableTeamsConsumerInbound        : True

If an external access policy isn’t defined for an account, it uses the tenant settings.

Important settings for federated communications defined in the external access policy are:

• EnableFederationAccess: Allow communication with Teams users in other tenants.
• EnablePublicCloudAccess: Allow communication with Skype consumer users.
• EnableTeamsConsumerAccess: Allow communication with Teams consumer users.
• EnableTeamsConsumerInbound: Allow Teams consumer users to initiate communication with this account.

To gain maximum control over how Teams users communicate externally, you might want to create a new external access policy. This is done as follows:

• Create a new external access policy with New-CsExternalAccessPolicy.
• Update the settings in the new policy with Set-CsExternalAccessPolicy.
• Assign the new policy to user accounts.

For example:

New-CsExternalAccessPolicy -Identity "Block Teams Consumer"
Set-CsExternalAccessPolicy -Identity "Block Teams Consumer" -EnableTeamsConsumerAccess $False
Grant-CsExternalAccessPolicy -Identity Jane.Sixsmith@office365itpros.com -PolicyName "Block Teams Consumer"

Teams External Access with Teams Consumer

Once permitted, it’s easy for a Teams enterprise user to connect with a Teams consumer user by starting a new chat, entering the email address of the consumer user, and searching externally. The initial messages go to the external user, who must decide if they wish to accept or block the connection (Figure 2).

You can add a Teams consumer user to a group chat, but you can’t share previous chats as a new chat starts to accommodate the external user.

A similar check before acceptance is used when a Teams consumer user contacts a Teams enterprise user, with the subtle difference that the Teams enterprise user sees the warning that Messages from unknown or unexpected people could be spam or phishing attempts.

Recipients of inbound connections can preview the messages, which is a good reason for clearly stating the intent and purpose of the conversation in the initial messages, unlike those shown in Figure 3. Only a contravention of the don’t say hello in chat rule would be worse!

Some limitations exist in what can happen in a mixed-Teams chat. The biggest loss of functionality is the inability to make calls or share files. Given that Teams users can call Skype consumer users, the loss of calling is surprising (I anticipate this feature will come soon). Not being able to share files is likely because enterprise and consumer Teams use different versions of OneDrive.

From a compliance perspective, the Microsoft 365 substrate captures compliance records for eDiscovery in the enterprise tenant. Teams consumer doesn’t have this capability. On a more serious note, Microsoft documents that Data Loss Prevention (DLP) policies don’t apply to external access chats. If you’ve invested in DLP for Teams (which needs Office 365 or advanced compliance licenses), you’re unlikely to be impressed at the prospect that tenant users can share sensitive information in external chats. This is definitely a hole which Microsoft should close.

Generally, all went as expected. The only issue I ran into was when attempting to connect to an account signed into Teams consumer that I had previously communicated with from Teams using Skype consumer. Teams stubbornly refused to communicate using anything other than Skype consumer. There’s nothing wrong with the Teams consumer account because I was able to connect with it in a group chat when another enterprise account added the consumer account to the chat.

Connections for Those Who Want Them

I’m unsure as to how many Teams consumer accounts are ready to use Teams external access to communicate with enterprise tenants. Sure, the client is in Windows 11 and many people might have kicked the tires of the client but knowing how many persist and use Teams consumer on an ongoing basis is a different question. In any case, for those who use Teams consumer, the pathway to communication with their enterprise connections is now available. That is, if enterprise tenants enable the capability.

Keep up to date with developments in Microsoft Teams by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

No Way to Suppress Messages

A reader asked if it’s possible to stop Teams displaying a system-generated message when someone joins a team. It’s a reasonable question. In the past, I have pointed out the dangers of adding someone to a group too early as people can then discover that a new employee is joining the company. Conversely, it’s not good when people learn about the departure of a valued colleague through an informational message posted in Teams to say that the person has left a team.

Things used to be worse. Before May 2020, Teams posted messages about members joining and leaving a team in the team’s General channel. The introduction of the channel information pane gave these system messages a new home. Unless people open the information pane, they don’t see messages about membership changes, new owners and channels, and other developments, so there’s a fair chance that the addition of a new employee to a team will go unnoticed.

The Many Ways to Add New Members to a Team

To see any of the methods to add a new member do not result in a system message in the information pane, I tested by adding a new member through:

• The Teams client.
• The Add-UnifiedGroupLinks cmdlet from the Exchange Online management module.
• The Add-AzureADGroupMember cmdlet from the Azure AD module.
• The Add-TeamUser cmdlet from the Microsoft Teams module.

I didn’t test using the Microsoft Graph API. The Add-TeamUser cmdlet is a wrapper around the Graph API call, so the results observed for that cmdlet are likely the same for a Graph call. System messages are retrievable using Graph API calls.

Azure AD is the directory of record. Add-AzureADGroupMember updates the Azure AD group object used by the team. Add-UnifiedGroupLinks updates the Azure AD group object and the group in the Exchange Online directory using a dual write. Add-TeamUser is like adding a new member through the client because the action updates both the team roster (to make the new team member immediately available) and Azure AD. Rosters (lists of members and owners) are how Teams organizes and manages membership.

Changes made to Azure AD or by other Microsoft 365 workloads synchronize with Teams through a background process called Microsoft Teams Aad Sync, introduced in 2020 to make the synchronization process between Teams and Azure AD more efficient and effective. Note that it can take several hours before a system message about a new member shows up. Apart from the need to run background synchronization, clients also need to refresh their cache.

In a nutshell, no matter how you add or remove a tenant or guest account, the change synchronizes back to Teams and the system message appears in the information pane (Figure 1).

Different system messages in the information pane appear depending on the method used to add an account. If you see that someone added a member (like “Tony Redmond has added Niamh Smith to the team”), it’s an indication that the action occurred through the Teams client, the Add-TeamUser cmdlet, or the Graph API (all of which execute the same code). On the other hand, if you see that someone joined the team, the source is Azure AD or Exchange Online PowerShell.

No Control Over System Messages

There’s no system or team setting to tweak to turn off system messages about member updates. Granular control would be best, but I guess Microsoft ignored me when I previously complained about the lack of control over system message publication, so I’ve submitted it again to the new Teams Feedback portal. Please vote there if you support the idea of having a team-level setting to control the publication of system messages.

In the interim, if you don’t want other users to discover that someone has joined a team, either wait until an appropriate time before adding them as a member or consider assigning a new display name to that person’s account until you’re ready to reveal their presence. For instance, I changed the name of a new user as follows:

Set-AzureADUser -Identity James.Baker@office365itpros.com -DisplayName "The Maestro of Office 365"

After waiting for a few hours to allow Teams to pick up details of the user account, I added them to a team. Sometime later, the information pane duly displays the system message for the addition (Figure 2):

This technique works if you want to pre-add new users to teams before they join the organization if you use suitably obscured display names, like UserAXXAD19948. Naturally, you should update their display name after they’re active in the organization. However, it’s not a great approach for people who already work there as other workloads pick up and use the changed display name.

Small Detail

The answer to the original question is that you can’t stop Teams posting system messages to inform team members about membership changes. No control is available at a system or individual team level, which is a pity. But life isn’t perfect, and this is a small detail in the overall scheme of things – unless you inadvertently reveal the name of a new employee before they join the company.

Learn how to exploit the Office 365 data available to tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Leverage Free Learning Sources and Connect Your Own Courseware

Viva Learning is part of the Microsoft Viva “employee engagement” platform along with Viva Topics, Viva Connections, and Viva Insight. The Viva Learning app is now available to Microsoft Teams users. In this article, I describe three easy steps to get the Viva Learning app into use without any fuss and bother.

Configure Learning Sources in the Microsoft 365 Admin Center

The first step is to configure the correct learning sources for the tenant. Go to the Settings section of the Microsoft 365 admin center, choose Org Settings and search for Viva Learning. Out of the box, Microsoft configures LinkedIn Learning, Microsoft Learn, and Microsoft 365 Training (Figure 1).

Only 125 selected LinkedIn Learning courses are available through Viva Learning. If your organization has LinkedIn Learning premium licenses, you can sign in to access their complete courseware portfolio. The Microsoft Learn and Microsoft 365 training material is available free.

Apart from the default providers, you can add SharePoint Online to make training material created within the organization available through Viva Learning. This process involves adding the URL of a SharePoint Online site where Viva Learning creates a list called Learning App Content Repository. The lists stores the URLs for folders storing learning information.

Another option is to add external providers of learning content such as Pluralsight and Skillsoft. Like LinkedIn Learning, you’ll need licenses to access this content.

Add the Viva Learnings App to a Teams App Setup Policy

The easiest way to bring Viva Learning to the attention of users is to pin the app to the Teams app navigation bar (left-hand rail) along with other default apps like Teams, Chat, and Tasks. You can do this by editing the default app setup policy or, if your organization uses multiple app setup policies, by updating the app setup policies assigned to users to whom you want to make Viva Learning available.

Changes to app setup policies take a little while to reach all clients within an organization, but soon users will see the Viva Learning icon appear in the app navigation bar. For now, the Viva Learning app is not customizable, meaning that you can’t change the icon or text seen by users.

Use Viva Learning

Once the Viva Learning app appears in the app rail, launch it to investigate the available courseware. A search for Teams turned up 1,187 courses (Figure 3). However, 986 belong to LinkedIn Learning and remain inaccessible unless you have the necessary license.

When you access an available course, it either brings you to an external web site or plays within the app. Viva Learning redirects static material like the Microsoft Learn Explore capabilities in Microsoft Teams course to a web page, while video material plays in the app, with or without additional back-up text instructions and background. Figure 4 shows a LinkedIn Learning video playing in the app.

The courses accessed by individual users are available to them through their learning history (Figure 5).

Users can bookmark a course to return to it later. If they think a course is worth viewing by others, they can share a link to the course in Teams chat or to a channel (using the Share to Teams feature – Figure 6) or get a deeplink to the course that they can copy into an email. The deeplink brings the recipient back to Viva Learning in Teams, even if the course is available on the web.

The Learning Begins

The steps described above will get you started with Viva Learning. There’s certainly goodness to be discovered in the courseware available free of charge, even if most of it is already available on the web. For large enterprises, I suspect that the real value of Viva Learning lies in organization-specific training, an exercise probably requiring involvement from and coordination across human resources, employee training, and the IT department. It’ll also be interesting to see if third-party training providers come up with special offers to make their content available through Teams.

Stay updated with developments across the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. We do the research to make sure that our readers understand the technology.

Teams is First Product to Use New Portal, Which Replaces User Voice

Update November 10: The feedback portal is now available for a bunch of other Microsoft 365 apps (OneNote, SharePoint, Stream, Planner, Yammer, Viva Topics, etc.. Exchange is a notable exception for now.

Much to customer dismay, Microsoft announced its intention to stop using the User Voice platform in March. Today, the Teams product group announced the preview of a feedback portal for Teams (aka “a community feedback experience”). Given the very active use of User Voice by the Teams community to suggest and press for product improvements, this is a welcome development. According to Microsoft, User Voice input has resulted in over 500 features and improvements since 2017, so it’s obvious that customers are listened to, even if they sometimes think this isn’t the case.

The new portal (Figure 1) also supports Edge, but that section isn’t as well populated as the Teams content is. Over time, you’d imagine that the portal will evolve from preview to become the central point for feedback for the entire Microsoft 365 ecosystem, assuming things go well.

Built on Dynamics 365

The new portal is built on the Dynamics 365 customer service technology. In the past, Microsoft has looked outside to replace its own technology with third-party code, notably when the Yammer-based Technical community was replaced by Lithium as the basis for the current Microsoft Technical Community. It’s good to see Microsoft eating its own dogfood here. Hopefully, the experience of handling customer feedback and feature requests through the new portal will inform future developments in Dynamic 365.

Data from User Voice

To ensure that the information from User Voice is not lost, it looks as if Microsoft has done a good job to populate the feedback portal with idea and comments already submitted by customers. The Teams product group has updated a bunch of requests with responses to tell people about the progress of ideas and suggestions, so if you’ve been missing out on wanting to know if Microsoft is going to do something, you can head over to the portal to browse ideas and responses (Figure 2).

Some responses address well-known recent developments, like quoted replies in chats (released in preview on September 17), while others are still being worked by engineering, like the request to sign-into the Teams client with accounts from  multiple tenants. According to some tweeted comments by Rish Tandon, Teams VP of development, support for multiple accounts will come when Microsoft releases an enterprise client based on the Teams 2.0 architecture sometime next year.

Given the use of Dynamics 365, it shouldn’t come as a surprise that you need to sign in to create a new suggestion (following Microsoft documentation on that point, naturally). However, the portal is available to all to browse without sign-in.

By the way, Live components in Chat are now available for preview users (here’s the official announcement). I mention this to illustrate that not every new feature developed by Teams will appear in the feedback portal. Live components are a good example of an interesting new technology coming from within Microsoft that has the potential to change the way people collaborate.

Overall, the new portal seems to work well. Give it a try. There’s no point about complaining about deficiencies in Teams or other Microsoft technologies if you can’t be bothered to provide feedback.

Microsoft 365 is now just Teams

As they do every quarter, Microsoft’s latest set of results (FY22 Q1) contain some interesting nuggets of information relating to Microsoft 365 and Office 365. Possibly the most startling of which is in the earnings transcript. This is Microsoft’s official record of the conversation between CEO Satya Nadella and CFO Amy Hood with market analysts. It contains zero mention of any Microsoft 365 app except Teams. No SharePoint Online. No Exchange Online. No OneDrive for Business, Stream, Planner, or Yammer. Just Teams.

Perhaps Teams is the key ingredient for the $20.7 billion generated for Microsoft Cloud revenue in the last quarter (up 34% in constant currency year-over-year). That is, until you realize that Microsoft charges precisely zero for Teams as the app is bundled into every Microsoft 365 and Office 365 product. I doubt sales of the Teams advanced communications add-on made much of a dent either. The thing is that Teams leverages a huge number of components drawn from across the Microsoft 365 ecosystem. It can’t survive without Exchange Online, SharePoint Online, Azure AD, and a bunch of other services (for background, see this interview with Rish Tandon, VP of Teams development). In a nutshell, the health and success of Teams reflects the overall wellbeing of Microsoft 365, which is why Microsoft senior management might be so preoccupied with talking about Teams.

Despite focusing exclusively on Teams, Microsoft’s leadership gave no further update on the number of Teams usage over the “nearly” 250 million monthly active users claimed in July 2021. They noted that the number of organizations with more than 100,000 Teams users is now 138 (up 12 since July) and that more than 3,000 organizations have more than 10,000 Teams users (no change since July).

Office 365 Usage Grows

Microsoft didn’t give a firm number for the number of Office 365 users either. They noted a 17% year-over-year growth in paid commercial Office 365 seats. The same growth rate was reported in July. Applying six months’ growth to the 296.7 million paid seats claimed in the FY21 Q3 results, we get a figure of around 325 million. Although this is not the same as active users, when comparing the number against Teams usage, you’ve got to ask if the majority of those using Office 365 also use Teams. The answer is “maybe” because it depends on what you consider active use. Microsoft’s telemetry gives them one view; others might say that starting Teams once a month and looking at a single message in a channel or chat is not a strong definition for active use.

Office 365 commercial revenue grew 21% in constant currency, driven by “installed base expansion across all workloads” (people are making more use of all apps). What’s also interesting is that E5 revenue is being driven by “demand for our advanced security, compliance, and voice offerings.” The interpretation here is that customers are willing to upgrade to the Office 365 E5 or Microsoft 365 E5 plans to access features like auto-label policies (retention and sensitivity labels), trainable classifiers, communications compliance, and Teams Voice plans, all of which allows Microsoft to increase its gross margin (up 4% for the Microsoft Cloud segment).

Further evidence of enterprise customers moving from basic Office 365 plans to Microsoft 365 plans is in the 30% growth of enterprise mobility and security (included in Microsoft 365) to 196 million seats.

Azure AD Grows Too

Office 365 makes heavy use of Azure AD. Microsoft says that Azure AD now has 500 million monthly active users, up from the 425 million reported in FY21 Q2. Microsoft also said that “nearly 240 million people have adopted passwordless login to date” but didn’t give any details about a breakdown across commercial and consumer segments.

Hopefully, the move to withdraw basic authentication for email connections in October 2022 will force more Office 365 tenants to move to embrace modern authentication, multi-factor authentication, conditional access policies, and the Microsoft authenticator app. Apart from anything else, going modern will make tenants more secure, stop business email compromise attacks, defend better against password spray attacks, and generally help to repel attackers. There’s lots to like about that.

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Not for Me, but Others Like the Praise App

What should the average tenant administrator make of the new conveyed in message center notification MC289968 (October 7) that the Viva Insights app for Teams will soon include praise history? This important development warrants Microsoft 365 roadmap item 85639.

Update December 7: Microsoft has moved the deployment date for Praise History out to early January 2022.

A brief history of praise in Teams is that the feature appeared in early 2019, gained the ability for tenants to create custom praise badges in 2020, and became part of the Viva Insights app when Microsoft released the app as part of its Viva initiative this year (Figure 1).

Despite Microsoft making it easy access to send praise to co-workers, I must admit that I have paid little attention to the feature. A quick thumbs-up to a message is one thing; sending someone a colorful badge is not a natural action for me. All of which means that the advent of praise history in Viva Insights is an inconsequential matter compared to other developments inside Microsoft 365.

Personal Praise History

But others will delight in the ability to view their sent and received praise for the preceding six-month period. And they will love that the notifications of praise sent to them will include a link to Viva Insights to allow them to check their “personal praise history.” The pleasure gained in reviewing who send you praise and whom you praised will doubtless create a warm sensation in the reader that I’m happy to miss. Apparently, the praise history really is personal; managers won’t be able to review their staff to discover who receives the most recognition from their co-workers. Or the opposite to find out the great unloved (aka grumpy old people) on staff. Like me.

Adding praise tracking to Viva Insights is another example of the utter uselessness of the app. Like headspace mediation, the virtual commute, and reflections of well-being, it’s an exercise in software engineering to deliver functionality that many will try out and discard without further thought. Some of the tenants I frequent don’t use the praise app (Microsoft does, even if guests can’t send praise)

I’m sure it all makes sense in the like-hunting, Instagram-influenced parts of the internet but advances like praise tracking leave me cold. All I can think about is whether the Teams engineers could spend the time developing praise to improve functionality elsewhere in the product.

Some People Like to Praise

In making this point, I acknowledge that Teams user voice has some 125 requests relating to praise, including a request for people to be able to praise themselves. The requests also include asks for praise history or dashboard and access to praised data via a Graph API, all to help organizations use praise as the basis for employee or school recognition, awards, and incentives.

I guess there are people who find praise useful and I’m happy for them that they’ll be able to track praise history when Microsoft ships the feature in November. Maybe I should do a better job of valuing differences. And if I do, perhaps someone will send me praise.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what’s happening.

Tackling Channel Sprawl One Channel at a Time

Now that Teams has been in production use for several years, it’s more than likely that some channels have fallen into an obsolete state. It’s easy to understand why this happens. A team supports up to 200 regular channels (and 30 private channels and soon, shared channels). When first introduced to Teams, it’s common to find that team owners go wild with channels and create far more channels than they need.

A channel should be a logical partition of the discussions which take place within a team that endure for a reasonable period. However, channels are often used where a simple conversation or group chat would be better.

Too Many Channels Hide Information

Browsing a team where you see

might be an exciting opportunity to discover tons of new and interesting information. Normally it leads to a confused mass of content, or “channel sprawl,” a condition that doesn’t help end users find the right information at the right time, even if Teams is improving search by including top hits in search suggestions and how it presents search results.

The question therefore is how to reconstruct the channel structure team. Given that you can’t move some or all conversations from one channel to another (in the same team or in a different team), it’s hard to close down a channel. The question therefore is how to reconstruct the channel structure team. You could delete unwanted or underused channels and use the 30-day period to see if anyone notices or protests. If someone does, a team owner can recover the deleted channel quickly through the Channels section of the Manage team option. Although deletion is a blunt instrument, it is certainly an effective technique to prune unwanted content from a team and restore channel navigation to a more logical and easily understood menu.

Warn Before Deletion

A more finessed approach is to give some warning that a channel will be removed for a period before deletion happens. There’s no option to do this in any Teams client, so we need to be creative,. An elegant and easy solution is to edit the channel settings to add a visual warning that the channel will soon be closed. A channel has a folder in the document library of the team’s SharePoint Online site. The folder is unaffected by a channel deletion, but it’s still good to check for any important files and consider moving them to a more appropriate location.

For example, a channel in a team used by a group of MVPs holds tweets about topics relating to Office 365. The Twitter connector posted the tweets to the channel. Everything worked well before Microsoft retired the Twitter connector in early 2020. The last tweet arrived on 17 March 2020 and the channel has remained silent since. This channel is a great candidate for immediate deletion. The information it holds is available elsewhere and it hasn’t been used in over 18 months. The channel is a stagnant container of not very valuable data.

But before we delete it, let’s give users some warning using the following steps:

• Select the channel and choose the Manage channel option.
• Edit the channel name to include an indicator that the channel is defunct. The name can be text-only, but it’s better to include a graphic to seize user attention. Press the Windows logo key and period to bring up the Windows emoji menu and select a suitable graphic as a prefix for the channel name (Figure 1).
• Make sure to uncheck the Automatically show this channel in everyone’s channel list option.
• Save the changes.

The newly renamed channel shows up with a clear indication of its new status. As you can see in Figure 2, I also post an announcement to the channel to warn users about the intention to remove the channel in the future.

Simple Technique

The technique explained here is a simple way of letting people know about the imminent removal of a defunct channel. Perhaps Teams will deliver a more elegant solution in the future. For now, this one works well.

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Part of Microsoft’s Hybrid Work Initiative

Highlighted by Microsoft in June as part of their hybrid work initiative and announced in message center notification MC279627 (last updated Aug 25, 2021), the refreshed version of the Whiteboard app for Teams is now appearing in tenants. To provide a uniform experience on all platforms, the refresh is also available now for the browser and Android clients with an update expected for the Windows native and iOS clients in October (Microsoft 365 roadmap item 82094 is for the Windows version).

Microsoft lists a bunch of new features now available for the browser and Teams clients:

• Sticky note colors: 10 colorful sticky note shades to choose from.
• Note grids – insert a grid of sticky notes in one of 12 available colors to help in workshops and ideation sessions.
• View objects created in native apps – Objects such as lists & templates inserted on native apps can be viewed on web and Teams as well.
• Ink pen colors: 15 new ink pen color options with a range of thicknesses to help visualize your content and bring your text to life.
• Highlighter colors: – 15 new highlighter color options enable users to emphasize content on the board.
• Ink shape recognition: – draw shapes with ink and then watch them straighten automatically.
• Improved mouse inking: – create smoother ink lines, making your strokes easier and cleaner when drawing with a mouse or trackpad.
• Read only mode for education accounts: – as a meeting facilitator or an educator, determine when and how students participate and collaborate by enabling or disabling their editing capabilities.

Among the objects which can be used in whiteboards are templates, stickers, and images plus the ability to customize the background of the whiteboard (change its color and pattern). I also like the ability to snap objects to lines to make sure that they line up properly. We’ll get to some of these later in this note. For more information, read Microsoft’s blog covering the highlights of the new feature set.

A further set of features are in progress and should roll out soon, including a “laser pointer” to allow users to attract the attention of other people as they share ideas in a whiteboard. Also coming is the welcome ability to cut and paste objects within a whiteboard.

The change in Whiteboard storage to use OneDrive for Business instead of Azure (MC282992) is still on course with opt-in to use OneDrive starting in late October and full transition in late February 2022.

Using Whiteboard in Teams

I’m not a whiteboard expert, but the change in the GUI is apparent immediately you start the app from the share tray in a Teams meeting. Microsoft says that the interface is clean and modern, and I think that’s fair. Figure 1 illustrates some of the new features such as adding a thumbs-up reaction to a text box, importing a graphic, and aligning posts. You can also see the new toolbox on the left. The cogwheel in the upper right offers options such as exporting the whiteboard as a graphic file or to prevent meeting participants making changes.

After a meeting finishes, the whiteboard is listed as one of the meeting resources and can be edited there.

Whiteboard Templates

The toolbox includes access to a bunch of templates designed to give users a flying start in sharing ideas in different contexts (Figure 2). Microsoft says that “over 30” templates are available. I didn’t count all the templates, but I that number sounds about right.

Importing a template into a whiteboard brings a complete structure ready for use or customization. It looks like many templates (such as the team alignment workshop shown in Figure 3) make extensive use of note grids, a new structure. Microsoft says: “Note grids help you create and build structure and form in your whiteboard session. Note grids present sticky notes in a clear and organized format. Customize each sticky note by color order and click to easily add extra sticky notes. You can also organize note grids by adding a title to them.”

The templates are a good base for developing whiteboards for use within an organization, or more importantly, they demonstrate what’s possible with the new whiteboard app.

Clever Inking

My ability to use digital ink has never been great. The digital versions of my drawing and writing sometimes look as if a drunken spider crawled out of an inkpot. I was therefore impressed with the draw and hold shape conversion feature (aka ink shape recognition). If you draw a line, circle, triangle, square, rectangle, rhombus, pentagon, or hexagon using a single ink stroke and then hold the pen (or finger, which is what I used) in place for a few milliseconds, Whiteboard converts the shape into what it should be. In other words, Whiteboard removes imperfections in the shape so that it looks perfect (or at least, better than I can draw). Clever tricks like this delight app users and you can waste many minutes playing with shapes.

Naturally, Microsoft has included some extra smarts into new devices like the Surface Pro 8 or Surface Studio laptop running Windows 11, with the new Surface Slim Pen 2. By sending slight vibrations through the pen, Microsoft says they achieve “a more natural inking feel while drawing” and “inking will feel more engaging with haptic signals for gestures.” All of which is supposed to give users more confidence when they ink. I have two pens which came with Surface Book 2 devices that I have never used. Looks like I need the new pen to get the confidence to use digital ink…

Good Update

The notion of a digital canvas for people to share ideas within Teams meetings is attractive. The original implementation of the Whiteboard app was pretty basic: about the best I can say is that the app was useful at times. This update contains enough to make Whiteboard much more interesting and productive. If you didn’t think much of Whiteboard beforehand, it’s time to take another look, if only to try out the shape conversion feature.

Keep up to date with developments like the new Whiteboard app by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

Fixes a Very Old Bug First Reported in 2016

Updated: December 19, 2021

Every channel in a team has a folder in the default document library of the SharePoint Online team site associated with the team. When a new channel is created in Teams, SharePoint Online creates a new folder with the same name as the channel. The channel and folder continue to share the same name until you rename the channel, in which case the names of the channel and the folder diverge. Microsoft acknowledges that losing the naming connection between Teams and SharePoint is a problem.

The issue has existed since the earliest days of Teams. The first user voice request for Microsoft to remove confusion by making sure that the channel and folder continued to share the same name following a rename appeared on November 3, 2016. I wrote about the issue in June 2019, saying that renaming channels could be messy.

Microsoft says they will fix the problem (MC280294) and clean up the mess with an update in mid-September (Microsoft 365 roadmap item 72211). The heading for Microsoft’s is “Pairing naming convention between Teams channels and corresponding SharePoint folders,” which I think is a poor attempt at conveying the impression that the change is something good. It’s not. Instead, it’s a long (very long) overdue fix for something that Microsoft should have addressed in 2017.

Update: In message center notification MC306666 (December 18), Microsoft says that they will roll out the fix in “late February through late April (2022).” The delay in the roll-out is likely due to the need to fix bugs which came to light during testing.

The delay means that any channel renamed before the deployment of the fix will remain unpaired, unconnected, unsynchronized, and seemingly unrelated to its SharePoint folder. Given the massive growth in Teams to 250 million monthly active users and the consequent growth in SharePoint Online usage, one can only guess at how many disconnected channels exist.

One of Those Complex Software Engineering Problems

No one denies that Teams is a complex product. Teams has dependencies on and consumes many different Microsoft 365 services from Azure AD to Exchange Online. The Teams development group has done a terrific job in growing the feature set in the product and expanding its capabilities into areas like multi-geo support. As Teams development VP, Rish Tandon, explained to me last May, the engineers have faced and solved many challenging problems as they developed the product from initial idea to world-class service.

But from time to time, the Teams development group just doesn’t deliver detail as well as it should. The failure to fix the channel rename problem is a classic example. Rolling out version 2.5.0 of the Teams PowerShell module with a broken version of the New-Team cmdlet is another. Neither seem to appear to be one of the complex software engineering problems that slow products down.

The New Channel Rename

After Microsoft deploys the update to Office 365 tenants, performing channel name (Figure 1) updates the value in both Teams and SharePoint Online.

As you can see in Figure 2, the synchronization with SharePoint Online means that the channel folder has the same name as used in Teams. In the past, the folder would still be “Projects” instead of the new “Projects 2021” name.

The General channel is an exception because it cannot be renamed. This is because the General channel represents the team. In fact, because the General channel exists in every team, the Teams clients translate its name to show translated values. For instance, it’s called Général in French and Allgemein in German. The names given to other channels are not translated and keep whatever name is given when created or renamed.

Rename synchronization for channels and folders applies for standard, shared, and private channels. Channels renamed prior to the update are not adjusted. If you want the names of these channels to synchronize with SharePoint Online, you’ll need to rename them again in Teams.

Microsoft notes that the new channel name will not be used by the OneDrive sync client until the client fully processes the channel following the rename. This usually doesn’t take long.

The Long-Awaited Fix

It’s good that Teams and SharePoint are now on the same page when it comes to channel renaming. It’s taken too long to happen, but it’s better later than never.

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Now Generally Available for Microsoft Defender for Office 365 Customers

The July 27 announcement of the General Availability of Safe Links for Teams is a welcome development. What it means is that if your tenant has Microsoft Defender for Office 365, you can update your Safe Links policy to include real-time checking of links posted to Teams chats and channel conversations.

Licensing Requirements

Licensing Microsoft Defender for Office 365 can be a little confusing. Two plans are available, both of which build on Exchange Online Protection (EOP):

• Office 365 E3 and below have Exchange Online Protection. These tenants can license Defender for Office 365 plans as standalone options.
• Microsoft 365 Business Premium includes EOP and Defender for Office 365 Plan 1.
• Office 365 E5/A5 and Microsoft 365 E5 includes EOP and Defender for Office 365 Plan 2.

Microsoft sometimes refers to the “security ladder from EOP to Microsoft Defender for Office 365” as a way of describing how the features in the Defender plans build on what you get in Exchange Online Protection (Figure 1).

In this case, you need at least Microsoft Defender for Office 365 Plan 1 to use Safe Links protection for Teams.

Configuring Defender for Teams

The Safe Links policy is managed through the Policies & rules section of the Microsoft 365 security center. To edit the policy, open Threat policies and select Safe Links. The important change is to set Select the action for unknown or potentially malicious URLs within Microsoft Teams to On (Figure 2).

At the same time, you should review the other Safe Links policy settings to make sure that they’re what you want. Three important settings used to detect and protect against malicious links in email also apply to links in Teams messages:

• Apply real-time URL scanning for suspicious links and links that point to files. In other words, before sending a user to a site, check that the link is not dangerous. If it is, display a warning.
• Do not track user clicks. This setting is normally off and isn’t needed unless you want to track user clicks against links.
• Do not allow users to click through to original URL. If a user clicks on a dangerous link, they see a warning page (Figure 3). You don’t want to allow people to click through the warning to open the dangerous page, so make sure that this setting is on.

You can also see in Figure 2 that I’ve opted to use organization branding on the warning page. The branding used here (and shown in Figure 3) is taken from the tenant’s browser theme.

Usually, Teams calls the default browser to open a web link and that’s when Defender steps in to display the warning page. If a malicious link is used in a channel tab (which means that someone has created a web site tab for that link), Teams opens the warning page in the tab and doesn’t call the browser. If Defender passes the link as safe, Teams opens the page as normal.

Nice Extension into Teams

It’s good that Microsoft has extended Safe Links protection into Teams. Although I suspect that most bad links will continue to arrive in user mailboxes (if not detected and placed in quarantine by Exchange Online Protection), it’s entirely possible that some users will share problematic links through Teams chats or channel conversations. If they do, and your tenant has Defender for Office 365 with a properly configured Safe Links policy, those links will be blocked. What’s not to like about that?

Learn about protecting Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s importance and how best to protect your tenant.

Customize Teams Apps by Choosing Your Own Icons, Colors, and Text

Now available in tenants, Microsoft has added the ability to customize apps through the Manage Apps section of the Teams admin center. Not every app is customizable, but you can easily find which can by using the new Customizable column to sort the set of apps (Figure 1). Microsoft and ISVs have upgraded several apps to support customization. including the Yammer communities app.

Customizing Apps

Deciding if app properties are customizable and which app properties a tenant can customize is up to its developer. These details are part of the app manifest used to publish the app to Teams. To transform an app to your liking, select a customizable app and then Customize from the Actions drop-down (Figure 2). In this example, we’ll customize the Yammer communities app (customization supported since version 2.2.4, per message center notification MC257689 issued on July 1).

Customize Teams App Properties

The full set of customizable properties are:

• Short name: a 30-character app name.
• Short description: an 80-character description of what the app does. You can also add a full description. The longest description I tested was 2,000 characters, which seems enough for anyone.
• Privacy policy URL. Microsoft uses https://privacy.microsoft.com/en-us/privacystatement.
• Website URL. This is usually the URL for the main landing page of your company’s web site.
• Terms of use URL. Microsoft uses https://www.microsoft.com/en-us/servicesagreement.
• Color and outline icons. The color image must be smaller than 1,000 KB and should be a PNG file sized at 192 x 192 pixels. The outline icon is 32 x 32 pixels. The color app shows up in the Teams app store. Teams displays the outline app in the app navigation bar.
• Accent color. A hex code defining the background upon which Teams displays the app’s color icon. Here’s a handy web site to help find the code for the background color.

As it happens, the set of customizable properties are exactly what Microsoft describes in how to create an app for Viva Connections when they first released Connections at the end of March. At that time, Microsoft hadn’t released a full-blown Viva Connections app for Teams but wanted customers to be able to use Connections in Teams, so they created a PowerShell script to create the necessary manifest to generate a customized line-of-business app.

Figure 3 shows the details pane and my attempts to customize the Communities app with some new descriptive text and a color icon. In many cases, making this level of change is enough for an organization. They might want to add some new text to the description to help their users understand why the app is available to them and customize the icon slightly, perhaps to add a corporate logo.

I didn’t use a 192 x 192 picture for the large icon. Instead, I took a regular-sized digital photo someone took of me with a Yammer logo on my face at an Ignite event and resized it using Paint. Teams didn’t complain about the height of the picture if its width matched the 192 pixel limit.

Publishing and Using Customized Properties

After saving the customized app properties, Teams publishes the new details to make them active. It can take up to 24 hours before the customizations become effective. If you make a mistake, you can reset the customizations to revert to the original settings.

Many organizations don’t allow end users to browse the Teams app store and install any app they like from the store. In these situations, you can create or update a Teams setup policy and include the app in the of pinned apps published to the left-hand app rail in the client (Figure 4).

You can expect a delay of a couple of hours (at least) before a new app shows up in the app rail or becomes available to users in the Teams app store. Figure 5 shows the customized version of the Communities app with the icons as they appear in the store (large) and app rail (small). Notice too that my customized title (“Communities Pro”) is only visible in the app store. This underlines the wisdom of using short app titles with the most important word appearing first whenever possible. Good examples of what I mean are “Teams”, “Files”, and “Chat.” Long titles like “Tasks by Planner” or even “Communities” don’t fit in the space available in the app rail.

Simple Change Worth Doing

Once its developer enables app customization, the process of making changes to the app properties to match corporate needs is quick and simple. Customizations should survive app updates, but that depends on the content of the app manifest. Time will tell if the theory holds true.

Make sure that you’re not surprised about changes which appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

On

July 12, Microsoft released version 16.0.21411.1200 of the SharePoint Online PowerShell module, installable from the PowerShell Gallery. The updated module is especially notable because the Get-SPOSite cmdlet boasts three new properties to inform administrators if sites are connected to Teams. The properties are:

• IsTeamsConnected: Set to True if the site is connected to a team.
• IsTeamsChannelConnected: Set to True if the site is connected to a Teams private or shared channel. These sites have IsTeamsConnected set to False.
• TeamsChannelType: Set to None for teams-connected sites and to Private for sites belonging to private channels or Shared for sites belonging to shared channels (due later this year).

New View of Teams Sites

The updated module aligns with the effort to make SharePoint Online more manageable for teams-connected sites through a UI refresh and by showing details of channel-connected sites in the SharePoint Online admin center with a new Sites connected to Teams view (Figure 1). This view is in preview at present and should become generally available later this year.

The new view lists all teams-connected sites and indicates how many of the channels in a team have a channel-connected site. Clicking the link for the channel sites exposes further information (Figure 2).

The net effect of the change is that SharePoint administrators will see information about teams-connected and channel-connected sites in the SharePoint Online admin center which isn’t available today. Access to information about channel-connected sites is read-only. This is because these sites inherit settings from the parent team site. It also ensures that management of the channel-connected sites remains with the channel owners.

Using the New Teams Site Properties in PowerShell

Coming back to PowerShell, the new properties make it easier to find and report details of Teams-connected sites. You can still do this using the Get-UnifiedGroup cmdlet, which offers the advantage of exposing group information more easily. Now you have the option to check if team-connected sites have private or shared channels.

Here’s some quick and dirty PowerShell to report channel-connected sites. The code:

• Creates an array of sites connected to Teams.
• Creates another array of channel-connected sites.
• Loops through the sites array to see if any matching channel-connected sites are present and reports these sites. Remember, a team can have up to 30 private channels.

# Find Teams-connected site
[array]$Sites = Get-SPOSite -Limit All | ? {$_.IsTeamsConnected -eq $True}
# Find channel connected sites
[array]$ChannelSites = Get-SPOSite -Limit All | ?{$_.IsTeamsChannelConnected -eq $True}

$SiteCount = 0
$ChannelData = [System.Collections.Generic.List[Object]]::new()
ForEach ($Site in $Sites) {
   [array]$MatchedSites = $ChannelSites | ? {$_.Url -Match $Site.Url}
   If ($MatchedSites) {
      $SiteCount++
      ForEach ($MSite in $MatchedSites) {
       $ReportLine = [PSCustomObject][Ordered]@{  
         Parent      = $Site.URL
         Title       = $Site.Title
         URL         = $MSite.URL
         ChannelType = $MSite.TeamsChannelType }
       $ChannelData.Add($ReportLine)
      } # End ForEach
   } # End if
} # End Foreach
Write-Host ("Total of {0} channel-connected sites found for {1} sites" -f $ChannelData.Count, $SiteCount)

Here’s an example of a record for a channel-connected site:

Parent      : https://office365itpros.sharepoint.com/sites/CorporateAcquisitionPlanning2020
Title       : Corporate Acquisition Planning 2020
URL         : https://office365itpros.sharepoint.com/sites/CorporateAcquisitionPlanning2020-LegalDiscussions
ChannelType : PrivateChannel

Figuring Out Inconsistencies

Interestingly, I found instances where the Microsoft 365 group which originally owned a team-connected site was no longer available in the tenant, but team-connected and channel-connected sites still existed. This is likely due to retention policies where sites come within the scope of a retention policy and the group did not. I used the following code to find these channel-connected sites:

# See if we can find parent groups
ForEach ($CSite in $ChannelSites) {
   $MatchURL = $CSite.URL.Split("-")[0]
   $Match = $Sites | ? {$_.Url -Match $MatchURL}
   If (!($Match)) {Write-Host "Can't find parent team-connected site for channel-connected"  $CSite.URL }
}

I also found some inconsistencies between the number of channel-connected sites reported using the new properties and the older method of using the site template to identity these sites:

$TTSites = Get-SPOSite -Limit All -Template "TEAMCHANNEL#0"

Some testing revealed that this is due to some provisioning delays in updating site properties. Essentially, if you update the membership of a channel, you force synchronization to update site properties.

Exposing Channel-Connected Sites

There’s no doubt that these updates add value. When Microsoft introduced private channels in November 2019, many complained that the sites used for sharing documents in private channels were invisible (they weren’t, but you had to use PowerShell to see them). Exposing details of private channels (and soon, shared channels) in the SharePoint Online admin center is a good thing: adding the properties to allow better filtering and reporting of channel-connected sites in PowerShell is even better.

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Hide Teams from Exchange to Clean Up a Potential Mess

Updated 17 October 2023

In mid-2018. Microsoft updated Teams so that the Microsoft 365 Groups created for new teams were hidden from Exchange clients (like OWA) and Exchange address lists (like the GAL). This was accomplished by setting the HiddenFromExchangeClientsEnabled and HiddenFromAddressListsEnabled properties of the groups to True. The idea is that there’s no point in revealing team-enabled groups to Exchange when communications for those groups is centered around Teams messaging and meetings.

Groups Created Using Admin Interfaces

Unfortunately, the change only applied to teams created with the Teams clients (desktop, browser, and mobile) and the New-Team cmdlet from the Microsoft Teams PowerShell module. The groups for teams created using the Teams admin center (Figure 1), Azure AD admin center, Microsoft 365 admin center, New-UnifiedGroup PowerShell cmdlet, or the Microsoft Graph are not hidden from Exchange clients or address lists, with the result being that an organization can end up with some teams being visible and others not.

The logic here is that when an administrator creates a new team or group, it is assumed that they can make whatever decisions are necessary about the settings for the new group. This position is undermined by the fact that there’s no way to update the settings to hide groups available in the Teams admin center or Microsoft 365 admin center, so any adjustments must be done using PowerShell or the Graph.

The PowerShell Solution to Hide Teams from Exchange

Fortunately, the solution is reasonably easy to code in PowerShell. The steps are:

• Find the set of groups used by Teams.
• Reduce the set to the groups still visible to Exchange Online.
• Update the group settings to make them invisible to Exchange Online.

Here’s some code to do the job:

$HiddenGroups = 0
Write-Host "Finding team-enabled Microsoft 365 Groups and checking for any which are visible to Exchange clients"
[array]$Groups = Get-UnifiedGroup -Filter {ResourceProvisioningOptions -eq "Team"} -ResultSize Unlimited 
# Reduce to the set visible to Exchange clients
[array]$Groups = $Groups | Where-Object {$_.HiddenFromExchangeClientsEnabled -eq $False}

# Process the remaining groups and hide them from Exchange
If ($Groups.Count -ne 0) {
  ForEach ($Group in $Groups) { 
     Write-Host "Hiding" $Group.DisplayName
     $HiddenGroups++
     Set-UnifiedGroup -Identity $Group.ExternalDirectoryObjectId -HiddenFromExchangeClientsEnabled:$True -HiddenFromAddressListsEnabled:$True
  }
}
Else { Write-Host "No team-enabled Microsoft 365 Groups are visible to Exchange clients and address lists" }

Write-Host ("All done. {0} team-enabled groups hidden from Exchange clients" -f $HiddenGroups)

You can download the script from the Office 365 for IT Pros GitHub repository.

The Graph Method to Hide Teams from Exchange

Update: Since the original post, Microsoft updated the Graph APIs to allow the retrieval and updating of the settings controlling the display of groups to Outlook clients and visibility to Exchange Online address lists. This code is an example of how to use a combination of Microsoft Graph PowerShell SDK cmdlets and Graph API requests to find teams, check each, and update the settings if necessary.

[array]$Teams = Get-MgGroup -Filter "resourceProvisioningOptions/any(x:x eq 'Team')" | Sort-Object DisplayName
If ($Teams) {
   Write-Host ("Processing {0} teams..." -f $Teams.count)
}
# Parameters if we need to update a group
$Parameters = @{
 "HidefromOutlookClients" = "true" 
 "HidefromAddressLists" = "true" }
[int]$i = 0; [int]$Problems = 0
# Process each team, check if it's visible to Outlook clients and if so, hide it
ForEach ($Team in $Teams) {
  $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}?`$select=id,displayName,description,hideFromOutlookClients,hideFromAddressLists" -f $Team.Id)
  $Data = Invoke-MgGraphRequest -Uri $Uri -Method Get
  If ($Data.hideFromOutlookClients -eq $True) {
     Write-Host ("Team {0} is hidden from Outlook clients" -f $Team.displayName)
  } Else {
     Write-Host ("Hiding Team {0} from Outlook clients and Exchange address lists" -f $Team.displayName) -foregroundcolor Red
     $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}" -f $Team.id)
     $Status = Invoke-MgGraphRequest -Uri $Uri -Method Patch -Body $Parameters
     If ($Status) {
       $i++
     } Else {
       $Problems++
     }
  }
}

Write-Host ("All done. {0} groups hidden successfuily. {1} problems." -f $i, $Problems)

Obviously, this check must occur periodically to process newly-created team-enabled groups to hide teams from Exchange Online clients and in address lists. Something like a scheduled job executing an Azure Automation runbook would do the job.

Learn how to exploit the Office 365 data available to tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Picking Up Support for Retention Labels

Updated: 10-Nov-2021

We’re approaching the end of the transition for the storage of Teams meeting recordings from “classic” Stream to OneDrive for Business and SharePoint Online (ODSP). From August 16, 2021, Microsoft will begin the process of moving any tenant who has not yet transitioned to store new meeting recordings to ODSP. When Microsoft announced their intention to move away from the Azure-based storage used by classic Stream, they emphasized the advantages gained by storing recordings in ODSP. Among those advantages is the ability to apply retention policies to meeting recordings. Others include the ability to share recordings with external people and an increase in storage quota over the limited amount made available for Stream.

Building an Auto-Label Policy

The sad fact about meeting recordings is that they tend to age rapidly. After a month or so, the need to refer to the recording of any meeting is greatly diminished. And indeed, many organizations don’t want recordings kept for any great length of time. An auto-label retention policy is the best way to find and remove Teams meeting recordings. The policy contains some conditions to identify items stored in ODSP and a retention label to apply. The retention label specifies the retention period (for example, two months), and the retention action (for example, permanently delete the item).

When Microsoft originally discussed the movement of Teams meeting recording to ODSP at Ignite 2020, they referenced a special retention policy to control recordings (see 15:00 in the recording) to be available in H1 CY21. That functionality hasn’t been delivered yet, and it’s important because it covers all licensing plans (SKUs). For now, Microsoft documents how to create an auto-label retention policy to remove recordings. Conceptually, the policy is very simple:

• Find Teams recordings: When Teams uploads a recording to ODSP, it stamps the MP4 file with ProgID attributes. This means that an auto-label policy can use a keyword search for ProgID:Media AND ProgID:Meeting to find recordings (Figure 1). Teams sets the ProgID (programmatic identifier) values for recordings when uploading the files to ODSP.
• Select the target locations: Most Teams recordings are from private meetings and end up in the meeting organizer’s OneDrive for Business account. Channel meetings end up in the channel folder in the SharePoint Online document library of the host team. The important thing here is to choose Microsoft 365 Groups as the target location type. You can also choose SharePoint sites if you expect to move or copy recordings around, but selecting Microsoft 365 Groups ensures that the auto-label policy finds recordings captured in the SharePoint sites connected to teams.
• Apply a retention label: Any retention label can be used, including those which require manual disposition.

Auto-label policies which run against ODSP locations depend on the indexing process to find matching items. As the process runs to populate the indexes used for Microsoft Search, it matches items using the criteria set in retention policies and applies the label specified in the policies.

The indexing process runs on an ongoing basis to detect new items and usually tags new recordings within a couple of days, depending on the overall load on the indexing service. My experience is that labels appear sooner in OneDrive for Business than they do in SharePoint Online. Frustratingly, it can happen that a policy labels some items in a location but not others, which might make you think that a policy isn’t working instead of reflecting how index updating proceeds. Eventually, everything gets caught up and all recordings have labels.

The Need for Licenses

Creating and applying an auto-label policy sounds like a good idea, until you realize that auto-label policies require Office 365 E5 or a Microsoft 365 E5 compliance license for all accounts covered by the policy. Many other licensed accounts generate Teams meeting recordings who can’t use auto-label policies. In these cases, users can apply retention labels manually (this function is covered by Office 365 E3 and E1 and Microsoft 365 Business Premium among other licenses). Manual application of retention labels is certainly feasible but this strategy relies on the discipline and thoroughness of user behavior, which isn’t always reliable. A generalized org-wide retention policy usually applies a longer retention period than desirable for Teams meeting recordings, so isn’t a good answer.

If you don’t want to use an auto-label policy, from January 2022 you should be able to apply a Teams-specific auto-expiration period to meeting recordings. The advantage of this approach is that retention is controlled by Teams meeting policies and is available to all Microsoft 365 plans which include Teams. And if you choose to use an auto-label policy, the retention labels assigned to meeting recordings will take precedence over Teams auto-expiration.

Interpreting the Effect of Black Box Policies

An auto-label policy is an impenetrable black box when it comes to reporting progress in processing items. Once you create or edit a policy and publish it to target workloads (ODSP in this case), all you can do is hope that the policy has the desired effect and labels the correct items. The compliance center gives no hint about when the policy last scanned a location, how many items matched, or overall totals for the tenant.

Three methods exist to check the effectiveness of an auto-label policy. The quick and easy method is to check the recordings in individual sites and accounts to verify if they have the correct retention label (Figure 2).

Checking individual recordings quickly becomes boring and there’s no guarantee when ODSP will process an auto-label policy against files. The Office 365 E5 and Microsoft 365 E5 licenses include access to the Activity explorer in the Data classification section of the Microsoft 365 compliance center. You can check there to see if the policy applies retention labels to recordings. Figure 3 shows the information captured for an auto-labelling action as viewed through the Activity Explorer.

The Office 365 audit log captures the same data for auto-labeling actions. You can search using the Audit log feature in the compliance center or by running the Search-UnifiedAuditLog cmdlet to look for TagApplied events. Here’s an example of the data available in an audit record:

Search-UnifiedAuditLog -StartDate 11-Jun-2021 -EndDate 12-Jun-2021 -Formatted -ResultSize 5000 -Operations TagApplied

RecordType   : SharePointFileOperation
CreationDate : 11/06/2021 15:39:17
UserIds      : 6909d419-3589-4d38-85e3-d65e8c9aa408
Operations   : TagApplied
AuditData    : {
                 "CreationTime": "2021-06-11T15:39:17",
                 "Id": "63ee2402-1400-42bf-89e8-08d92cef12fc",
                 "Operation": "TagApplied",
                 "OrganizationId": "b662313f-14fc-43a2-9a7a-d2e27f4f3478",
                 "RecordType": "SharePointFileOperation",
                 "UserKey": "6909d419-3589-4d38-85e3-d65e8c9aa408",
                 "UserType": "CustomPolicy",
                 "Version": 1,
                 "Workload": "OneDrive",
                 "ClientIP": "",
                 "ObjectId":
               "https://office365itpros-my.sharepoint.com/personal/tony_redmond_office365itpros_com/Documents/Recordings/Transcription for All-20210609_131449-Meeting Recording.mp4",
                 "DestinationFileName": "Meeting with Ivan-20210609_131449-Meeting Recording.mp4",
                 "DestinationLabel": "Teams Recordings",

A more extensive discussion about how to use audit log events to track the progress of auto-labeling is in this post. You can also use audit events to know when new Teams meeting recordings are created in OneDrive for Business or SharePoint Online.

If you don’t have the licenses needed to use an auto-label policy to manage Teams meeting recordings, you can at least find out when recordings are created and use that information as the basis to remove the recordings manually or programmatically.

To Keep or to Remove?

It’s hard to recommend a suitable retention period for Teams meeting recordings. The pressure which existed previously due to the limited storage quotas imposed by Stream doesn’t apply anymore, so you could keep all recordings if you wanted. But given that most recordings are not very useful after a month or so, the right thing to do is to remove them. That is, if you have the licenses for auto-label policies!

Learn more about how Office 365 really works on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s really important across the Office 365 ecosystem.

Teamify: An Offer Hard to Refuse

If you’re the owner of a SharePoint Online team site which is connected to a Microsoft 365 group, you might have seen the prompts (subtle harassment) to “teamify” the site. The prompt (Figure 1) promises that you can “collaborate in real-time and share resources across Microsoft 365 with your team.” Sounds good, unless you created the site to use with email-based Microsoft 365 groups (aka Outlook groups) and plan to use email as the collaboration mechanism.

Email-Based Microsoft 365 Groups

I use Outlook-based groups quite often to work with companies who don’t use Teams or might not use Microsoft 365. In 2016, Microsoft added support for Azure B2B collaboration to Outlook groups to enable collaboration with external users. Tenant users can post to Outlook groups through Outlook (desktop, mobile, or OWA) but guests rely on email to receive copies of posted messages. In many places, Outlook groups are more than sufficient to work with third parties. But email will always get the message through (within reason) and access to the group’s SharePoint sites makes it easy to work on shared documents.

Driving Teams Adoption

But Teams is where the action is, and Microsoft certainly knows how to create many different touch points to drive user awareness and usage. Teams also uses Microsoft 365 Groups, and it’s more than possible to team-enable Outlook Groups. In technical terms, it’s a matter of creating a team and setting some values for the group, like the resource provisioning option. After creating the team, the team picks up the existing group membership and resources.

Creating Tabs in the General Channel for Site Resources

It’s long been possible to link a team to a group-connected site (the so-called teamify process). Recently, Microsoft added the ability to create channel tabs for site resources when setting up the new team. Figure 2 shows the dialog used to collect information about resources like Microsoft Lists and individual pages.

In Figure 2, two resources are selected to become channel tabs. Figure 3 shows the result with two tabs created for the home page for the site and a Microsoft list hosted in the site.

After creating the team, the process creates tabs in the General channel for the selected resources. You can’t create new channels when you teamify an existing SharePoint site, so the resources must go into tabs in the General channel. After creating the team and building out its channel structure, you can remove resources from the General channel into other channels. Unfortunately, you need to recreate the tabs as there is no way to move a tab from one channel to another.

Hiding the New Team

A small, but potentially important point, is that team-enabling a SharePoint site does not update the properties which hide the group from Exchange clients (Outlook, OWA, and Outlook mobile). If you look at the properties with PowerShell, you’ll see that the group remains visible to Exchange clients and the GAL.

Get-UnifiedGroup -identity "Project Haycock"| fl hiddenfrom*

HiddenFromExchangeClientsEnabled : False
HiddenFromAddressListsEnabled    : False

Is this important? In April 2018, Microsoft decided to hide team-enabled groups from Exchange clients with the logic being that once a group has a team, collaboration flows through Teams channels and chats rather than email. It doesn’t make sense to expose teams to email clients, hence the hiding. You can make up your own mind if you need to run a PowerShell script to find and update team-enabled groups which are still visible.

Need to know more about how Office 365 and its apps really work? Subscribe to the Office 365 for IT Pros eBook and learn on an ongoing basis.

Avoiding the Need to Remove and Recreate Guest Accounts

Microsoft 365 applications like Microsoft 365 Groups, Teams, SharePoint Online, and Planner use Entra ID B2B Collaboration to enable guest user access to their resources. The result is that many tenants have a proliferation of guest accounts to manage. I’ve written quite a few tools to help, including a report of guest accounts and their membership of Microsoft 365 Groups and a comprehensive report of tenant and guest members in Groups and Teams. Management can even be a challenge for guests who want to renounce their membership of a tenant.

In any case, the details of some guest accounts change over their lifetime. On March 2, Microsoft issued documentation for Reset redemption status for a guest user. This doesn’t sound very exciting, but it’s really very interesting because the feature allows tenant administrators to adjust how a guest account is signed into without using the previous technique of removing and recreating an account. The downside of that approach is that access is lost to all the resources available to the guest account like Teams, SharePoint sites, shares to individual documents, and so on. After recreating the account, access must then be regranted for each resource. This process is tedious, especially when the guest features in multiple groups.

Microsoft anticipates that the reset feature will be used in scenarios such as:

• The user wants to sign in using a different email and identity provider. In other words, they now have a different account. For instance, the user might have moved companies and wishes to continue working with your company (a common scenario for professionals like IT consultants and lawyers).
• The account for the user in their home tenant has been deleted and recreated. Entra ID won’t recognize the link between the guest account and the user’s new account.
• The user’s responsibilities have been passed along to another user and they want to assign access to the resources which supported those responsibilities to that user.

Part of the change is performed using the Entra ID admin center. The rest is done with PowerShell cmdlets from the AzureAD Preview module, which you can download from the PowerShell Gallery.

Change the Email (Sign-in) Address for a Guest Account

Unlike tenant accounts, guest users don’t use their user principal name to sign in. Instead, they use their email address. To work, the reset feature changes the sign-in name for the guest account and nothing else. The mail user object created in Exchange Online to allow guest users to receive email is also updated.

In this example, I have a guest account for Jacko Winters. The original email address for this account is Flayosc@outlook.com. The guest is a member of multiple teams and shares some SharePoint documents. I want to reassign access to all these resources to another account called Flayosc@yandex.com. It’s an example of the first scenario described above.

The first step is to update the Mail attribute (Email address) for the guest account with the email address you want to use. Do this through the Entra ID admin center (Figure 1). The new email address cannot belong to any other mail-enabled object in the tenant, such as another guest account. If it does, Entra ID won’t allow you to update the account.

Moving to PowerShell, connect to AzureAD and get the Entra ID account identifier for the guest account you want to replace.

Connect-AzureAD
$ObjectId = (Get-AzureADUser -SearchString “Jacko Winters”).ObjectId
$ObjectId
558d8cbb-a5a2-4ea1-b950-0d0748ca5634

Now create a new User object and populate it with the object identifier for the account.

$OldUser = New-Object Microsoft.Open.MSGraph.Model.User -ArgumentList $ObjectId
$OldUser

Id                                   OdataType
--                                   ---------
558d8cbb-a5a2-4ea1-b950-0d0748ca5634

Issuing a New Invitation

The next thing to do is check that the values returned from the two commands match. If they do, use the New-AzureADMSInvitation cmdlet to reissue an invitation to the new email address. The identifier for the guest user account is passed in the InvitedUser parameter. The myapps.microsoft.com landing page is a default site showing apps available to a user. Here’s the command I ran:

New-AzureADMSInvitation -InvitedUserEmailAddress Flayosc@yandex.com -SendInvitationMessage $True -InviteRedirectUrl "http://myapps.microsoft.com" -InvitedUser $OldUser -ResetRedemption $True

Update: Given the deprecation of the AzureAD module in March 2024 (and the disappearance of the ResetRedemption parameter from the New-AzureADMSInvitation cmdlet), you should switch to the Microsoft Graph PowerShell SDK. This code is the equivalent using the Get-MgInvitation cmdlet:

$User = Get-MgUser -Filter "startsWith(mail, 'Flayosc@yandex.com')"
New-MgInvitation `
    -InvitedUserEmailAddress 'Flayosc@yandex.com' `
    -InviteRedirectUrl "http://myapps.microsoft.com" `
    -ResetRedemption `
    -SendInvitationMessage `
    -InvitedUser $User

See this documentation for more information.

Entra ID creates a new invitation to access the resources currently available to the guest account and sends it to the new email address. You’ll see a response like this:

Id                      : 129c1c12-da99-4879-b258-d14b34601d46
InvitedUserDisplayName  :
InvitedUserEmailAddress : Flayosc@yandex.com
SendInvitationMessage   : True
InviteRedeemUrl         : https://login.microsoftonline.com/redeem?rd=https%3a%2f%2finvitations.microsoft.com%2fredeem%
2f%3ftenant%3db662313f-14fc-43a2-9a7a-d2e27f4f3478%26user%3d129c1c12-da99-4879-b258-d14b34601
d46%26ticket%3dLStZd8uAONAIbLNIZyfaUZ91VsRczLbzqbFOeHsonSE%253d%26ver%3d2.0
InviteRedirectUrl       : http://myapps.microsoft.com/
InvitedUser             : class User {Id: 558d8cbb-a5a2-4ea1-b950-0d0748ca5634
OdataType: }

InvitedUserMessageInfo  : class InvitedUserMessageInfo {
                            CcRecipients: System.Collections.Generic.List`1[Microsoft.Open.MSGraph.Model.Recipient]
                            CustomizedMessageBody:
                            MessageLanguage:
                          }

InvitedUserType         : Guest
Status                  : PendingAcceptance
ResetRedemption         : True

Accepting the Reissued Invitation

The invitation arrives at the email address (Figure 2) and the user can accept the invitation to confirm their credentials (set a password) and create an OAuth consent to allow the tenant to read details of the user’s account (Figure 3).

Once the user consents to the permissions, the user account is updated to set the UserState property to Accepted and write the date of the redemption in UserStateChangedOn. We now have a fully functional guest account again. The important point is that the object identifier and user principal name for the account do not change. The only thing which changes is the mail address associated with the account.

The Entra ID audit log contains details of the issue (Figure 4) and redemption of the invitation. While the activity tab confirms the target address for the invitation, the target tab confirms the guest account.

Accessing Resources

In this instance, the guest account has access to several teams and some SharePoint documents. SharePoint access is immediate, including the sites used by Teams. Guest access to Planner also works properly.

After testing that access worked for SharePoint and Planner, I turned to Teams. I expected access to the Teams app to take longer because of the need to complete the process which synchronizes Entra ID with the membership roster used to control access to individual teams. Until this happens, the user is refused access to Teams (Figure 5) and the old email address assigned to the guest account remains visible in Teams (Figure 6). [Note that the display name of the guest account has reverted to Flayosc instead of Jacko Winters]

Unsurprisingly, because the account information in Teams is now outdated, any attempt to add the guest account as a new member of a team also generates an error (Figure 7).

To try to force synchronization, I updated the display name and several other attributes of the account. This had no effect, so I added a couple of new users to the group using Teams to force Teams to refresh its membership roster. The updates flowed through to Entra ID, but nothing happened in Teams.

Get-AzureADGroupMember -ObjectId b647d5ff-3bda-4333-b768-7990084569b6

ObjectId                             DisplayName                   UserPrincipalName
--------                             -----------                   -----------------
cff4cd58-1bb8-4899-94de-795f656b4a18 Tony Redmond                  Tony.Redmond@office365itpros.com
b3eeaea5-409f-4b89-b039-1bb68276e97d Ben Owens (Business Director) Ben.Owens@office365itpros.com
a6bfb216-e88c-4f1f-86d7-04747e5fc686 Ben James                     Ben.James@Office365itpros.com
9ba20686-f869-46e8-85a2-00ec8a035e48 James Joyce                   James.Joyce@office365itpros.com
acb778e8-f587-45de-ae3a-e76007e043b2 Paul Howett                   Paul.Howett@office365itpros.com
98dda855-5dc3-4fdc-8458-cbc494a5a774 Sean Landy                    Sean.Landy@office365itpros.com
6b52fba5-349e-4624-88cd-d790883fe4c4 Ken Bowers                    Ken.Bowers@office365itpros.com
558d8cbb-a5a2-4ea1-b950-0d0748ca5634 Jacko Winters                 flayosc_outlook.com#EXT#@office365itpro

Get-AzureADuser -ObjectId 558d8cbb-a5a2-4ea1-b950-0d0748ca5634 | ft mail, displayname, objectid

Mail               DisplayName   ObjectId
----               -----------   --------
flayosc@yandex.com Jacko Winters 558d8cbb-a5a2-4ea1-b950-0d0748ca5634

The Original email address can’t be used to sign into Teams either. Eventually, after a couple of days, Teams synchronized with Entra ID and the updated account details became visible in Teams. However, the updated account could not sign into Teams.

Come Home to Teams

Working with the Entra ID development group, the problem was diagnosed to due to the way Teams tries its best to bring a user to their home tenant. In the case of guest users, Teams uses the sign in address to locate the tenant and headed off to the wrong place. When using an explicit redirect to the tenant identifier, like https://teams.microsoft.com/?tenantId=c662313f-14fc-43a2-9a7a-d2e27f4f3478, the user can connect.

Obviously, there’s some work for Teams to do to cope when administrators assign new email addresses to guest accounts, but at least the problem is known, and Microsoft will no doubt fix the issue soon.

All this work for a few lines in Chapter 13 of the Office 365 for IT Pros eBook. It just goes to prove how much work and effort the writing team puts in to keeping content accurate, refreshed, and updated. Subscribe now to receive monthly updates of goodness.

Useful Update With Some Authentication Challenges

Without any fanfare, Microsoft released Version 2.0 of the Teams PowerShell module on March 4. You can download and install the new module from the PowerShell gallery. Here are the commands I used:

Uninstall-Module -Name MicrosoftTeams -AllVersions
Install-Module -Name MicrosoftTeams -Force -Scope AllUsers

The previous production version for the Teams PowerShell module was 1.1.6. The major enhancements in this release are:

• Support for cmdlets to manage Teams templates policies.
• The need to run the New-CsOnlineSession cmdlet to connect to the policy management endpoint (old Skype for Business Online endpoint) and download the policy management cmdlets into a session no longer exists. All the cmdlets are now in the Microsoft Teams module. You’ll experience a slight delay when a cmdlet needs to connect to the policy management endpoint for the first time in a session and later if a connection must be re-established.
• The module now uses the Microsoft Authentication Library (MSAL) rather than the Active Directory Authentication Library (ADAL) for authentication and authorization.
• Support for group policy assignment to users. According to MC243733 (9 March), Microsoft is rolling this feature out to be complete in mid-March.
• The Get-Team cmdlet is much faster at retrieving teams than it was in the past, and it comes with a progress bar (Figure 1)

Good as these enhancements seem at first reading, issues lurk, and some might ask why Microsoft could issue a new module with such evident challenges.

You can use a script as described in this article to keep your PowerShell modules updated. I usually run the script once monthly to make sure that I pick up any updates I haven’t gone looking for.

Authentication Problems

Moving to MSAL has some downsides. For instance, connecting to Teams using the AccountId parameter to pass a user principal name for an MFA-enabled account generates an error.

Connect-MicrosoftTeams -AccountId $O365Cred.UserName 
Connect-MicrosoftTeams : One or more errors occurred.
At line:1 char:1
+ Connect-MicrosoftTeams -AccountId $O365Cred.UserName
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : AuthenticationError: (:) [Connect-MicrosoftTeams], AggregateException
    + FullyQualifiedErrorId : Connect-MicrosoftTeams,Microsoft.TeamsCmdlets.Powershell.Connect.ConnectMicrosoftTeams

Connect-MicrosoftTeams : Integrated Windows Auth is not supported for managed users. See https://aka.ms/msal-net-iwa for details.

Basic authentication works as expected but the only reliable way I have found to sign into Teams with an MFA-enabled account (and all administrative accounts should be MFA-enabled) is to run Connect-MicrosoftTeams without a parameter and choose the account name from the login dialog. This isn’t suitable for batch processing, so if you need to run batch jobs to access Teams with PowerShell, use the older 1.1.6 release, scripts with other cmdlets if possible (for example, Get-UnifiedGroup), or the Graph API.

Update: Microsoft has released a preview version (2.1.0) of the Teams PowerShell module which works properly with modern authentication. It’s likely that this version will be pushed through to general availability quite quickly.

Microsoft is aware of the problems with authentication. We’ll update this post when further news appears.

Using the Teams Template Management Cmdlets is Not Easy

Microsoft added template policy management to the Teams admin center in late February 2021. The cmdlets to manage teams templates are in V2.0. However, their syntax is very much like Graph API commands rather than following normal PowerShell conventions. In addition, the cmdlets to create and update templates don’t accept PowerShell objects as input. Output is odd too, with JSON the favorite output format. The way the new cmdlets behave creates a learning barrier to surmount, which isn’t helped by some odd text in the documentation. For instance:

Within the universe of templates the admin’s tenant has access to, returns a template definition object (displayed as a JSON by default) for every custom and every Microsoft en-US template which names include ‘test’.

To begin, the Get-CsTeamsTemplateList cmdlet returns the set of teams templates in the tenant:

Get-CsTeamTemplateList

OdataId
-------
/api/teamtemplates/v1.0/d84de63f-26bb-4c8e-a438-fa5b99ac5c5a/Tenant/en-US
/api/teamtemplates/v1.0/9f90e23d-a361-4caf-ba79-9886adc93c68/Tenant/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.ManageAProject/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.ManageAnEvent/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.OnboardEmployees/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.AdoptOffice365/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.OrganizeHelpDesk/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.CoordinateIncidentResponse/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.CollaborateOnAGlobalCrisisOrEvent/Public/en-US
/api/teamtemplates/v1.0/retailStore/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.CollaborateWithinABankBranch/Public/en-US
/api/teamtemplates/v1.0/healthcareWard/Public/en-US
/api/teamtemplates/v1.0/healthcareHospital/Public/en-US
/api/teamtemplates/v1.0/com.microsoft.teams.template.QualitySafety/Public/en-US
/api/teamtemplates/v1.0/retailManagerCollaboration/Public/en-US

The first two templates listed are custom tenant templates. The others are the default set maintained by Microsoft. To make things easier to deal with, I extract the data for each template and put it into a PowerShell list:

$Templates = Get-CsTeamTemplateList
$Report = [System.Collections.Generic.List[Object]]::new() 
ForEach ($Template in $Templates) {
    $ModifiedBy = $Null
    If ([string]::IsNullOrWhiteSpace($Template.ModifiedBy)) {
       $ModifiedBy = "Microsoft" }
    Else {
       $ModifiedBy = (Get-AzureADUser -ObjectId $Template.ModifiedBy).DisplayName }
    $ReportLine = [PSCustomObject]@{
         Name           = $Template.Name
         Apps           = $Template.AppCount
         Channels       = $Template.ChannelCount
         Description    = $Template.ShortDescription
         Modified       = $ModifiedBy
         "Last Updated" = Get-Date($Template.ModifiedOn) -format g
         Id             = $Template.ODataId
         Scope          = $Template.Scope
         Visibility     = $Template.Visibility }
    $Report.Add($ReportLine) }

The extracted properties for a template object now looks like:

Name         : R&A Events
Apps         : 5
Channels     : 6
Description  : Improve your event management and collaboration.
Modified     : Tony Redmond
Last Updated : 26/02/2021 14:33
Id           : /api/teamtemplates/v1.0/d84de63f-26bb-4c8e-a438-fa5b99ac5c5a/Tenant/en-US
Scope        : Tenant
Visibility   : Private

To retrieve full information about a template, use the Get-CsTeamTemplate cmdlet. This takes the Odata.Id as its identity. Taking the id stored in our list we can do this:

$TemplateData = Get-CsTeamTemplate -ODataId $Report[0].id

The result is a bunch of JSON formatted information about the apps, channels, and settings configured for the template. Here’s a snippet:

{
  "templateId": "d84de63f-26bb-4c8e-a438-fa5b99ac5c5a",
  "displayName": "R\u0026A Events",
  "description": "Manage tasks, documents and collaborate on everything you need to deliver a compelling event.
Invite guests users to have secure collaboration inside and outside of your company.",
  "visibility": "Private",
  "channels": [
    {
      "id": "General",
      "displayName": "General",
      "description": "",
      "isFavoriteByDefault": true,
      "tabs": [
        {
          "id": "General.tab0",
          "teamsAppId": "0d820ecd-def2-4297-adad-78056cde7c78",
          "name": "Team Information",
          "key": "General.tab0"
        },
        {
          "id": "General.tab1",
          "teamsAppId": "com.microsoft.teamspace.tab.planner",
          "name": "Event Plan",
          "key": "General.tab1"
        },
        {
          "id": "General.tab2",
          "teamsAppId": "0d820ecd-def2-4297-adad-78056cde7c78",
          "name": "Meeting Notes",
          "key": "General.tab2"
        }
      ]
    },

Unfortunately, if you try to convert the JSON, it fails due to an invalid primitive.

$TemplateData = Get-CsTeamTemplate -OdataId $Report[0].id | ConvertFrom-Json
ConvertFrom-Json : Invalid JSON primitive: Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TeamTemplate.

The other cmdlets are:

• Update-CsTeamTemplate: Update the settings of a template.
• Remove-CsTeamTemplate: Deletes a template from the tenant.
• New-CsTeamTemplate: Creates a new template.

If you’re used to PowerShell, the syntax created for these cmdlets is not the norm. I think this is due to the familiarity the designers have with the Graph API. This makes the cmdlets harder to use, but it’s unlikely that you will use them often as it is easier to maintain templates policies through the Teams admin center.

Creating a New Teams Template

As an example of where you might want to use these cmdlets, consider the situation of a multinational tenant who wants to create the same policy in different languages. To do this, you:

Extract the properties of the source template policy to a text file.

Get-CsTeamTemplate -OdataId "/api/teamtemplates/v1.0/d84de63f-26bb-4c8e-a438-fa5b99ac5c5a/Tenant/en-US" > Template.json

Update the text strings in the file with translated strings and save the file. Then use it as input to the New-CsTeamTemplate cmdlet. The output after the command is the response from Teams:

New-CsTeamTemplate -Locale fr-FR -Body (Get-Content 'template-fr.json' | Out-String )

{
  "id": "b8e908a8-af13-42e6-86b9-eb33b8874fa5",
  "name": "Événements d\u0027entreprise",
  "scope": "Tenant",
  "description": "Gérez les tâches, les documents et collaborez sur tout ce dont vous avez besoin pour organiser
un événement convaincant.\r\nInvitez les utilisateurs invités à avoir une collaboration sécurisée à
l\u0027intérieur et à l\u0027extérieur de votre entreprise.",
  "shortDescription": "Améliorez la gestion et la collaboration de vos événements.",
  "iconUri": "https://statics.teams.cdn.office.net/evergreen-assets/teamtemplates/icons/default_tenant.svg",
  "channelCount": 6,
  "appCount": 5,
  "modifiedOn": "2021-03-10T08:56:55.1668488Z",
  "modifiedBy": "53f08764-07d4-418c-8403-a737a8fac7b3",
  "locale": "fr-FR",
  "@odata.id": "/api/teamtemplates/v1.0/b8e908a8-af13-42e6-86b9-eb33b8874fa5/Tenant/fr-FR"
}

Voila! We now have a French version of the template policy. This won’t be something you do often, but when you need to do it, the cmdlets might offer an alternative to creating the templates in the Teams admin center.

Normally we like including news of updated PowerShell modules in the Office 365 for IT Pros eBook. I’m not so sure about this update, but even so we will adjust our text.

The Sad Decline of Printing

One of the most common requests I get is “how can I print off the membership of a group or team?” On one level, it’s a rather old-fashioned request. Much to the chagrin of printing companies, people don’t print as often as they used to. When I worked at HP, I sat through many presentations about the wonders of printer technology and how ink jets work, but all that business about super-heated injection through microscopic holes of ink configured to an exact chemical specification isn’t quite as popular (or exciting) anymore.

How Apps List Group Membership

Applications list the membership of a Microsoft 365 group in different ways. OWA has quite a nice way of displaying group membership (Figure 1) but misses out that all-important print option.

Teams takes much the same approach in its Manage team option (Figure 2) and also neglects to include a printing feature. It’s a little surprising that Teams doesn’t support printing off membership information seeing that so many education establishments use Teams for classes. Then again, Teams pretty well eschews printing everywhere (clearly a member of the anti-ink faction) and leaves it to other apps to print off files like meeting attendance reports.

Neither OWA nor Teams reveal much about the members. Some details are exposed, like title and location (Teams), but not a lot.

Code Needed

The solution is to write some code to create a report about group membership. You could do this using PowerShell or the Graph API. There are many examples of PowerShell scripts to attack the problem that can be found on the internet (like this mega-script by Vasil Michev), but there’s always room for another.

The things to remember about Microsoft 365 Groups are:

• An owner must be a member.
• Owners and members are stored in two lists. Each list is a set of links back to individual accounts. Dynamic Groups also have two lists; the sole difference is that Azure AD periodically calculates the membership of each list by querying the directory.
• Microsoft 365 Groups support only tenant accounts and guest accounts as members. No nesting is allowed, probably because of the complexities it might introduce for applications which use Groups as a membership and identity service.

The setup of Microsoft 365 Groups mean that they are much easier to process than Exchange distribution groups. We need to:

• Fetch all the members and fetch the properties of each member that we are interested in.
• Do the same for the owners.
• Generate a report.

In my case, I decided to generate a HTML format report (Figure 3) and a CSV file. The report is for printing, the CSV file is to analyze membership as needed. Because we’re using PowerShell, it’s easy to include or remove properties for each member. I chose to include name, user principal name, email, title, department, office, city, post code, country, type (tenant or guest account), and member type (owner or member). The bottom of the report contains some summary detail such as the number of members, owners, and guests, the description of the group, and when it was created.

You can download the script from GitHub. The code is very straightforward. Feel free to improve it as you wish. And if you want a report detailing all the Microsoft 365 Groups and Teams in your tenant, check out the Groups and Teams Activity Report.

And if you’d like to create a report of the membership of every group/team in your tenant, check out this article.

Want to understand how to use PowerShell with Microsoft 365 Groups and Teams? Read Chapter 13 of the Office 365 for IT Pros eBook!

Check that Guests are Really Wanted

Microsoft is previewing the ability to create an Azure AD Access Review to cover guest access to every group (and team) in a tenant. The idea is that group owners are asked to approve or deny the access granted to guest users to their groups. With the caveat that all previews come with rough edges, the review works well enough for organizations to assess if the feature is valuable for them.

A challenge facing every GUI is how to achieve the balance of usability for both large and small organizations. Getting an oversight of an access review for guests in 27 teams in a small tenant makes certain demands on the GUI to make the data comprehensible and enable administrators to figure out where the overall review is at. Doing the same for a large tenant where reviews might be ongoing for thousands of teams poses a different test. However, the Identity Governance section in the Azure AD admin center has just one interface to manage access reviews (Figure 1).

When an access review is viewed through the Azure AD admin center, you see10 groups at a time (it’s a preview), but even if the admin center showed a hundred groups, paging through large numbers of groups to find what’s happening in an individual review can be painful.

Using the Graph API for Access Reviews

Which brings us to the Graph API for Azure AD Access Reviews, the basis for DIY management of access reviews. To test how the API worked, I wrote a PowerShell script to find the review for all groups and create a report of the review decisions made to date.

The steps taken in the script are:

• As usual when using PowerShell to interact with the Graph, create a registered app in Azure AD. Note the app identifier, tenant identifier, and app secret. The app must be assigned the AccessReview.ReadWrite.All permission. I also assigned the Group.ReadApp permission to allow the app to retrieve details of Azure AD groups.
• Use the app identifier, tenant identifier, and app secret to get an access token.
• Read the set of access reviews known in the tenant and find the one used for guest access to all groups. This will result in a review instance.
• Find the groups within the scope of the review. These are called instances. In other words, an instance of the overall review applied to a specific group.
• For each instance, retrieve the decisions made for the guests in the group. It’s here that I retrieved the group display name to make it easier to understand the output.
• Store details of each decision (verdict). The verdict will be Deny, Approve, or NotReviewed. A verdict comes with the name of the person who decided and when they decided. If the policy dictates, a justification is also present.
• Capture the details of the verdict out in a PowerShell list.
• After processing all instances, write the verdict data out from the list to a CSV file and give an overall report on screen.

Figure 2 shows the output at the end of the script.

The script generates a CSV file to allow the decision data to be analyzed in whatever way you wish. Piping the data to the Out-GridView cmdlet is a good way to get a quick overview of the current state of reviews across all groups (Figure 3).

Download the Script

The sample script can be downloaded from GitHub. It doesn’t exercise all the functionality available in the API. For example, to accelerate the process of completing the review, you could look for outstanding reviews of guests in groups and call the acceptRecommendations API to accept the automatic recommendations as made by Azure AD. However, as I explain here, accepting automatic recommendations is not always the wisest thing to do, especially when Azure AD makes decisions based on limited data.

You’ll find full details about Azure B2B collaboration (the basis of guest access to Teams and Groups) plus a ton of insight about how guest access works in the Office 365 for IT Pros eBook. And because we keep the book updated, new developments like the Azure AD Access Review for all guests in a tenant are mentioned there too.

Edge Now the Preferred Microsoft 365 Browser

Even if you spend time reading all that’s posted to the Microsoft Technical Community, you might have missed the August 17 post announcing that Microsoft 365 will soon end support for Internet Explorer 11. In a nutshell, support in Teams finishes on November 30, 2020 while August 17, 2021 is when support ceases in other Microsoft 365 browser apps like OWA, Planner, To Do, and Yammer plus all the administrative portals.

Microsoft’s advice is unambiguous: use Edge (the Chromium-based version). The legacy (original) version of Edge stops getting security updates on March 9, 2021. Curiously, Microsoft refers to legacy Edge as a “desktop app” instead of a browser, but I guess that’s just a matter of semantics.

Teams First to Dump Internet Explorer

While the other Microsoft 365 apps have a year left to support Internet Explorer, Teams stops in just over a quarter. Microsoft doesn’t explain why they want to accelerate deprecation of IE11 support in Teams, but it might be linked to the lack of calling and video support in IE11 for Teams meetings. Given the massive upswing of demand for Teams meetings since the pandemic started, it’s unsurprising that Microsoft would want to make sure that Teams users avoid Internet Explorer.

I doubt the demise of IE11 will cause many problems for Teams users. Mac users are more concerned about Safari support for Teams (audio is supported in meetings, but video is not). Linux users who don’t use the Teams Linux client have Chrome and Firefox browsers to choose from.

Another point to consider is that Teams uses a three-week update cycle to make new functionality available to clients. The longer IE11 remains supported, the further it falls behind in terms of the new meeting functionality recently introduced for Teams.

IE Gets More Time in Other Microsoft 365 Apps

Microsoft 365 has a bunch of browser clients, some of which are refreshed almost as quickly as Teams is (OWA is an example). The longer time allowed before the Microsoft 365 apps stop supporting IE11 might be linked to the relatively straightforward nature of the apps. SharePoint Online and Stream both support IE11 only in document mode, perhaps because of the video playback capabilities available in both clients. Forms, on the other hand, also supports video playback, but proclaims itself to be optimized for IE11.

Move Now

No matter what the reason is, the simple fact is that IE11 has a limited lifetime inside Microsoft 365. It’s time to move any IE11 diehards to one of the supported browsers, unless they enjoy discovering just what Microsoft means by “customers will have a degraded experience or will be unable to connect to Microsoft 365 apps and services on IE11.”

Degraded could be anything from “a feature just doesn’t work” to “a feature works slowly.” Being unable to connect is more fundamental but could come about through something like a change in conditional access policies which IE11 can’t handle. In either case, the experience is unlikely to be anything to write home about. Time to move. And soon.

The September 2020 update for the Office 365 for IT Pros eBook will remove most mentions of IE11 (there are twelve right now). It’s one of the nice things about having a book that’s updated monthly. When Microsoft changes, we do too.

Is Teams Really a Memory Hog?

Teams often gets tagged as a performance hog, with people pointing to the huge amount of memory the desktop client grabs on Windows and the constant ticking over of CPU cycles when the client seems to be inactive. Like many assertions, there’s a mixture of truth and fiction mixed in here.

Teams is built on the Electron platform. Some hold that this is the foundation of Teams demanding so much memory because of the need to load so many libraries. It’s true that the decision to use Electron as the development platform incurs some cost. But any platform brings some penalty, and the upside of using Electron is that Teams gets a client that works in much the same way on Windows, Mac, Linux, and browsers.

Chromium Memory Management

Chromium is part of Electron. It’s used by Teams for rendering the user interface and text. As Teams is an intensely graphical application, a lot of rendering happens, and memory is consumed. An interesting Microsoft article explains how the Chromium memory model works for Teams. Essentially, if a workstation has free memory, Teams will take some of that memory to cache data and keep structures in memory instead of going to disk. As demand grows from other applications, Teams releases memory. It’s therefore an expected condition to see the Teams processes occupy a lot of memory, even when apparently idle.

Tracking Memory Usage

Microsoft’s article says that because the desktop and browser clients share the Chromium memory management model, much the same memory usage profile is seen. I tested this assertion and found that it’s true. Figure 1 shows the Windows Task Manager report that the browser client loaded into Edge Chromium takes up 775 MB while the processes which compose the Teams desktop client need 887 MB. The Outlook desktop client, another application often criticized for its size, looks svelte in comparison.

In both cases, the data was after a sustained period of activity. Memory usage grows and declines as Teams features are accessed. For instance, loading a recording of a live event into the browser rapidly grew usage past 1 GB. Switching tenants, moving between apps (including the basic apps like the Activity feed, Files, and Calendar), and accessing chats and channel conversations all cause a demand for memory. Meetings are the most demanding app in terms of consumption due to the need to process audio and video feeds. The lowest reported memory I have seen over several days of monitoring was circa 250 MB. Your mileage might vary depending on how you use Teams and the configuration (hardware and software) of your PC.

Memory Better Than Disk

Using 1 GB of memory, even on a 16 GB Surface Book 2, seems an awful lot for a single application. But using available memory to cache and manipulate data usually results in better performance, especially if an application can avoid reading data from disk. Even the fastest SSD is much slower than memory.

Of course, memory is not the only thing to consider when looking at an application’s performance. Teams has had its challenges in other areas, notably when rendering video or using a high-definition external monitor. When I plug my PC into a HP Envy 34 inch monitor at 1080p, memory usage increases slightly for both Teams and browsers; scaling up to drive a 4K monitor demands more memory and GPU cycles.

Keep Applying Updates

Keeping performance within acceptable limits is always likely to be a challenge, especially when the application functionality changes often, which is the case with Teams. For instance, we’ve yet to see how the new 7 x 7 large gallery view and the Together mode for meetings perform across a variety of workstations. Maintaining acceptable performance is one of the reasons why Teams updates its clients so often and why it’s important to make sure that client workstations get those updates. It’s also important to apply Windows and driver updates to workstations.

Keeping the good news until last, memory usage by Teams and other Chromium-based applications dropped on my PC after applying a number of recent changes, including the 2020-07 cumulative updates for the .NET framework and Windows 10 1909 and an upgrade to version 84 of Chromium. Teams was also upgraded to Version 1.3.00.19565. Initially I thought that an impressive drop had occurred when I saw Teams using 306 MB (Figure 2), even after switching between tenants, posting some messages, and attending a meeting.

Memory usage tends to grow over time and Teams is no exception. The 306 MB grew to about 750 MB as the day progressed and different events occurred, including frequent tenant switches and peak usage topped 1.2 GB after the PC resumed from hibernation and Teams restored itself (and probably checked the six tenants I connect to – perhaps due to cache synchronization). However, in normal use, memory usage never went higher than 800 MB and normally hovers around 625 MB. That’s still hefty, but less than before.

I’m not quite sure which update had most effect, but I’m thankful that the Teams performance profile shows some signs of improvement. Again, your mileage might vary depending on the work you do and the number of tenants you connect to.

Need more information about how Teams really works? Check out the Office 365 for IT Pros eBook and the detail included there.

Here’s my quick video review of the Plenom Busylight. It’s a small LED light that plugs into a USB port on your computer and changes color to reflect your presence status in Teams, Skype, Zoom, Jabber, or several other UC clients.

The executive summary: great device, well worth US$50 or so to help communicate your presence status to the partners, spouses, small children, and passers-by who may be in, around, or near your working-under-quarantine location.

Now, a couple of production notes. I wanted to record the video using my Logitech desktop webcam. It’s a C920, by no means the latest and greatest, but I didn’t want to fool around with finding a mount or tripod for my iPhone. My first thought was to use TechSmith’s Camtasia because it’s usually my go-to Windows tool for video work. I didn’t have it installed, though, so a little rummaging around led me to Logitech Capture, a surprisingly nice free utility that allows you to capture video from Logitech desktop webcams. It includes basic composition and exposure controls and the ability to simultaneously record with two cameras (which I didn’t test). For free, I was delighted with it; it did exactly what I wanted done with a very small learning curve. Pancake the cat, on the other hand, remains undecided.

Writing about a USB light doesn’t seem like the kind of thing serious book publishing people like the Office 365 for IT Pros team should be doing. But we have a lighthearted side too…

More Traffic to Clutter Activity Feed

This might be heresy, but the Teams activity feed can be as annoying and cluttered as any email inbox. Notifications flow from channels and mentions, all demanding attention and potentially a response. Obviously, some control needs to be exerted over the activity feed as teams and channels grow otherwise the feed will swamp users.

The notifications section of Teams settings in all clients allow users to control the notifications which appear in the activity feed. For instance, you can decide that you only want to see notifications when people mention you in conversations, or when messages are posted to personal chats, but not for channel or team mentions. If your activity feed is getting out of hand, it’s a good idea to tweak your notification settings and take back control.

Automatically-Generated Trending and Suggested Notifications

Last year, Microsoft “trending” and “suggested” notifications. These notifications are generated automatically based on the signals captured in the Microsoft Graph from the teams a user belongs to. The idea is to create more involvement in Teams by letting users know what’s happening by highlighting conversations in the activity feed. By itself, there’s nothing wrong with the idea. It encourages greater participation in conversations and might bring something to the attention of users that they would otherwise miss. Specific icons in the activity feed mark these notifications. Figure 1 shows the (lightbulb) icon for a suggested notification.

Office 365 generates the automatic notifications based on information captured in the Microsoft Graph. The more activity happens in Teams, the better the information available about user behavior and habits for the Graph to analyze and the more valuable the automatic notifications will be.

The Downside

The downside of the extra notifications is that they might clutter the activity feed of uses who have tuned their notification settings to meet their needs. If you’re in this category, it’s easy to disable these notifications by switching off “Trending” in the notification settings in the Teams client (Figure 2). The mobile client looks different, but you can make the same change.

Tenant-Wide Disablement

And if you really don’t like the auto-generated notifications, you can disable them for the entire tenant in the Org-wide settings section of the Teams admin center (Figure 3). This overrides settings for individual users and Teams won’t include trending or suggested notifications in their activity feeds.

Keeping an eye on the detail of small (and often unannounced) changes in Office 365 can be a royal pain for tenant administrators. Which is why it’s such a good idea to subscribe to the Office 365 for IT Pros eBook.

Teams Powers Ahead Despite Service Glitches

Updated on April 3 with details of Teams usage at the UK National Health Service and usage data for Google Meet.

Anyone using Teams over the last few days has probably been aware that the service has experienced some reliability problems. Commentators felt that the problems were provoked by the upsurge in demand due to people moving to work from home because of the Convid-19 crisis, especially to use Teams audio and video meetings as a replacement for in-office gatherings.

That feeling was confirmed by data released by Microsoft on March 19. The number of Teams daily active users is now 44 million, a growth of 12 million over the last week (when many countries implemented large-scale restrictions), and an increase of 24 million since the last public figure released by Microsoft in November 2019. Microsoft defines an active user as someone who performs an intentional action in Teams over a 24-hour period. For instance, posting a new conversation, starting or replying to a personal chat, joining a meeting, or opening a document stored in SharePoint Online or OneDrive for Business from Teams.

The spike in growth is clearly seen in Figure 1, which charts growth from 13 million in July 2019 to 44 million today.

The UK National Health Service (NHS) is an example of how organizations quickly adopted Teams during the Covid-19 pandemic. After being given free licenses from Microsoft, the NHS web site reports that during the March 22-28 period, NHS employees used Teams for:

• 973,072 private chats
• 66,736 group chats
• 76,173 private calls
• 68,365 meetings

The site says that a peak of 28,148 NHS employees used Teams daily. Although the NHS is a huge organization with 1.4 million employees, it’s impressive that Teams usage ramped so quickly.

Lots of Teams Meetings

The impact of users participating in online Teams meetings is seen in the 900 million calling and meeting minutes consumed daily. Although massive, that’s only 20 or so minutes per active user, which indicates that this number is likely to increase as work from home takes more effect and people learn how to take full advantage of Teams.

On April 9, Microsoft said that Teams handled a new record of 2.7 billion meeting minutes on March 31, 2020. They also noted that the percentage of calls with video grew from 21% to 43% in the period March 2 to 31 (Figure 2) and that the number of Teams videos processed by Stream had increased five fold in the last month.

By comparison, on April 2, Javier Soltaro (head of G Suite), said that Google Meet serves 2 billion minutes of video calls daily. He noted that this equates to 3,800 years of meeting daily. Chuck Robbins, CEO of Cisco said that WebEx hosted 14 billion meeting minutes in March 2020, with a peak of 4.2 million meetings daily, a figure that had doubled since January. WebEx registered 324 million attendees in March. In the same period, Zoom claimed 200 million daily meeting participants, both paid and free.

It’s impossible to assess the usage of the various platforms because not enough detail is made available by any vendor to compare different aspects such as average length of meetings, the number of users involved in meetings, distribution between corporate and personal use, and so on. But it’s for certain that the numbers for online meetings are big and growing.

Large Organizations Use Teams

Interestingly, Microsoft hasn’t updated the number for how many organizations use Teams since March 2019, when it was 500,000. Instead, they focus on how large organizations use Teams, possibly to emphasize the enterprise credentials of the application. Microsoft says that 20 customers have more than 100,000 Teams users while the number with more than 10,000 users has grown from 150 to 650 (Figure 3). These data indicate that projects are moving from the kicking-the-tire phase to full deployment.

Microsoft highlights companies like Ernst & Young, SAP, and Pfizer as organizations with more than 100,000 users, while Accenture retains its position as the world’s largest deployment at 440,000 users. 93 of the Fortune 100 use Teams. This number is up two from a year ago, so the question is who are the seven Fortune 100 companies not using Teams?

Remember that the limits for individual teams, personal chats, meetings, and live events are much smaller than 100,000, so Microsoft has some work to do to accommodate all the needs of very large organizations.

If you’re one of the new tenant administrators or architects who needs to work out how to deploy and manage Teams effectively, why not take out a subscription to the Office 365 for IT Pros eBook? We have over 250 pages of Teams content in the book.

Teams to Skype Chats and VOIP Calls Bridge the Divide

Update May 19: Microsoft has run into some problems with the early implementation of the Skype consumer interoperability feature and has delayed the roll-out to make some code changes. The new target date for completion is the end of June.

Office 365 Notification MC205801 (Microsoft 365 roadmap item 53935) published on March 7, 2020 brings news that Teams is extending its federated chat capabilities to include Skype consumer users. When enabled, Teams and Skype users can have personal chats and VOIP calls with each other. Teams users can search for Skype users with their email address (not Skype ID or phone number) while Skype users need to know the user principal name of a Teams user.

Being able to communicate with Skype consumer users closes a gap in the Teams chat story that will help Skype for Business Online users move to Teams in advance of the July 31, 2021 deadline for the shutdown of Skype for Business Online.

Common Roots in the Media Stack

Apart from building out the Skype for Business Online migration story, this update shouldn’t be a huge surprise because Teams and Skype consumer share many components like the media stack. Once Microsoft had rolled out native federated chat for Teams users in different Office 365 tenants, Skype was the natural next stop.

Enable Under External Access

Unlike many new features Microsoft introduces in Teams, Teams-Skype interoperability is disabled by default. To allow users to chat and call each you, you must go to the Org-wide settings access section of the Teams Admin Center, select External access, and then move the Users can communicate with Skype users slider to on (Figure 1).

Allow an hour or for Teams and Skype learn of their new ability to interact before trying to connect. To support federation, Teams users must be configured in TeamsOnly mode. This won’t be an issue for tenants that have always used Teams, but could be a problem for those still migrating from Skype for Business Online.

Searching for Connections

Teams users can search for people in Skype by typing their email address (the address associated with their Windows Live ID or Microsoft Services Account) into the search bar or by adding them to a chat. Like for federated chat, Teams won’t find the address locally but can if you tell it to search externally.

Skype users can search for Teams users with their email address. When the chat connects to Teams, the Teams user has the option to block or accept the connection (Figure 1). If the user accepts, the connection is made, and the two users can chat and call each other. If the Teams user chooses to block the connection, no further attempts to connect by the Skype user will be accepted.

Meetings are unsupported on either platform and neither the Teams nor the Skype consumer user can see details of each other’s presence.

Given that Skype consumer users don’t belong to any organization, the likelihood of spammers connecting to Teams users exists. The Show messages link allows the Teams user to see whatever message the Skype user sends to set up a conversation as an aid to decide if they want to accept the connection (just like a LinkedIn request to connect!).

Microsoft recommends that Skype users should use version 8.58 or above. I tested with Skype version 8.56.0.102 and things worked OK. Even so, I will upgrade as soon as the Windows Store offers an update for Skype, just to make sure that I have all available bug fixes.

The Nature of Chat

Unlike Teams native federated chat, Skype to Teams chats are text-only and don’t enjoy the full range of text formatting, @mentions, and emojis that liven native chat between Teams users. However, if you input text emojis into Teams, Skype will interpret and change those emojis to graphics. In the conversation shown in Figure 3, inputting into Teams shows up as a wink in Skype.

Teams gathers compliance records for interactions with Skype users. Those records can be searched for using an Office 365 content search and included in an eDiscovery case. The messages posted by Skype users are also monitored by Office 365 supervision policies and Microsoft 365 communication compliance policies.

Another Step for Skype for Business Online Users

Slowly but surely, Microsoft is peeling away any reason why Skype for Business Online users want to stay on that platform. Connecting with consumer users is important because it allows consumers to be brought into the Teams ecosystem. Another item is marked off on the migration checklist.

Planning a migration from Skype for Business Online is a difficult and time-consuming task. Make it easier by subscribing to the Office 365 for IT Pros eBook and learn from our experience.

Included in Microsoft’s February wrap-up announcement of new features in Teams is this gem:

Automatic creation of an org-wide team

Streamline the process of bringing everyone together in your small to medium-sized business. All new tenants with 5000 users or fewer will start with an org-wide team. Learn more about org-wide teams and related best practices here.

Org-wide teams are useful ways to share information like organizational announcements with everyone. Currently, these teams can only be created by administrators if a tenant has 5,000 users or less (the threshold increases to 10,000 in November 2020). A tenant is limited to five org-wide teams. In one way, an org-wide team might be regarded as filling the role that Yammer often plays in larger organizations.

On the surface, it seems perfectly reasonable for Microsoft to create an org-wide team for new Office 365 tenants to get their collaboration juices flowing and encourage people to use Teams. But it’s a horrible idea for many reasons. Here’s a few that come to mind.

Don’t Mess with My Directory

First, Microsoft doesn’t own the tenant directory and should not create user-visible objects in the directory without prior approval from the tenant. Microsoft has been down this road before in 2017 when some bright spark came up with the notion to create Office 365 groups for managers and their direct reports. That idea died quickly after customers pointed out that they didn’t want a heap of new groups created by Microsoft.

Anything that uses tenant data (and this feature does because it must read information from the directory to create the org-wide team) should be an opt-in feature.

Office 365 is a Journey

Second, new Office 365 tenants often grow into the array of functionality available in the service. They might start by moving their current email workload to Exchange Online, then embrace document management with SharePoint Online and OneDrive for Business, then tell users about Planner and To-Do, and so on. It’s up to a tenant to decide what they use from Office 365. After all, tenants must train and support their users.

Throwing Teams into the Office 365 mix without asking first is asking for trouble. A tenant might be committed to Yammer as its collaboration platform, or have decided that Slack is a better choice for chat-based communication. Or even decided that they’d prefer to stick with email until the new-fangled cloud technology is better understood.

Communication Barriers Exist within Organizations

Third, it’s entirely possible that organizations don’t want to have org-wide communications and see no need to “streamline… bringing everyone together.”. Or that they want to control org-wide communications using different methods (like email). Do organizations with many frontline workers automatically want everyone to communicate via Teams? It’s an open question.

A company might even want to use techniques like information barriers to control the flow of communications between different parts of the organization. Users will then be ejected from the org-wide team because of policy violations, which nullifies the reason to have an org-wide team.

Microsoft’s automated processes to create new org-wide teams have zero knowledge of the culture, structure, and organization of a new tenant, which is a very good reason why they should leave cross-organization communications for the company to decide.

Good Ideas Sometimes Turn to Dust

Good ideas that seem to be based on impeccable logic often don’t survive the transition from brainstorming sessions to actuality. I know Microsoft wants to popularize Teams and drive its user base to much higher levels. But doing stuff like this is not the right way to proceed. I hope Microsoft sees the light and withdraws this poorly thought-through idea.

Old Reply with IM Feature Works with Teams

The new Share to Teams and Share to Outlook features announced (still not generally available) by Microsoft have attracted a lot of attention, but Outlook’s Reply with IM feature seems to fly under the radar with little awareness (and no Microsoft documentation). Let’s try and redress the balance.

The idea is simple. You receive an email and instead of having endless rounds of to-and-fro replies, you take the conversation to an instant messaging platform that’s more suitable for an interactive debate. Reply with IM has been around since Outlook 2010. In those days, the IM connection was to Office Communications Server, duly replaced by Lync and then Skype for Business. Inside Office 365, depending on your configuration, Outlook ProPlus or OWA will connect to Skype for Business Online or Teams.

Reply with IM from Outlook

I used Office ProPlus Version 2002 to test Reply with IM. I doubt this feature will work with Outlook 2016 or 2019, and it seems like it didn’t work so well with earlier versions of Office ProPlus.

The Reply with IM option is found in the […] menu of Outlook’s read message window (Figure 1) or in the Respond section of the Outlook menu bar. Reply with IM launches a conversation with the sender while Reply All with IM includes all the recipients in the conversation.

Prerequisites

To use the feature with Teams, a user must be:

• Configured in TeamsOnly mode. The value of the registry key HKCU\Software\IM Providers\DefaultIMApp should be “Teams.” This value is set when you choose to register Teams as the chat app for Office in Teams settings (Figure 2).
• Signed into the Teams tenant where the users you want to chat with are homed. In other words, if you want to chat with someone in your home tenant, make sure that you sign in there.

Some Gotchas with Conversation Transfer

There are some details to remember when using Reply with IM:

• If an existing chat with the recipients exists, Teams will use that. Otherwise it creates a draft chat.
• Teams doesn’t take the message subject and use it to name the chat, even when a new chat is created. In fact, apart from the recipients, nothing is copied from the message into the chat, so you’ll have to cut and paste information from the message body into the chat to provide a context for the conversation.
• Federated chat (external access) isn’t supported by Reply with IM. If you use Reply All with IM and a guest user is among the message recipients, they are dropped from the conversation.
• If one of the message recipients is blocked for chats by Teams, you won’t be able to send messages to the chat.
• If you are signed in as a guest to a Teams tenant where an external recipient is homed, Reply with IM can launch a conversation with that person.
• Rather bizarrely, if a shared mailbox is in message recipients, Teams includes the shared mailbox in the chat (you can clean things up by removing the shared mailbox from the chat).
• If the message recipients contain a group, Teams drops the group when it starts the chat.

It seems like the Outlook developers might do a little work to smoothen the rough edges that Reply with IM sometimes exhibits when used with Teams, but that being said, this is a useful little-known feature that deserves more attention from users too.

It’s the detail that makes technology interesting. In this case, a feature that’s been around for a long time has a new lease of life because it bridges a gap between Teams and Outlook. Learn more in the Office 365 for IT Pros eBook, where there’s enough detail for anyone’s taste.

A Small Delay in Making New Channel Tab Available

In May 2019, Microsoft posted Office 365 Notification MC180213 to tell tenants that a refreshed version of the Teams Files Channel tab was rolling out (the new tab was also featured at the SharePoint North America conference that month). The Files channel tab is the interface between Teams and SharePoint Online and it’s an important part of the Teams collaboration story. Tenants expected to see the new tab in June 2019, but it never showed up. Microsoft isn’t saying why the tab was delayed so much, but the need to improve performance might be the reason why.

Old Files Channel Tab

In any case, the good news is that the old Files Channel tab experience (Figure 1), complete with its advantage of simplicity and disadvantage of missing functionality, should soon be no more.

New Files Channel Tab

The new experience delivers a Files channel tab (Figure 2) with more functionality. You’re able to pin documents to the top of a folder and use features like check-out and check-in. Unlike the old tab, the view is customizable. In Figure 2 you can see that I’ve added columns to display retention labels and sensitivity labels (still in preview for SharePoint Online) and that values for these labels appear in the view. You can also see that a date column is formatted using colors.

Sharing is Caring

The Copy link option picks up the work spearheaded by OneDrive for Business to have a common sharing experience across Office 365. When you create a link (to the folder belonging to a channel). It is a sharing link of the form https://office365itpros.sharepoint.com/:f:/r/sites/O365ExchPro/Shared%20Documents/2020%20Edition?csf=1&e=zXeeRZ (Figure 3).

The type of links that can be created depend on the organization’s sharing policy for SharePoint Online, and include:

• Anyone with the link (Anonymous sharing). This type of link will expire if the organization configures a link expiration period for anyone links. You can set a password for the link so that those who try to use it must also know the password, and you can set the link to allow editing.
• People in your organization. The link can be read-only or allow editing.
• People with existing access (like team members). These people use the access they already have to work with the content in the folder.
• Specific people. You enter the email addresses of the people you want to allow access to the folder. You can make the access read-only or allow editing.

After you create a link, you can copy it to the clipboard and share it with intended recipients using Teams or email.

What’s Missing in the New Tab

Mostly when I work with SharePoint Online, I use the browser interface. The Teams channel tab is fine for day-to-day work, but I miss a couple of features that I use extensively.

• You can’t access the version history of a document.
• You can’t edit the properties of a document to assign a retention label or update custom properties.
• You can’t share an individual document. Maybe it’s an attempt to force people to share documents in chats or channel conversations, but that’s a warped perspective because most Office 365 (and other) users don’t use Teams.

The easy workaround is to use the Open in SharePoint option to perform these and other actions, like access to Power Automate (Flow) and Power Apps. Although I understand why the Teams developers have chosen to keep the tab simpler and less cluttered than the SharePoint interface, I’m sure there will be some who are disappointed that the new channel tab is not equivalent to what’s available in SharePoint.

Subscribe to the Office 365 for IT Pros eBook to make sure that you stay up to date with all the developments in Microsoft’s cloud office suite.

An Unclear Announcement About Legal Holds for Teams

The wording of Microsoft’s February 2 announcement (MC202846) that legal hold is now supported for Teams private channels might have confused some. The announcement starts with “we have begun rolling out legal hold for Microsoft Teams,” which isn’t accurate. It has been possible to put the group mailboxes used by Teams on legal hold via PowerShell or by including group mailboxes in holds owned by eDiscovery cases for quite a while. For example, to set a group mailbox on litigation (everything is retained hold), you can run the command:

Set-Mailbox -Identity MyTeam -LitigationHoldEnabled $True -GroupMailbox

The real meaning of MC202846 is that holds are now supported to control the compliance records created for conversations in private channels. As noted in this article, private channels don’t have a group mailbox, so the same capture mechanism for compliance records used for regular channels doesn’t work.

Holding Teams Private Channel Conversations

When messages are posted to regular channels, the Microsoft 365 substrate captures copies of the messages and stores them in the Team Chat folder of the group mailbox belonging to the team. The lack of a group mailbox for private channels means that the substrate stores compliance records for Teams private channels in the mailboxes of all the members of the private channel, which is the same approach taken to capture records of 1:1 and group chats. Therefore, compliance records for a team are divided as follows:

• Messages posted to Teams regular channels. Stored in the Team Chat folder of the group mailbox belonging to the team.
• Messages posted to Teams private channels. Stored in the Team Chat folder of the mailboxes belonging to all private channel members.

Team Chat is a sub-folder of the Conversation History folder. “Team Chat” is the English language name. If you want to be sure that you’re accessing the right folder with PowerShell, check the folder type. For example, I often use a command like this to discover when the last compliance record was written to a mailbox:

Get-ExoMailboxFolderStatistics -Identity O365ITPros -FolderScope ConversationHistory -IncludeOldestAndNewestItems | ?{$_.FolderType -eq "TeamChat"} | Format-Table Name, ItemsInFolder, NewestItemReceivedDate   
                                       
Name      ItemsInFolder NewestItemReceivedDate
----      ------------- ----------------------
Team Chat          2469 4 Feb 2020 16:03:05

Teams Compliance Records Are Copies

Despite the efforts of some backup vendors, aided and abetted by a lack of understanding about Teams compliance records, it is untrue that messages stored in Exchange mailboxes are real Teams message data that are a good backup source. The Teams message store is in Azure CosmosDB, and the mailbox items are incomplete copies created as Outlook mail items. The upside is that because the compliance records exist in Exchange mailboxes, they are indexed and therefore discoverable by Office 365 content searches, available for retention processing, and suitable targets for holds.

Distinguishing Teams Private Channel Messages

The problem with storing copies of private channel messages alongside copies of personal data is how data governance processing can distinguish the items. After all, you probably don’t want the retention policy set for personal chats to apply to private channel messages. To solve the problem, compliance records for private channels are marked with a different source, allowing components like the Managed Folder Assistant to ignore private channel data when processing retention policies.

Code in the Managed Folder Assistant also handles ELC (Electronic Lifecycle) processing, a fancy name for checking if items must be retained because they come within the scope of a hold. ELC checks items before they are removed from a mailbox and keeps a copy if required by a retention policy or hold. Microsoft has updated the hold logic to allow processing of private channel items, which then means that private channel items now support holds.

Clients can’t get at the Team Chat folder to view or remove items (as seen in Figure 1, you can use MFCMAPI to look at the items), so all compliance records for private channels created since their introduction are still in group mailboxes. In effect, a hold existed for these items. After the update rolls out, holds placed on the mailboxes of members of a private channel will include the messages posted to that channel.

Holding Private Channel Messages

Because all members of a private channel store copies, it’s enough to put the mailbox of a single member of a private channel on hold to impose the hold on the messages posted to that private channel. The obvious flaw in this strategy is that if the chosen member leaves the organization and their mailbox is deleted, the hold lapses. The workaround is to include the mailboxes of two, or three members in the hold, but what happens if all the chosen members leave?

It would be better if the addition of a group mailbox to a hold created implicit holds on all private channel content stored in member mailboxes, but that’s not the way things work. At least, not for now.

Compliance is such an interesting topic! Seriously, when you need to understand Office 365 data governance, consider leveraging the wealth of experience in the Office 365 for IT Pros eBook.

New Teams Scheduling Form Resembles Outlook

Office 365 Notification MC200243 published on 15 January 2020 brings the news that Teams is getting an “enhanced scheduling experience,” which is a long-winded way of saying that Microsoft has upgraded the form used to schedule a meeting in the calendar app in the Teams desktop and browser clients. The new form is described in Microsoft 365 roadmap item 54364. The code will roll out to tenants in mid-February 2020.

New Features in The New Form

According to Microsoft, the new form (Figure 1) retains previous functionality (always good) and adds:

• An improved view of available time (you can see the suggested times in Figure 1).
• The ability to add required and optional attendees. You can add tenant users, guest users, and other external recipients (by entering their email address) as meeting attendees.
• A room picker to select from room mailboxes defined in the tenant. Unlike OWA and Outlook mobile, the form doesn’t use the Outlook Places service to display location information about rooms.
• Toggle to set an all-day event.
• Time zone picker.

The form also includes a Scheduling Assistant tab (Figure 2) to display availability information for the attendees.

When a meeting is scheduled, Teams adds the information about the online meeting to the request and posts it to either:

• Attendee calendars, if no channel is associated with the meeting, the meeting request is sent from the mailbox of the meeting organizer to attendees, who can then RSVP to the invitation.
• As a new conversation in the associated channel, if one is assigned (Figure 3). The meeting request is sent from the group mailbox of the team that owns the channel. People invited to the meeting (including guests and external recipients) can still attend, but they can’t access the channel conversation or other resources belonging to the team that owns the channel.

Like Outlook – Almost!

The new meeting form brings Teams up close to parity with the meeting schedule experience in Outlook desktop or OWA. There’s more properties of a meeting (like category) to set in Outlook and OWA makes good use of the map and location data to show attendees where meetings will take place. Both Outlook clients can display multiple calendars, including those belonging to groups, and Teams doesn’t handle the tricky details of calendar delegate and management.

But from the perspective of an average Office 365 user, the difference between Teams and Outlook is down to a few minor points that won’t be noticed by most people. The new form is a good change because it will help those who want to move their focus for internal communications away from email to Teams handle meetings better than before. Whether it will help prise Outlook away from those who remain dedicated to Outlook’s calendar remains to be seen.

Need more information about Teams or Office 365 in general? Look no further than the Office 365 for IT Pros eBook. It’s packed full of tips and knowledge/

Find Obsolete Microsoft 365 Groups and Teams

May 11: Microsoft is deprecating the TechNet Gallery in June 2020. The script can now be downloaded from GitHub.

Oct 14: Microsoft updated the location of the Teams compliance records used to check how active a team is. Version 4.7 or later of the script handles this issue.

I wrote the first version of a script to analyze the activity in Microsoft 365 Groups (then Office 365 Groups) and Teams to identify obsolete groups in 2017. The script is described in this Petri.com article and is reasonably popular. I keep an eye on the feedback from people who run the script and update the script as time goes by. You can download the latest version from GitHub. The latest version is V4.8 dated 16 December 2020.

Update: A Graph-based version of the script is available in GitHub (5.4). This version is much faster at processing Microsoft 365 Groups and Teams and is now the recommended code and the base for future development. See this post for details.

The basic idea is to analyze the Microsoft 365 Groups in a tenant to find underused groups or simply understand the level of activity across groups. The script looks at the level of activity in:

• Conversations stored in the Inbox of group mailboxes (for Outlook Groups).
• Documents (in SharePoint document libraries belonging to the groups)
• Chats (for Teams-enabled Groups). In fact, the script checks the compliance records logged in the group mailbox for conversations in channels belonging to the Teams.

Checking different aspects of individual groups isn’t fast. One tenant tells me that it takes 17 hours to process 5,300 groups… but this isn’t a report that you’ll run daily. It’s more like a monthly or quarterly activity.

Script Outputs

The script records the data for each group in a PowerShell list. Eventually, after processing all the groups, the script outputs an HTML report and a CSV file. The script also assigns a status of Pass, Warning, or Fail to each group depending on the level of detected activity. The determination of the status is entirely arbitrary and should be adjusted to meet the needs of your organization.

At the bottom of the report you’ll see a summary like this:

Report created for: tenant.onmicrosoft.com
Number of groups scanned: 182
Number of potentially obsolete groups (based on document library activity): 120
Number of potentially obsolete groups (based on conversation activity): 129
Number of Teams-enabled groups : 65
Percentage of Teams-enabled groups: 35.71%

----------------------------------------------------------------------------

Reviewing the report should help you find the Microsoft 365 Groups and Teams that are not being used. These groups are candidates for removal or archival.

You can view a screen capture video showing how to run the script here.

Recent Improvements

Scripts that evolve over time can often do with a rewrite from scratch. However, I don’t have the time for that. but I do make changes that I think are useful. Here are some recent changes.

• New tests to see if the SharePoint Online and Teams modules are loaded. In particular, the Teams check took far too long because the cmdlets in this module are slow. In fact, the Get-Team module is so slow that we don’t use it from V4.3 onwards. Using Get-UnifiedGroup with a filter is about twice as fast. We might revisit this point as new versions of the Teams PowerShell module appear. See note above about the Graph-based version of the script.
• Use a PowerShell list object to store the report data. This is much faster than an array, especially when you might want to store data for thousands of groups. This was one of the performance tips received after publishing a post about how we write PowerShell and it makes a real difference.
• Use Get-Recipient instead of Get-UnifiedGroup to create a set of group objects to process. Get-Recipient is much faster than Get-UnifiedGroup when you need to create a list of mail-enabled objects like Office 365 Groups. V5.0 and later replaces these calls with Graph API commands.
• Output the storage consumed by the SharePoint site belonging to each group.
• Handle groups that have no conversations in the group mailbox more elegantly. Groups used by Teams are often in this situation.

Test Before Deployment

As always, test any PowerShell code downloaded from the web, even from sources like GitHub, before introducing it to a production system. The code as written needs some extra error handling to make it as robust as it could be, but I’ve left that to the professionals as people tend to have their own way of approaching this issue.

The Office 365 for IT Pros eBook includes many valuable tips for writing PowerShell scripts to interact with Office 365 Groups and Teams. Subscribe to gain benefit from all that knowledge!

Files Channel Tab Loses Connection to SharePoint

Being able to rename the URLs for SharePoint sites was one of the most popular features shipped by Microsoft in 2019. Site renames work and SharePoint makes sure that old links work too by creating redirects for the old URLs, but there are some known side-effects of a site rename that should be considered before proceeding. Losing the connection between the Files channel tab in Teams and the underlying SharePoint document library is one of the known problems. Figure 1 shows the error that you see if Teams can’t connect to SharePoint.

Microsoft’s documentation notes that the “issue is actively being worked on and will be addressed soon.” The problem has been known for several months and Microsoft rolled out a fix in mid-November. The original fix made sure that site renames no longer affected Teams and a backfill process run by SharePoint corrected the link in any sites that had been renamed to that point. At least, that was the plan. And like any good plans, it survived until the first hiccup, which was when some renamed sites stubbornly refused to cooperate.

A new fix takes care of the recalcitrant sites and restores the connection between Teams and SharePoint. The fix will roll out over the coming weeks.

MVPs and Microsoft Development Groups

Part of the unique joy of being a Microsoft MVP is the opportunity to work with development groups to test new features (always interesting) or chase down problems (maybe not as interesting, but often more valuable). I’ve been helping the Teams developers figure out what went wrong and how to fix the problem for a while. The process was slowed by the holidays, but everything clicked in the new year, meaning that the Files channel tab started to display the right information (Figure 2).

You might consider that Microsoft was slow in fixing a problem affecting two major Office 365 applications. It’s true that solving the issue took more time than predicted or desired, but that’s probably due to the nature of cloud software distributed across multiple Office 365 datacenter regions and SharePoint Online farms, the need to gather and analyze logs and run tests, and so on. The other point is that this issue only affected a small number of renamed sites which have a mixture of upper and lowercase letters in the new site URL. In any case, the bug is now squashed and we can now rename sites happily in no danger that Teams will be affected (the other side effects still remain).

The writing team for the Office 365 for IT Pros eBook are all MVPs, which explains where we get some of our information and insight that we share in the book. But of course, we can’t tell you the really interesting stuff… If we did, we’d lose our MVP status.

A Team is Tightly Connected to its SharePoint Site

Last year, I wrote an article about the ways you can publish SharePoint news items to Teams. One of the methods is to use the SharePoint tab to link to the News page in the site belonging to the team. This works well and I called it the “nicest approach to publish news into Teams.”

The downside is that the SharePoint tab only supports the publication of pages or lists from the site belonging to the team (Figure 1). This is fine if you want to publish news to something like an org-wide team (for tenants with fewer than 5,000 accounts), but it’s problematic if you want to bring content like a news item with important information from another site into a team.

The Workaround

If you examine news items, you’ll find that each item is a separate page. The workaround to bring content from a different site into a team is to publish the page using the website tab. The website tab supports the publication of content from any URL, assuming that the reader has access to that content. In the case of a SharePoint page, we need a URL that tells Teams to fetch and display the content.

The first thing to do is to open the page we want to display in a browser and copy its URL. For example:

https://office365itpros.sharepoint.com/sites/BlogsAndProjects/SitePages/Microsoft-Launches-New-Teams-Exploratory-Experience.aspx

This URL is enough for SharePoint to render the content, but Teams is a different context and the URL we need is slightly different. The amended format is:

https://office365itpros.sharepoint.com/sites/BlogsAndProjects/_layouts/15/teamslogon.aspx?spfx=true&dest=/sites/BlogsAndProjects/SitePages/Microsoft-Launches-New-Teams-Exploratory-Experience.aspx

The important bit is the inclusion of a command to force Teams to authenticate with SharePoint before displaying the page.

Working Example

Figure 2 shows a news item created and published in SharePoint as viewed through the browser interface. The first thing to do is to copy the URL for the item from the browser and adjust it as described above.

Next, go to Teams and select the channel in the team you want the content to appear. Click Add a tab and select the website tab. Input a unique name for the tab and the amended URL for the content you want to display (Figure 3).

After the tab is created, it should display the content. As you can see from Figure 4, the formatting and layout is rendered properly by the tab.

Avoid Spinning Wheels

Some people have great success with this workaround, others find that it leads to spinning wheels and nothing being displayed. If you’re in the latter category, consider exploring the solution proposed by Yannick Reekmans. It’s a nice example of thinking outside the box to fix a problem.

Need more information about how Teams and SharePoint Online work together? Peruse the chapters in the Office 365 for IT Pros eBook to get a better understanding of how these important parts of Office 365 work together.

Improve the Readability of Teams Messages

From time to time, I check the settings in Teams policies to see if anything new has turned up or to pick up on something that I previously missed. Recently, I noticed the Immersive reader setting in the Teams Messaging policy (in PowerShell, it’s the AllowImmersiveReader property set with the Set-CsTeamsMessagingPolicy cmdlet). The description in the documentation says:

Allow immersive reader for viewing messages Turn this setting on to let users view messages in Microsoft Immersive Reader. Immersive Reader is a learning tool that provides a full screen reading experience to increase readability of text.

The Microsoft Immersive Reader is a free tool built into many Office programs to make it easier for people to read text. As you’d expect, the implementation differs across the apps. For instance, in Outlook desktop, the Read Aloud button reads the text of the message in the preview pane or when a message is opened. By comparison, the implementation in Teams and OWA is more “immersive” because the message opens in a full-screen window and the text is enlarged.

Using the Immersive Reader in Teams

You can read messages in personal or group chats or channel conversations with the Immersive Reader. Click the […] menu and select Immersive Reader (Figure 1).

Teams opens the message in full-screen mode. You can scroll through the text or have it read to you, with options to select a Male or Female voice and different speeds (Figure 2). I have not tried the reader in languages other than English, and the English reader doesn’t do so well if it meets non-English text. Perhaps people who use Teams in other languages can check and report back on their experience.

Using the Immersive Reader in OWA

OWA takes much the same kind of approach as used in Teams. Select a message, lick the […] menu, and choose Show in immersive reader (Figure 3). The same kind of controls and display seen in Teams are available when you open email with the immersive reader.

Most tenant administrators probably haven’t given much thought to message readability because there are many other things to worry about when managing Teams or Exchange Online. However, it’s nice to see technology like this available in the Office apps. A small but pleasant way to make Teams and email more accessible to all.

Although we don’t cover the Microsoft Immersive Reader in any depth in the Office 365 for IT Pros eBook, there’s lots more to discuss about Teams, Exchange Online, OWA, and other bits of Office 365. About 1,200 pages and counting…

Finishing Microsoft Ignite 2019 With Another Teams Session

One of the unique joys for all conference presenters is waiting for an audience to assemble. Will anyone turn up? Will only a few be waiting for me to start? Will people leave during the session? Will they like my material? I must admit to having some of these doubts at conferences where I have presented.

My last session at Microsoft Ignite 2019 was scheduled for Friday morning, the day after the attendee party at Universal Studios. The party ended at midnight and it takes time for people to get back to their hotels, so asking them to be at a 9:15am session on the last day of the conference is a stretch for some. And when I walked into the room about 30 minutes before the session started, rows of empty seats were waiting to be filled (Figure 1).

I wasn’t quite sure about the maximum capacity, but it was certainly in the high hundreds or early thousands. You can’t see past the front row once things start because of the very bright lights on the stage that are needed to record the video, so it wasn’t possible to know exactly how many turned up. Let’s leave it at enough to fill a large part of the room. All went well.

Will Teams Take Over from Email Recording and Deck Online

The recording for the session is available online at the Microsoft Ignite 2019 site. A link to a copy of the deck is below.

A write-up for the talk is available on the AvePoint web site.

It’s difficult to formulate a collaboration strategy for an organization without good information. If you need to know more about the strengths and weaknesses of Teams and email inside Office 365, read the Office 365 for IT Pros eBook.

Block Replies to Topics When Posting Messages

As you probably know, Microsoft introduced channel moderation to Teams some time ago. Another associated feature is the ability for team members to block replies to a topic. Although this doesn’t sound like functionality that fits with the openness mantra of Teams, it’s actually a good idea, especially when making organizational announcements when you don’t reall want to encourage replies.

When someone starts a new topic, they have the choice to allow everyone in the team to reply or to limit replies to the original author and channel moderators (Figure 1).

When replies are restricted for a conversation, only the author and channel moderators see the option to add a reply. Everyone else sees the post without a reply option (Figure 2).

No Need for Moderators

Teams uses moderators to restrict who can add topics to channels, but you don’t need to enable channel moderation to restrict replies. If specific moderators aren’t defined for the channel, team owners serve in their place.

Need more information about Teams? Read Chapter 11 of Office 365 for IT Pros to discover how Teams works and Chapter 12 to investigate the finer details of Teams management.

Filtering Chats More Useful Than Filtering Teams/Channels

The sense that the Teams development group is learning from their own use of their product is growing all the time. Although seemingly always goodness when developers learn from shortcomings in their products, it can also be a double-edged sword when a product evolves to meet the needs of the company that builds it instead of its customers.

In the case of Teams, features like pinned channels and being able to mute notifications for busy conversations benefit everyone, including the Teams developers. The new filtering capabilities (announced in the What’s New in Microsoft Teams September 2019 post) are firmly in this category too, even if its availability wasn’t announced in an Office 365 notification or documented as a roadmap item.

The Problem with Chats

Teams chats are an excellent way to communicate with individuals (1:1 chats) or small groups (up to one hundred participants). Tenant users and guests can participate in chats, which are less structured than channel conversations because the chat flows in a continuous stream (much like human conversation) instead of being divided into topics. But the problem with chats is that you can have too many of them and end up losing sight of an important point. The Teams search function isn’t particularly good at precision interrogation, and Microsoft might have introduced the Filter feature as a short-term fix to the problem while they sort search out.

Filtering Teams

Filters are available to find chats or teams and channels. In the desktop or browser client, select either Teams or Chat and click the filter icon (Figure 1) and input a keyword. In the case of Teams, you input part of the name of a team or channel. The Teams filter is no more than a convenient way of finding a team or channel in what might be a long list of teams and channels that someone interacts with (remember, each team can have up to 200 different channels). Once you’ve found that important channel, consider pinning it so that you don’t have to look for it again.

Filtering Chats

For personal chats, you input part of the name of someone you’ve had a conversation with. For example, I can find conversations with Kim Akers by inputting “Kim” or “Akers” or even “ak.” Once you’ve found an initial set of matches, you can refine the set by clicking … to expose some additional filtering options (Figure 2). These options don’t exist when you apply a filter to channel conversations, probably because these conversations are already organized into teams and channels.

Overall, filters are a welcome tweak of the Teams user interface. In particular, the chat filter will help busy people find the chat they want more quickly than before. However, a better long-term solution would be to make Teams search work with the precision it should have. It took Outlook many false starts and almost twenty years of effort to deliver reliable and powerful search for user mailboxes. Let’s hope that Teams shortcuts the process.

For more information about Teams, read the exciting and insightful content in the Office 365 for IT Pros eBook. We tell it as it is, not as marketing would like you to believe it is.

But Which Way Tells the Truth About Teams?

If someone was ever to run a trivial pursuit game based on the history of Microsoft Teams (an undoubtedly nerd activity suitable for something like the Ignite conference), one of the questions should be: “How many ways can you generate usage reports for Teams within Office 365.” The follow-up question is then “And which report is accurate?”

Five Ways to Report Teams

I count five ways to generate a report about Teams usage.

• The Reports section of the Office 365 Admin Center.
• The Analytics and Reports section of the Teams Admin Center. (Recently, the Teams Admin Center added the 7-day Teams usage, device usage, and user activity reports to its dashboard).
• Within the Teams desktop and browser client, the Manage team option has an option to generate team Analytics (Figure 1).
• The Manage Teams option includes cross-team analytics (Figure 2).
• The Microsoft 365 usage analytics content pack for Power BI.

Cross-Team Analytics

If you click the cogwheel at the bottom of the list of teams in the desktop or browser client, you’re brought to the Manage teams section. Typically this is where a team owner would archive or delete a team, but now it offers an Analytics option for all the teams you can access (Figure 2). Cross-team analytics look very similar to the Teams usage reports in the Teams Admin Center, right down to the inability to sort the list by clicking on a heading.

You can click on a team in the cross-team list to drill down and view its detailed analytics. The data presented in Analytics lags by about two days, depending on the load on the service and other factors.

New Analytics Features

The per-team and cross-team analytics features are new and have not yet been announced to tenants in an Office 365 notification. However, they are promised in Office 365 roadmap item 51464 and is due in Q3 2019, which is probably why the Analytics features are popping up in tenants now.

Per-team and cross-team analytics are available to tenant and guest users.

Seeking a Source of Truth

The per-team and cross-team analytics seem very similar to the reports generated in the Teams Admin Center. Even so, some inconsistencies can be seen if you compare the data reported in one against another. For instance, the per-team analytics for the team used to organize the production of the Office 365 for IT Pros eBook reports the posting of zero channel messages on 20 August. The Teams Admin Center agrees, but the Office 365 Admin Center says that two messages were posted. When I browse the actual messages in the team, I can count seven messages posted by three different users in just one channel. A glitch in the way the Graph counts messages?

All the reporting options are at least two days behind because it takes time for Office 365 to gather and collate the data. The Microsoft 365 usage analytics content pack is even further behind (at least a month and perhaps longer), so it’s not a source of immediate feedback.

In any case, just like personal fitness trackers, the important thing is to choose one method to track usage data and stick with it to achieve a consistent view of the world. Remember that third-party reporting alternatives (like Quadrotech’s Nova solution) are available too, some of which do a much better job of slicing and dicing usage data to meet the specific needs of individual tenants.

Mute Notifications for Chatty Conversations

The Microsoft support article Manage Notifications in Teams explains how the desktop client supports the ability turn off notifications at a conversation level. The code is still in beta (but documented) and when it’s released, you access the option from the […] menu at the top of a conversation thread (Figure 1) and choose Turn off notifications.

The concept and implementation of muting a conversation is very similar to the way that you can choose to mute notifications for a complete channel. The big difference is that you can only mute a conversation after it starts.

A user’s general notification settings might mute notifications for all conversations or the user might have muted notifications for the channel. If this is the case, they can unmute a specific conversation that they want to receive notifications for.

When to Mute Conversations

Muting notifications for a specific conversation is useful when the thread becomes very chatty and multiple responses are received in a short period. This causes the Activity Feed to be swamped with updates. You might have responded at some point but have now lost interest in the conversation.

After you mute a conversation, Teams still sends notifications if someone @mentions you in the conversation. If you want to restart notifications for the conversation, go back to the menu and select Turn on notifications.

The support article also points out that you can “turn down the noise” by hiding a particularly busy channel or simply set your presence to Do Not Disturb when the time comes to get work done without interruption (what the MyAnalytics people call “focus time”). These are the kind of useful tips that should be communicated to users to help them use Teams more productively.

Mobile Devices

You can’t mute a conversation with the Teams mobile client. However, because muting a conversation affects what appears in the Activity Feed, you won’t see notifications on mobile clients for muted conversations.

Need more information about Teams? Look no further than the Office 365 for IT Pros eBook. It’s packed full of information, some of which is even useful.

Highlight Important Channels Above Teams List

Office 365 Notification MC190856 brings the news that Teams supports the ability to “pin” channels to the top of the Teams list. The new feature is described in Office 365 roadmap item 55369. The new feature is now rolling out to Office 365 tenants and Microsoft says that the deployment will be complete worldwide by the end of October 2019.

Pinning a channel currently works for the Teams desktop and browser clients. The feature is also available in the mobile Teams client. Both tenant and guest users can pin channels and, as you’d expect, the pinned channel list is unique to a tenant.

Simple Idea, Simple to Pin

The idea is simple: some channels are more important than others. In fact, some channels hold information that might be critical to the work someone does. It’s easy to lose sight of a channel if you belong to a large set of teams, each of which has several channels. Your activity feed might be swamped with the debris generated by multiple chatty channels and the notifications you create for channels might result in barrage of banner notifications. The solution is to allow users identify which are their important channels and then pin those channels to a prominent spot on top of the Teams list (Figure 1).

The name of the team it belongs to appears under each pinned channel, and if the channel name is bold (see First Edition above), you know that it has some new content.

Pinned channels are listed in the order they are pinned. If you don’t like the order, you can drag and drop pinned channels within the list to create your preferred order.

Pinning a Channel

You can pin a channel in any team, whether it’s in the “Your teams” or “Hidden teams” list. Once you’ve found a channel to pin, click the […] menu and select Pin (Figure 2).

To unpin a channel, select it in the pinned list, click […] and select Unpin.

For more information about Teams, why not read the 200+ pages of insightful content included in the Office 365 for IT Pros eBook. You never know, you might learn something!

Extracting Unused Mailbox Information from Mailbox Diagnostics

Recently, I posted a Petri.com article to report the availability of some new properties in the Export-MailboxDiagnosticLogs cmdlet. The properties record different kinds of mailbox activity, and I included a script to generate a report based on the properties. The output is a CSV file that can be opened in Excel or imported in Power BI. All is well.

I then had the idea that maybe it would be good to filter the output to find unused mailboxes and post that information to a Teams channel as a form of proactive notification to administrators. Not having endless time, I browsed the web to find a PowerShell script to serve as a starting point and found one that reports inactive Active Directory accounts. That’s not a long way from what I wanted to do, so I grabbed the code and edited it to fit my purpose.

Using Incoming Webhook Connector to Post to Teams

Posting messages to a Teams channel is easily done using the incoming webhook connector, one of the standard connectors available to all Microsoft 365 tenants to bring information sourced from applications into Teams and Microsoft 365 Groups. When you configure the connector for a channel, you get a webhook (unique identifier) to post messages to the channel.

I then filtered the set of mailboxes I created in the table generated by the previous script (see link above) to find mailboxes with no email activity over the last 90 days. If a mailbox has no activity in three months, it’s a good indicator that it is an unused mailbox. I then generate the necessary JSON format payload consumed by Teams and post the resulting message reporting the unused mailboxes to the webhook. Here’s the script:

# Script uses some code from https://www.thelazyadministrator.com/2018/12/11/post-inactive-users-as-a-microsoft-teams-message-with-powershell/

$WebHook = "https://outlook.office.com/webhook/42f6d6b0-c191-496d-85b4-bfd6e63e230b@b662313f-14fc-43a2-9a7a-d2e27f4f3478/IncomingWebhook/62c92a65258a416b90e969980ae4ebb1/eff4cd58-1bb8-4899-94de-795f656b4a18"

$InactiveTable = New-Object 'System.Collections.Generic.List[System.Object]'
$PersonImage = "https://img.icons8.com/cotton/2x/gender-neutral-user--v1.png"
$Today = (Get-Date)
ForEach ($R in $Report) {
   $DaysSinceLastEmail = ((New-TimeSpan –Start $R.LastEmail –End $Today).Days)
   If ($DaysSinceLastEmail -gt 90) {
   $UserData = @{
     ActivityTitle = "$($R.Mailbox)"
     ActivitySubTitle = "-----------------------------------------------"
     ActivityText = "$($R.Mailbox)'s last email activity was on $($R.LastEmail)"
     ActivityImage = $PersonImage
     Facts = @(
        @{	
	  name  = 'Mailbox:'
	  value = $R.Mailbox 	},
	@{
	  name  = 'Last Email activity:'
	  value = $R.LastEmail 	},
	@{
	  name  = 'Days since last activity:'
	  value = $DaysSinceLastEmail	},
	@{
	  name  = 'Last active time (unreliable):'
	  value = $R.LastActive 	} )
	}
   $InactiveTable.Add($UserData)
   Write-Host $R.Mailbox $R.LastEmail $DaysSince }}

$Body = ConvertTo-Json -Depth 8 @{
	Title = "Possibly Inactive Office 365 Users"
	Text  = "There are $($InactiveTable.Count) users with no detected email activity for 90 days or more"
	Sections = $InactiveTable }

# Only post if we have less than 25 items
If ($InactiveTable.Count -lt 25) {
    Write-Host "Posting inactive account information to Teams" -ForegroundColor Yellow
    Invoke-RestMethod -uri $WebHook -Method Post -body $body -ContentType 'application/json' }
Else {
    Write-Host "Too many (" $InactiveTable.Count ") inactive accounts found to post to Teams... Spread the bad news another way" }

The message posted to Teams looks like the example shown in Figure 1:

Remember the Teams Maximum Message Size

There’s nothing earth shattering in the code and plenty of similar examples are available online (such is the joy of PowerShell). What is important to note when you post to Teams is that the message is limited to a maximum size of 25 KB. If your message exceeds the limit, Teams responds with a HTTP 413 error similar to:

Microsoft Teams endpoint returned HTTP error 413 with ContextId tcid=982653230009892365,server=DB3PEPF00000461,cv=4LrmcZGylkmtD0uEToTT2g.0.

In my case, it seemed like the error happened if more than 28 or so items were in the list of reported accounts. This will obviously vary depending on how much data you try to post for each item.

For more information about using Teams and Microsoft 365 Groups with connectors, read the Office 365 for IT Pros eBook.

Users Baffled Because They Didn’t Know They Needed a Secondary Ringer

Microsoft’s announcement in Office 365 notification MC189659 that Teams is rolling out the ability for users to define a secondary ringer possibly came as a surprise, even to those of us who peruse the Office 365 Roadmap (in this case, item 51089).

What, you might ask, is a secondary ringer? It’s a voice calling feature that allows an application to signal the arrival of an inbound call on multiple devices. For instance, as the UserVoice item on the topic explains, you might want to have calls signaled on both your PC and headphones. Skype for Business Online supports the feature, so given that Teams is very much the future for voice communications inside Office 365, Teams needs to support the assignment of a secondary ringer. You can think of this as just another preparatory step along the way to the retirement of Skype for Business Online in July 2021.

Setting a Secondary Ringer

To set a secondary ringer, go to the Devices section of Teams settings and select a device from the drop-down list of available choices (Figure 1). Obviously if you aren’t connected to more than one suitable device, you can’t set a secondary ringer. If a device isn’t online (like a Bluetooth headset that’s powered off), it can’t be used either.

If you remove your PC from a situation where the secondary ringer is unavailable (for example, unplug a laptop and move out of the range of the headset’s Bluetooth connection), Teams removes the secondary ringer and you’ll have to reconfigure it after you reconnect.

Availability

According to the notification, the new feature will roll out in mid-September and be complete worldwide by mid-October. It will be available for both Windows and Mac clients.

Need more information about Teams voice capabilities and the transition from Skype for Business Online? We have just the thing in a complete chapter in the Office 365 for IT Pros eBook.

New Meetings Tab Shows Up in Stream

Office 365 Notification MC189279 brings the happy news that those of us who record meetings in Teams will find it easier to locate the recordings when they arrive in Stream. A new Meetings option has been added to the My Content menu; the same filter is applied using the Meetings tab in the Stream menu bar (Figure 1). You’ll be able to find recordings that are published or draft (still need some work done before publication).

This fulfills the promise of Office 365 Roadmap item 54528 to the delight of Office 365 tenants who began to see the new feature in late August 2019. The roll-out is due to be complete worldwide by the end of September 2019.

Recording Meetings

Not everyone likes the idea of recording a meeting. To make sure that everyone knows what’s happening and has an opportunity to leave the meeting if they don’t want to be recorded, when someone turns on recording of a Teams meeting, participants see a warning banner to tell them that everything they say will be recorded.

After the meeting finishes, Teams has the recording processed by Azure Media Services and stores the output as a video file in Stream. The person who started the recording is the owner of the video. All other participants in the meeting can view the video.

In addition to capturing a video of the meeting, voice contributions are transcribed when Stream generates an automatic transcript of a meeting (one of Stream’s intelligent features). In fact, the output isn’t a transcript as would be generally known. A Stream transcript is composed of all the captions generated when Stream processes a video file. It’s not possible to print off a complete transcript or even the individual captions unless you copy and paste the captions into a file. The owners of a video can correct the captions once Stream is finished – you should do this to correct some of the howlers that can creep in through automatic transcription.

Yes, we cover Stream in the Office 365 for IT Pros eBook. In fact, we have a complete chapter to explain what’s going on inside the Office 365 enterprise video portal.

Create On-Demand Private Meetings Without Scheduling

Office 365 Notification MC189276 (30 August 2019) tells us that the new Teams Calendar App will get the ability to host private on-demand video or audio meetings from the desktop or browser client. The feature is also documented in Office 365 roadmap item 54208, which promises meetings with “no calendar, no scheduling, no fuss.”

The Meet Now feature is rolling out worldwide in mid-September with GCC tenants getting it in mid-October. Microsoft says that every Office 365 tenant will have the feature by the end of November.

How Meet Now Works

To create a new on-demand meeting, click the Meet now button in the Calendar app (Figure 1).

Teams then starts a meeting. You can choose what settings you want to use , join it as the organizer and then add whoever else you want to meet with (Figure 2), including both tenant and guest users.

The meeting is private because no trace exists of it in the user’s calendar or a Teams channel.

Teams Meeting Policy Setting for Allow Meet Now

All users are allowed to run on-demand meeting unless they’re barred by the Teams meeting policy assigned to their account. To stop users, open the meeting policy in the Teams Admin Center and set the “Allow Meet now in Private meetings” slider from On to Off (Figure 3).

Updating Allow Meet Now with PowerShell

You can also do this in PowerShell by updating the AllowPrivateMeetNow setting from True to False. First, let’s find out what meeting policies allow the Meet Now feature:

# Find out what Teams meeting policies allow Meet Now
Get-CsTeamsMeetingPolicy | Format-Table Identity, AllowPrivateMeetNow

Identity                           AllowPrivateMeetNow
--------                           -------------------
Global                                            True
Tag:AllOn                                         True
Tag:RestrictedAnonymousAccess                     True
Tag:AllOff                                        False
Tag:RestrictedFunctionality                       True
Tag:Default                                       True
Tag:Kiosk                                         True

Let’s say that we don’t want users assigned the RestrictedFunctionality policy to use Meet Now. To update the policy, run the Set-CSTeamsMeetingPolicy cmdlet to update the setting to False.

# Update Teams meeting policy to block user access to Meet Now feature in Calendar app
Set-CsTeamsMeetingPolicy -Identity "RestrictedFunctionality" -AllowPrivateMeetNow $False

Need to know more about Teams? Read the several chapters covering all aspects of this topic in the Office 365 for IT Pros eBook.

Office ProPlus Now Installs Teams Alongside Other Apps

Microsoft recently decided to include Teams in the set of applications automatically installed with the Office ProPlus (click to run) suite (Office 365 roadmap item 46444). At first glance, this seems like a benign change that shouldn’t cause many disruptions. That is, unless your organization doesn’t want to use Teams or people within the organization have no need to use Teams. Despite Teams now being used by 19 million active monthly users in 500,000 organizations, there’s a heck of a lot of Office ProPlus users who haven’t ever heard of Teams.

Take my wife for instance. She has an account in my Office 365 tenant and uses Office ProPlus. Well, she uses Outlook and an occasional Word document. I don’t think she has ever felt the need to fire up PowerPoint and the wonders of calculations via Excel remains a blessed mystery to her. She’s happy with the way she uses Office, which is as good as it gets.

That is, until the latest update arrived on her PC and left a Teams icon on her desktop. This wouldn’t have been too bad as it’s easy to remove an icon. What really ticked her off was the way that Teams automatically started after each reboot. She doesn’t want to use Teams, but there’s no obvious way for a regular user to suppress Teams and stop it starting.

Microsoft Gave Overlooked Advice

I hadn’t read the important note Microsoft included in its Deploy Microsoft Teams with Office 365 ProPlus document which said:

“Starting in July 2019, if you’re using Monthly Channel, then Teams will be added to existing installations of Office 365 ProPlus (and Office 365 Business) on devices running Windows when you update your existing installation to the latest version.”

The document goes on to explain how to use the Office Deployment Tool or a Group Policy Object (GPO) if you don’t want Teams to be added to existing Office installations. You can also add a DWORD value called PreventTeamsInstall to the system registry at HKLM\SOFTWARE\Policies\Microsoft\Office\16.0\common\officeupdate. Set the value to 1 to stop Teams being installed.

Stopping Teams for a Single User

All of this is goodness until you have to deal with a single user who happens to be important to you who wants Teams stopped now. Teams is already on the PC and we don’t use the Office Deployment Tool or GPOs for family members (I know, I should). The need is therefore simple: find something to stop Teams starting up on individual PCs where Teams is already installed because Office is updated.

Another DWORD registry value called PreventFirstLaunchAfterInstall is available to stop Teams launching after an update. The value is at HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\Teams and should be set to 1. I don’t know if this works when Teams has already been started on a PC, but a Microsoft Technical Community contribution led me to remove the value splendidly named com.squirrel.Teams.Teams from the system registry. The value is at HKCU:\Software\Microsoft\Windows\CurrentVersion\Run (Figure 1).

The PowerShell command to do the job is:

Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "com.squirrel.Teams.Teams"

Removing the value stopped Teams and made my user happy. If you haven’t yet deployed the latest Office update to your tenant, you might want to think about controlling Teams with the Office Deployment Tool or GPO. Or just wait until users log those help desk tickets to ask why this new app turned up on their PC without asking.

Need more information about dealing with Office ProPlus with Office 365? We cover clients in detail in the Office 365 for IT Pros eBook.

Teams Replaces Meetings App with New Calendar App

First announced in March 2019 in Office 365 Notification MC175133 and then highlighted later that month in Microsoft’s round-up of announcements at the Enterprise Connect conference, the long-awaited roll-out of the new Calendar app finally seems to be happening. Tenants are reporting that the new app has appeared in Teams clients following the last regular software refresh to replace the older Meetings app. The change from Meetings to Calendar is also documented in the Office 365 roadmap (Figure 1). Because the release dates slipped, the descriptive text says that the release is March 2019 while the release date is predicted in Q1 CY2020. The most positive way of reading this is to think that the app is now available before its scheduled release date. Scheduling software is difficult!

Original Minimalist App

The Meetings app is, how shall we say this, minimalist. It allows you to schedule Teams meetings and it synchronizes with user Outlook calendars, but that’s about it. The new Calendar app redresses the situation and delivers new views and actions. It also responds in some part to the many user voice requests for the Teams calendar.

Nice as it is to have new calendar features in Teams, the new calendar app is not as functional as the Outlook calendar and few users will be able to organize their professional and personal schedules inside Teams in the same way as they can in Outlook. For example, the Teams calendar has no concept of multiple time zones (useful when meeting with people in other countries or entering travel details), categories are unsupported, you can’t mark events as private, drag and drop between time slots can’t be done, and so on. These features might come in time, but they’re missing in the new Calendar app today.

New Teams Calendar Features

The features in the new calendar (Figure 2) include:

• Day, work week, and week views (but no month view).
• Calendar widget to navigate to chosen date.
• Ability to interact with selected calendar item (for instance, right click to accept, reject, or join a meeting). Meetings light up when they are active.
• Bi-directional synchronization with user’s Outlook calendar. For instance, you can edit items scheduled in the Outlook calendar and have those changes appear in Outlook.
• Synchronization with Exchange calendar settings, like working hours and days of the work week.
• Users can put a meeting into their calendar without adding anyone (but themselves) to the meeting (appointments in Outlook calendar terms).

Users are unlikely to need much if any coaching to use the new app. It’s all very straightforward and easy to use. Best of all, despite the wait, it’s a great improvement.

We don’t really cover details like the features of an app in the Office 365 for IT Pros eBook, but if you need information about how to manage Office 365 in general and Teams in particular, the eBook is full of great content.

Uses Teams Graph API to Access Conversations

Last week, I wrote about the new Teams tenant-to-tenant (T2T) migration capabilities released in BitTitan’s MigrationWiz product. A lot of feedback flowed from the article, including several vendors getting in touch to say that they too are working on T2T products.

Migration and Backup

I spoke with AvePoint’s John Peluso and Dux Raymond Sy to review the capabilities of AvePoint Fly for T2T migration. As expected, because all vendors are limited by the same Graph-based API, AvePoint is at much the same stage as BitTitan. One thing AvePoint is quite proud of is their success at migrating Slack installations to Teams and say that there’s an increasing amount of interest in this capability. This is unsurprising given the success Teams is experiencing today; any Office 365 tenant using Slack is likely to consider a migration to Teams at some point.

I also learned that AvePoint use the same API to backup Teams data. Many ISVs claim to support backup of Teams, but the ones I have checked out so far backup the Teams compliance records stored in Exchange Online mailboxes instead of Teams data. AvePoint is the first ISV I know of to backup direct from Teams.

Limitations of Teams Backup

Before getting too excited, we should realize a few home truths that arise from the simple fact that the Teams API for conversations is not intended for use as a backup platform.

• The Teams API is limited to channel conversations only. It doesn’t allow access to personal or group chats.
• The API is slow and prone to throttling. It’s not designed for the high-speed data streaming activity typical of a backup product.
• The topics extracted from source channels are concatenated. A topic and its replies are stored in a single HTML item that is backed up.
• Restore is done by posting the HTML item back into the Files section (SharePoint Online site) of the target teaml.
• Not all metadata can be backed up. Specifically, reactions (likes, etc.) can’t be copied.

These issues also arise in the T2T products. However, if you’re in the middle of merging two Office 365 tenants, you probably don’t worry so much as the focus is to move data from one tenant to another. Backup and restore tend to have a different focus as people expect perfect recovery of the original data.

Better Backup API Needed for Teams

To some extent, we have been down this road before. Exchange Web Services (EWS) was never designed to be used as a backup API yet it is used by every backup product for Exchange Online. Getting EWS to the point where it reliably transfers large quantities of data into and out of Exchange Online has taken several years of engineering effort from Microsoft and ISVs. I expect the same will be true for Teams.

Perhaps Microsoft will deliver a purpose-built API for Teams Backup in the future. Until then we will live in an imperfect world where backups and restores of Teams data is never going to be as good as other Office 365 data sources that have been around for a while, like Exchange Online and SharePoint Online. In the meantime, it’s nice to see that AvePoint has started along the journey.

Need more items to think about when considering how to backup Office 365? Chapter 4 of the Office 365 for IT Pros eBook deals with this question in some depth. It’s worth reading!

Greater Fidelity and Ability to Work with Content

The original file viewing capability in the Teams desktop and browser client was relatively basic. To improve the situation, Microsoft is rolling out a set of new file viewers for OneDrive for Business, SharePoint Online, and Teams. The OneDrive for Business development group leads this work to build out the number of supported file types (now over 300 and growing).

A picture tells the story better than words. Teams uses file viewers to display content when users click on documents in the Files channel tab. Figure 1 shows Teams displaying a PowerShell script that I uploaded to a SharePoint document library. The file is simple text, but the viewer is intelligent enough to understand the .PS1 extension and highlight different elements of the script. You can’t edit PowerShell scripts through the viewer.

Viewing and Editing Office Documents

Because the viewer launches the online version of the Office apps, you can edit Office documents in the viewer. Figure 2 shows a Word document being edited. This replaces the previous options to edit in Teams or edit online. If the desktop version of the app is available, you can choose to open the file in that.

The new viewers make it easier to work with documents in Teams. However, when working with documents in Teams, you work with online files stored in SharePoint. Often it’s easier to synchronize the document libraries belonging to a team with the OneDrive client and work with local copies of the files. If you’re traveling and have to deal with flaky Wi-Fi networks, local copies are the only way to go…

For more information about working with Teams, read the Office 365 for IT Pros eBook. It’s packed full of useful information!

Control the Apps Users Can Install in Teams

The process of migrating Teams tenant management settings has been in progress since Microsoft announced the Teams Admin Center in April 2018. Lots has changed since and the Teams Admin Center has matured greatly, and now we see the final pieces of the puzzle appear with Teams app setup policies (to control the default apps available to users) and Teams app permission policies (to control the apps users are allowed to install and use, including during meetings).

Migrated Org-Wide App Settings

If you’ve already blocked some third-party apps in the Teams settings in the Office 365 Admin Center, you’ll find that the settings are moved across into org-wide app settings in the App Permissions Policies sector of the Teams Admin Center (Figure 1).

Org-wide app settings (Figure 2) control if third-party or custom apps (app packages developed by your organization) can be installed. If you allow third-party apps to be installed, you can create a list of blocked third-party apps that will never be available to users.

Teams App Permission Policies

App Permission Policies control the set of Microsoft, third-party, and custom apps available to end users. While org-wide settings apply to everyone in the tenant, app permission policies offer a finer degree of control down to the individual user level. Each policy allows access to its own set of apps (Figure 3). After you assign an app permission policy to a user, they can install any of the apps covered by the policy. An app permission policy can’t override a block set in the org-wide app settings.

Creating and Assigning Teams App Permission Policy

A global app permission policy is created automatically within a tenant and applied to all accounts. If you want to allow access to different apps, you can customize the set of apps defined in the global app permission policy or create a new app permission policy and assign it to selected accounts. An app permission policy covers three types of app:

• Microsoft Apps.
• Third-party Apps.
• Tenant Apps (apps published and owned by the organization).

For each type of app, you can decide to:

• Allow all apps. Users can install and use any app of the type published in the Teams app store.
• Allow specific apps and block all others: The administrator selects the apps that users can install and use. Any other apps are blocked.
• Block specific apps and allow all others: The administrator blocks selected apps available in the Teams app store and makes them unavailable to users.
• Block all apps: Users aren’t allowed to install and use apps of this type.

When you restrict the set of apps available in Teams, the Store filters the set of apps, bots, and connectors it displays to users and team owners. To assign a policy to a user, go to the Users section of the Teams Admin Center, select the user, and edit the policies section of their account to update the assigned app permission policy, which will be the Global (Org-wide default) policy unless it was previously changed for another policy. Due to caching, it can take a up to a day before Teams clients respond to a change in the set of apps allowed to users or a change in the policy assigned to an account.

Updating Teams App Permissions Policies with PowerShell

Editing individual accounts to update policies rapidly becomes a boring activity. The cmdlets to work with Teams App Permissions Policies are in V2.0 of the Teams PowerShell module. PowerShell makes it easy to assign the same App Permissions policy to a group of users, such as the members of a team. In the code snippet below, we connect to the Skype for Business Online endpoint, find the members of a team, and use the membership list to assign the policy to each member.

# Find members of the Human Resources Group and assign them the appropriate Teams App Permissions policy
$HRGroup = Get-Team -DisplayName "Human Resources Group"
$TeamUsers = Get-TeamUser -GroupId $HrGroup.GroupId -Role Member
$TeamUsers | ForEach-Object { Grant-CsTeamsAppPermissionPolicy -PolicyName "HR App Policy" -Identity $_.User}

For more information about managing all aspects of Teams, read the several hundred pages of coverage we give to Teams and Office 365 Groups in the Office 365 for IT Pros eBook. You won’t be disappointed.

Useful Extension for Anyone with a WordPress site

Those who follow this blog might have noticed a small Teams logo floating on the left-hand side of the page. It’s a link to the Share to Microsoft Teams WordPress plugin, a nice extension written by MVP Joao Ferreira.

The plugin is very simple (and effective). If you’re logged into Teams, clicking the link takes the current page and creates a post in Teams in a selected team and channel (Figure 1). The post then becomes the focus of a debate in the channel (nothing is shared back to the original web site). You can only share a post to a channel in your home Teams tenant; the plug-in doesn’t support sharing to a channel in a tenant where you are a guest user.

The plugin is installed on this site to allow you to share the joys of all the Teams and other Office 365 coverage here on htpps://Office365itpros.com with your fellow workers. For more information about the technical details behind this extension, see this post by MVP Tom Morgan.

It’s hard to keep up with interesting information about Teams or other Office 365 technologies. So much happens, so little time to investigate. Which is why you should subscribe to the Office 365 for IT Pros eBook and gain back some time by letting us do the hard work of keeping you updated.

New options to Set What You Want to See

Teams recently moved away from a model where users “follow” a channel when they want to receive notifications about new posts and replies in the channel to the ability to control the notifications received on a general basis and for individual channels. The clients are now being updated to reveal Channel notifications as an option in the […] menu for a channel (see this support article).

General Notification Settings

In general, the notifications a user sees for new posts, replies, and mentions in channels of teams they belong to are controlled by settings in the Mentions and Messages sections under Notifications in their Teams settings (Figure 1). For example, under Mentions, we see a setting controlling how Channel mentions are handled. If Teams can’t find a user setting for a channel, it applies their general settings.

Channel Notification Settings

To control notifications for a channel, select the channel and then click the […] menu. Channel notifications are the top option and reveal the screen shown in Figure 2.

Assuming you want to be notified when people post to the channel, the options are:

• Send notifications for all posts to the channel.
• Send notifications for all posts and replies to the channel.
• Send notifications for @[channel name] mentions.

With notifications enabled, you can choose to have Teams post notifications to the activity feed, or to the feed and as a “banner” (pop-up notification, sometimes called a “toast”). A banner notification looks like Figure 3:

Obviously, if you participate in some ultra-busy channels, you might not like to see notifications appear for everything. In these cases, I usually opt for activity feed notifications only unless I’m waiting for something to happen and want to see the pop-up.

For more information about Teams, read the chapters in the Office 365 for IT Pros eBook.

Fixes Problem of Knowing If Other Users are Available

Now that all the fuss and bother surrounding the retirement of Skype for Business Online has died down, we can return to normal business. A notification posted some time ago (June 20 in Office 365 message MC182674) tells us that “Teams Presence is now happening in real time meaning that when users’ presence is changing, other users can see this change right away.” Tracking and reporting user presence accurately is an essential element in the movement from Skype for Business Online to Teams.

The update is also in Office 365 Roadmap item 52395. Microsoft says that they will begin to roll-out the change across Office 365 in early July and aim to complete the process worldwide by the end of August. So far, the change seems to be effective.

Presence is a fundamental part of a chat or messaging application. Email works asynchronously in that you never depend on the recipient of a message being online and able to respond. Indeed, the distributed nature of email systems and the multiple protocols and clients used by email would make it impossible to know if a recipient was available, busy, or in a meeting.

Presence and Teams

The concept of presence is different for chat applications like Teams, Slack, and Skype for Business because users sign into a central service which then tracks their presence status over time and makes that presence status available to other users. A user’s presence can change through something they do (like join an online meeting) or be set explicitly by the user, as shown in Figure 1 (you can also type a command like /available or /away into the Teams command bar to set your presence).

The new version of MyAnalytics can book two-hour calendar slots for “focus time” to allow people to concentrate on specific tasks. When Teams sees these slots, it switches the user’s presence to “Do Not Disturb.” This setting suppresses notifications so that the client only flags urgent messages and those from priority contacts.

What’s Changing

Teams has been criticized in the past because it has not updated user presence status as quickly or as accurately as it should. For instance, it can take several minutes before a state change made by a user becomes available to other users. This update aims to publish presence updates almost immediate (or real-time). In other words, as soon as someone changes their presence, other people will know about it.

Real-time presence changes will come as a pleasant surprise to those who have been exasperated at the slowness of presence updates in Teams. This especially affects people moving from Skype for Business Online because the presence changes in that app happen very smoothly.

Learn more about Teams presence and status updates in the Office 365 for IT Pros eBook.

Service Shuts Down on July 31, 2021

A process started in September 2017 with the announcement at the Ignite conference that Teams would replace Skype for Business Online will conclude on July 31, 2021 when Microsoft retires Skype for Business Online. Existing tenants using Skype for Business Online can continue using it until they can transition to Teams.

New customers won’t get a choice as Microsoft will only configure new Office 365 tenants with Teams from September 1, 2019. New tenants with fewer than 500 seats have been unable to choose Skype for Business Online since last year.

To be fair to Microsoft, they have made huge progress in developing Teams to be able to take over from Skype for Business Online since the 2017 announcement. All the data indicates that Teams is obviously successful with customers, with over 19 million monthly active users in over 500,000 organizations. Now that a firm retirement date is set for Skype for Business Online, we can expect to see that number grow fast.

Feature List in Teams Expands All the Time

The list of new features delivered in Teams since 2017 is staggering and Microsoft is lining up to add the last remaining set of features needed to enable customers to make the move, including dynamic 911, shorter retention periods (down to one day) for compliance records, and better interoperability between Teams and Skype consumer (due in the first quarter of 2020). That last point mightn’t seem important, but it’s critical for many companies who want to connect with partners and customers who don’t have Teams.

Preparing for Retirement

As the retirement date for Skype for Business Online approaches, you can expect:

• A huge effort by Microsoft to convince Office 365 tenants using Skype for Business Online to move to Teams. The last thing Microsoft wants is to have a substantial number of reluctant movers left as July 31, 2021 draws near. If you use Skype for Business Online today, expect to hear from Microsoft.
• Microsoft will work out edge case scenarios like what happens to new tenants after September 1 who have Skype for Business on-premises servers and want to have a hybrid organization.
• ISVs to speed up the delivery of more Teams phone and room devices to help customers switch out old devices designed for Skype for Business Online.
• A ramp-up of migration services offered by Microsoft and third-party consulting companies. Remember that Teams is very different to Skype for Business Online, and switching in Teams as a 1-for-1 replacement isn’t a good strategy. It’s much better to figure out how Teams fits in your overall collaboration strategy first. And remember to consider questions like data governance and compliance when you deploy Teams too.

We have a whole chapter (16) covering the transition from Skype for Business Online in the Office 365 for IT Pros eBook. You should think about reading it!

Office 365 Audit Records Useful Source of Information

Recently another MVP pointed out that Office 365 Activity Alerts don’t seem to work so well. At least, he tried to set one up to alert him when someone created a new team and no alert was ever sounded.

Activity alerts depend on events logged in the Office 365 audit log. I tried to create an activity alert for new team creations and Office 365 remained mute for several days. In fact, I haven’t seen an activity alert for team creation yet. Something odd is happening on the back end because the events are in the audit log.

Script for DIY Emailed Report

In any case, I decided to roll my own activity alert by running the Search-UnifiedAuditLog cmdlet to find team creation events, parsing the AuditData content, and emailing the resulting information. Because I don’t like recreating the wheel, I combined code from Chapter 21 of the Office 365 for IT Pros eBook to parse the results returned from Search-UnifiedAuditLog and some code from one of my Petri.com articles to format and send the message. The mailbox used must be enabled to use SMTP AUTH.

The original script appeared on 30 July 2019. This is version 2 of the code and it adds some information to the emailed report such as the privacy setting for the team, its classification, the number of group members, and the number of guests. You’ll also note that I sort the audit records by team name to get one record for each team. Sometimes Office 365 creates multiple audit records when a new team is created. Remember to update the $EmailRecipient variable with a valid email address before you run the script.

# TeamsCreationReportByEmail.PS1
# A script to locate Office 365 audit records for the creation of new Teams and report the fact via email.
# V2.0 22 Oct 2019
# Uses the Exchange Online PowerShell module...
$StartDate = (Get-Date).AddDays(-90); $EndDate = (Get-Date).AddDays(1)
#HTML header with styles
$htmlhead="
     <style>
      BODY{font-family: Arial; font-size: 10pt;}
	H1{font-size: 22px;}
	H2{font-size: 18px; padding-top: 10px;}
	H3{font-size: 16px; padding-top: 8px;}
    </style>"

#Header for the message
$HtmlBody = "
     <h1>Teams Creation Report for teams created between $(Get-Date($StartDate) -format g) and $(Get-Date($EndDate) -format g)</h1>
     <p><strong>Generated:</strong> $(Get-Date -Format g)</p>  
     <h2><u>Details of Teams Created</u></h2>"
#Person to get the email
$EmailRecipient = "SomeoneinYourTenant@Tenant.com" # &lt;- Update this with the real address

If (-not $O365Cred) { #Make sure we have credentials
    $O365Cred = (Get-Credential)}
$MsgFrom = $O365Cred.UserName ; $SmtpServer = "smtp.office365.com" ; $SmtpPort = '587'

# Find records for team creation in the Office 365 audit log
Write-Host "Looking for Team Creation Audit Records..."
$Records = (Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Operations "TeamCreated" -ResultSize 1000)
If ($Records.Count -eq 0) {
    Write-Host "No Team Creation records found." }
Else {
    Write-Host "Processing" $Records.Count "audit records..."
    $Report = [System.Collections.Generic.List[Object]]::new()
    ForEach ($Rec in $Records) {
      $AuditData = ConvertFrom-Json $Rec.Auditdata
      $O365Group = (Get-UnifiedGroup -Identity $AuditData.TeamName) # Need some Office 365 Group properties
      $ReportLine = [PSCustomObject]@{
        TimeStamp      = Get-Date($AuditData.CreationTime) -format g
        User           = $AuditData.UserId
        Action         = $AuditData.Operation
        TeamName       = $AuditData.TeamName
        Privacy        = $O365Group.AccessType
        Classification = $O365Group.Classification
        MemberCount    = $O365Group.GroupMemberCount 
        GuestCount     = $O365Group.GroupExternalMemberCount
        ManagedBy      = $O365Group.ManagedBy}
     $Report.Add($ReportLine) }
}
# Add details of each team
$Report | Sort TeamName -Unique | ForEach {
    $htmlHeaderTeam = "<h2>" + $_.TeamName + "</h2>"
    $htmlline1 = "<p>Created on <b>" + $_.TimeStamp + "</b> by: " + $_.User + "</p>"
    $htmlline2 = "<p>Privacy: <b>" + $_.Privacy + "</b> Classification: <b>" + $_.Classification + "</b></p>"
    $htmlline3 = "<p>Member count: <b>" + $_.MemberCount + "</b> Guest members: <b>" + $_.GuestCount + "</b></p>"
    $htmlbody = $htmlbody + $htmlheaderTeam + $htmlline1 + $htmlline2 + $htmlline3 + "<p>"
}
# Finish up the HTML message body    
$HtmlMsg = "" + $HtmlHead + $HtmlBody
# Construct the message parameters and send it off...
 $MsgParam = @{
     To = $EmailRecipient
     From = $MsgFrom
     Subject = "Teams Creation Report"
     Body = $HtmlMsg
     SmtpServer = $SmtpServer
     Port = $SmtpPort
     Credential = $O365Cred}
Send-MailMessage @msgParam -UseSSL -BodyAsHTML ; Write-Host "Teams Creation Report sent by email to" $EmailRecipient 

Figure 1 shows what the resulting email looks like:

You can download a copy of the script from GitHub. Feel free to amend the script to meet your own requirements. Don’t forget to tell us about all the great improvements you make by posting comments here.

Another Email Feature Added to Teams

Moderation is a well-known feature of email systems to control messages posted to sensitive mailboxes or distribution lists. For instance, you can enforce moderation on the CEO’s mailbox so that all messages must be checked by their assistant before delivery. Announced on July 19 in Office 365 Message Center notification MC186219 (Roadmap item 51786), Teams now supports the same kind of capability for channel conversations. Microsoft has started to roll-out moderation for Teams and the deployment should be complete across Office 365 worldwide in August.

Use Case for Moderation

Moderation is likely to be used in channels used to announce information rather than for general discussion. For example, you might want to dedicate a channel in a team used to co-ordinate the development of a new product to announce when new builds are available and don’t want to clutter up the channel with random unrelated conversations. Some might be disappointed that moderation is limited to restricting posts and doesn’t include functionality like selecting posts to highlight or pinning those posts to the top of the channel, but if you compare it to moderation for a distribution group or mailbox, the implementation in Teams makes sense.

Moderation is available for both public and private teams.

Adding Moderation to a Channel

To enable moderation, select the channel you want to control and then Manage channel from the […] menu. You can then turn moderation on or off for the channel. Even if moderation is disabled, you still have the option to restrict the creation of new topics (posts) to any member of the team or everyone except guests (Figure 1).

If you enable moderation for a channel, the next step is to decide who the moderators should be (Figure 2). By default, all team owners are moderators, but you can select a different set of owners and members to act as moderators.

Finally, you can control if members can reply to posts and if automated processes (bots and connectors) can submit messages to the channel. An example of where you would enable these types of posts is where you connect the channel to something like Visual Studio to get updates about product builds.

After moderation is enabled, members who aren’t moderators cannot create new conversations in the channel and will see an informational banner saying “only channel moderators can post in this channel.” Depending on the settings, they might be able to reply.

Need to know more about Teams? Check out the information in the Office 365 for IT Pros eBook. The book includes several hundred pages of information relevant to managing or using Teams.

The Teams Call Bot Will Answer

Figuring out the best headset, microphone, and camera to use in Teams calls can be a pain. Usually, dedicated hardware is best and delivers better results than the microphone and speakers built into workstations. Using a dedicated camera is a harder call because the quality of cameras available in workstations today is pretty good.

But even after you’ve settled on the hardware, you still don’t know how well it works from the perspective of other people on Teams calls. Which is where the ability to make a Test Call comes in. The Check Call Quality feature exists in Skype for Business Online and is requested on User Voice, where Microsoft’s 12 June response reports that the feature is “currently being tested internally.” Well, Test Call has shown up in a number of tenants I used (all configured in targeted release), so it must be coming very soon.

Making a Teams Test Call

To make a test call with the desktop client (the option doesn’t exist in the browser client), click your avatar (picture) in the top bar and select Settings, then Devices. Make sure that the right audio devices are selected for the test and then click Make a test call (Figure 1).

Teams makes the test call to a bot. Unlike human beings, bots are always ready to accept a call, even from annoying people. The bot answers and allows you to record some words before playing the words back to you to check if the quality is acceptable. Only English-language calls are supported currently. At the end of the call, you see some test results (Figure 2).

Microsoft removes the recording of the test call after you finish.

The test call verifies that you can connect to Teams to make a call in the same way as you’d call into a meeting. It tests the selected audio devices and it shows you what you see on the camera (and demonstrates why you should turn background blur on). It does nothing to improve your voice or looks, but aside from that, Test Call is a pretty useful function.

Need to know more about Teams calling? The Office 365 for IT Pros eBook includes a complete chapter to explain the mysteries of calling and how to attain great call quality.

Microsoft Declares Success for Teams Over Slack

Microsoft’s July 11 post about the progress of Teams shared the assertion that Teams now has 13 million daily active users and 19 million weekly active users. Without ever saying it in text, the graph supplied by Microsoft underlined the point that Teams has surpassed the last official Slack number of “more than 10 million daily active users” in its pre-IPO S-1 filed with the SEC on April 26, 2019.

Slack September 2019 Growth

On October 10, Slack reported that the September 2019 number for daily active users had reached 12 million. More interestingly, Slack said that users of their paid service spent 9 hours daily connected to the service, 90 minutes of which were in active use generating 5 billion weekly activities (like sending a message). Slack also pointed to the 500,000 apps in their app directory as evidence of strong use of the platform. In a remark that might be a subtle dig at Teams, Slack also said that “you can’t transform a workplace if people aren’t actually using the product.” In other words, growth in user numbers is meaningless unless people actually use a platform to get real work done.

Low Number

Returning to Microsoft’s post, their not-so-subtle comparison positioning Teams ahead of Slack seems like good news, but I was surprised at just how low Microsoft’s number is. In March 2019, Microsoft said that 500,000 organizations now use Teams. That number had grown at around 40,000 organizations per month since the last data given by Microsoft, so it could be in the 600,000 – 650,000 range now, assuming that Teams maintained its recent growth rate since March.

In December, Accenture said that they had 170,000 users on Teams. We also know from Microsoft’s March statement that 150 organizations have 10,000 or more users on Teams (presumably accounts like Emirates, FedEx, Lexmark, The Adecco Group, KONE, and McCann Worldgroup as mentioned in Microsoft’s post). Taking Accenture and the 150 organizations together, that accounts for around 1.7 million users of the overall population.

Defining an Active Teams User

Not all of these users are active. There’s a big difference between an Office 365 license bought by an organization and assigned to a person and someone who actually uses Teams regularly. Or, as Microsoft calls them, qualified entitlements versus active entitlements. Office 365 has 180 million monthly active users, but that’s not nearly the total number of licensed Office 365 users.

Microsoft doesn’t define what a daily active user of Teams does, but we can assume that it’s someone who signs into Teams and does something, like contribute to a channel conversation, participate in a meeting, or have a personal or group chat. These are basic operations that don’t take other activities into account, such as working with Files, Planner, or other first-party or third-party apps integrated in Teams.

Figuring Out the Numbers

Taking the 19 million weekly active users reported by Microsoft and subtracting 1.7 million for the large organizations (more than 10,000 users), we get 17.3 million for the remaining organizations. If we divide this number by 650,000 organizations, we get an average of 27 weekly active users per organization. Taking 500,000 organizations as the yardstick, we get 35 weekly active users per organization.

These numbers seem low. They might be accounted for by:

• Many organizations are still in test mode and haven’t proceeded to full deployment. Ancedotal evidence suggests that this is not the case as I hear of many organizations that use Teams extensively. However, it’s also true that many organizations are in the process of moving from Skype for Business Online to Teams. When these migrations are over, we should see a further increase in Teams daily active users.
• Many small organizations use Teams (free or paid versions). We know that a large percentage of Office 365 tenants are small and have less than 50 seats, so the presence of a large percentage of small organizations in the overall count might contribute to the relatively low average number of active Teams users per organization.

In January, I thought the total Teams user base might be in the 40 million range. That figure was for licensed users based on an average of 100 users per organization (at that time, Teams reported that it was used by 420,000 organizations). Remember that Teams is part of every Office 365 plan, so everyone assigned an Office 365 E3 or E5 license (for example) is automatically a licensed Teams user unless Teams is removed from the plan. In one way, you could say that Teams has 180 million licensed users!

Of course, because Microsoft hadn’t published any firm data on Teams at that time, this was pure guesswork. But even so, I guess my figure could be in the ballpark because of the difference between active users and licensed users.

In any case, we now have a definite number to work with and can track the future growth of Teams from this baseline.

Microsoft’s post included mention of four new Teams features. One of the reasons why you need to subscribe to the Office 365 for IT Pros eBook is to stay updated with new developments. We include information about new features as soon as we see them appearing in our tenants and have a chance to figure out how they work.

Type a Name and Teams Will Make it an @Mention

Office 365 Notification MC184810 brings the news that Teams will soon support something called an @-less mention. The text of the notification is terse and you might not quite understand exactly what Microsoft means by an @-less mention. Fortunately, Office 365 Roadmap item 52966 gives more detail:

“Get someone’s attention in a channel conversation or a group chat with @-less mentions. Simply start typing a person’s name starting with a capital letter and select the right contact from the list of suggestions. They will receive a notification, which they can click to go directly into the point in the conversation where they were mentioned. “

When someone is @-mentioned, the message appears in their Activity Feed. If they have a busy Activity Feed, they can filter to find just the messages where they are mentioned.

Two Types of Mentions

Today, if you want to draw someone’s attention to a message in a personal chat or channel conversation, you must prefix their name with an @ sign. Teams then finds any matches in the membership list and suggests the people you might want to mention (Figure 1).

An @-less mention removes the need to type the @ sign as a prefix to someone’s name. Teams scans text as it is entered into the message box and looks for names (starting with a capital letter) that match names in the membership list. The capital letter is important because it tells Teams to check for a name. If you enter a member’s name in lowercase, Teams won’t suggest them as a mention. Figure 2 shows how things work.

In practice, the idea works pretty well. Sometimes the list of suggestions disappears before you have a chance to select a name, but that might be down to typing speed.

Microsoft says that they started to roll @-less mentions out at the start of July 2019 and will complete the deployment by the end of the month. So far, @-less mentions work in the desktop and browser client. The feature hasn’t shown up in a Teams mobile client (yet).

Need more information about how to use and manage Teams? It’s all in the Office 365 for IT Pros eBook.

The Real Meaning of July 1

Apart from being the day when new editions of Office 365 for IT Pros appear, July 1 is a big day for MVPs. The annual renewal cycle brings good or bad news in an email from Microsoft to tell MVPs around the world if they have retained the status. For some, it’s a nerve-wracking wait. For others (usually the more experienced MVPs), it’s part of the annual cycle. For the record, a number of well-known MVPs in the Office 365 orbit were not renewed on July 1, including Paul Cunningham, one of the original authors. It’s sad to see talented people leave the program.

All of which brings me to Team system (or service) messages. These are the message posted in the General channel of each team to inform members about people who leave or join the team, the creation of new channels, and so on. The new Information Barrier feature (generally available since June 28 and covered in the 2020 edition of Office 365 for IT Pros) posts messages when it detects policy violations and has to remove people from teams to stop them connecting with people defined in an information barrier policy (Figure 1).

I suspect that many pay little attention to notifications that someone has joined or left a team, but they can reveal secrets. We touched on this issue previously when discussing how to protect the privacy of new employees whose names might appear in org-wide teams before they begin working at a company.

They’re All Gone!

The issue was highlighted for me on July 1 when I signed into a team run by the Teams development group for MVPs and found a bunch of notifications about people leaving the team (Figure 2). The penny didn’t take long to drop that these individuals had lost their MVP status. Because they were no longer MVPs, the team owner had to remove them. This is necessary to preserve the Non-Disclosure Agreements signed by MVPs with Microsoft to allow us access to new technology.

In this instance, Teams worked the way it was designed and the team owner did nothing wrong. However, the result was that the privacy of the people who had lost their MVP status was compromised in that they had no opportunity to share the news as they wished. It was unfortunate that some of their friends learned the news by seeing these notifications.

The Redundancy Situation

No great harm was done. Most MVPs are not timid individuals who worry deeply about these things, so I doubt that anyone lost sleep about anyone else seeing these notifications. But it got me thinking about how things might happen in a redundancy situation where those affected by job losses might get an inkling of what’s happening through similar notifications. Let’s take the case of a team whose membership is composed of the people in a specific department whose manager is told by the company that they must reduce headcount by three. A choice is made and communicated to HR and senior management, who both approve the decision. Processes are put in place to effect the redundancies, including changes to IT systems.

The way people are let go differs from country to country. In the U.S., it can be much more immediate than in Europe with people being asked to walk out the door without notice. In these scenarios, if IT systems had processed removals from groups to stop people being able to access confidential material, they might learn of their fate before the axe descends (by either not being able to access a team or another team member telling them that their membership is revoked). This is not good.

Vote Now, Vote Often on User Voice

My solution is to ask the Teams development group to introduce a team setting to suppress the posting of system messages to the General channel. In fact, there’s already a User Voice suggestion to turn off “Member add” notifications. If you think the idea is a good one, why don’t you vote for it to help the Teams development group prioritize the idea as they craft future development plans.

Update: June 8: Microsoft has announced that they will remove system messages from the General channel.

Old Teams Files Channel Tab Limited to 300 Items

One of our regular readers contacted us about a problem they’d run into when migrating to Teams. They have many SharePoint Online sites and would like to make Teams the primary client interface for users to interact with SharePoint, so they’ve been doing a lot of testing to make sure that they can switch over without problems.

Apparently, they ran into an issue with folders that hold more than 300 files as they discovered that the Teams Files channel tab can display 300 files from a folder but no more. On reporting the problem to Microsoft, Premier Support said:

“As discussed with our internal team we have found that there is a limit of only 300 files.​ ​The Product group team is currently working on this and due to Technical challenges the team has not given any ETA on this.“

Fixed in New Files Channel Tab

It’s hard for Premier Support to stay up to speed with everything that’s happening inside Office 365, or even just Teams. But the good news is that the new Teams Files Channel tab can display more than 300 files. The new channel tab has the same capability as SharePoint (technically 30 million) and I was able to use the new tab to open large folders and see all the items. Figure 1 shows items in the folder where I store Petri.com blog posts. There are more than 600 items in the folder.

The new Files Channel tab is rolling out across Office 365, so hopefully it will soon reach our reader’s tenant and fix the problem.

Stay abreast of new developments in Teams and other parts of Office 365 by subscribing to the Office 365 for IT Pros eBook. It really does make sense.

Adding New Employees to Org-Wide Teams

If your Microsoft 365 tenant has fewer than 10,000 accounts, a few minutes after you create an Azure AD account for a new employee, the account is added to the membership of any org-wide teams in the tenant. If your company provisions Azure AD accounts for new employees in advance of their joining date as part of a HR onboarding process, you might not want this to happen because you don’t want other employees to know that someone is joining the company. In this case, you can either:

• Wait for the employee to join the company and create their Azure AD account at that point.
• Create the account for the new employee but assign dummy information for the display name and primary SMTP address. For example, you could assign “New Employee” or a similar term as the display name so that other employees see that “New Employee:” has joined. The reason why to assign a dummy SMTP address is that users can click on “New Employee” to see more information from their people card. The SMTP address usually contains the first and last name of a person, so you don’t want to expose that information in the people card. Figure 1 shows the general idea.

Soon afterwards, the new employee shows up in the information pane for the org-wide teams active in the organization (Figure 2). As you can see, no one can discover exactly who the new employee really is.

Update Account After the Employee Joins

You then update the display name and SMTP address after the new employee is active within the company. We also update the mailbox name and alias to match the employee’s actual name. Finally, because Microsoft 365 creates the User Principal Name (UPN) for a new account based on its SMTP address, we need to update the UPN to allow the user to sign-in correctly. The update is easily done with PowerShell:

Set-Mailbox -Identity NewEmployee5July2019 -DisplayName "Jake Adams" -WindowsEmailAddress "Jake.Adams@Office365itpros.com" -Alias "Jake.Adams" -Name "Jake Adams"
Update-MgUser -UserId (Get-Mailbox -Identity Jake.Adams).ExternalDirectoryObjectId -UserPrincipalName Jake.Adams@office365itpros.com

There’s no need to retain the dummy SMTP address as it was never used to send outbound email. Any messages delivered to the mailbox before the employee became active will be waiting there for them.

The DIY Option

If this arrangement doesn’t work, consider using all-employee teams whose membership is updated manually. It is easy to script additions and removals of employees from membership as part of the HR onboarding or leaving processes.

Need to know more about managing Teams or Office 365 in general? Look no further than the Office 365 for IT Pros eBook, which is packed full of interesting and useful tips like this.

Post an Announcement When You Have Something Special to Say

Office 365 Message Center MC179865 announces that Teams will support the new announcement post type worldwide by the end of June 2019 (roadmap feature 51326). There’s no indication in the notification if this feature is limited to commercial customers.

Graphic Highlights

Essentially, an announcement post is a post highlighted with a graphic heading. When you start a new conversation, select announcement from the drop-down list to the top left and then compose a heading. You can then upload a graphic file (JPEG or PNG) or opt for the heading to have a solid background color. If you choose a graphic, the ideal proportions for the oblong shape of the heading are 914 x 120 pixels. If you upload a file of a different size, you have some latitude to select an appropriate area, which is what I’ve done in Figure 1. You can also zoom in and select a specific area of the graphic to use for the heading.

When you post the announcement, readers see a small announcement icon to indicate the post type (Figure 2) I wonder how many will overlook this because they focus on the graphic?

Anyone in a team can post an announcement. If people get into the habit of posting announcements rather than regular conversations because they like the way that the graphics make their posts prominent the usefulness of announcement posts will decrease. You don’t really want to see a message stream full of posts with headings containing furry cat pictures.

New Post Types to Come?

By itself, the announcement post type isn’t terribly interesting. The idea is that announcements will give organizations the chance to highlight important messages to users. The new type will add some color to conversations, but that’s about it. What is interesting is that Teams is laying the foundation for users to be able to select from multiple post types when they start a conversation. Over time, we might well see new post types appear, possibly created by ISVs who integrate their products with Teams.

Teams is covered in Chapter 13 of the Office 365 for IT Pros eBook. We’ll give this feature a couple of lines in the chapter…

Files Tab Now Close to Functionality Available in SharePoint Browser UI

On May 20, Microsoft posted Office 365 notification MC180213 to let tenants know that a refreshed version of the Files channel tab is now rolling out. Commercial Office 365 tenants should see the new functionality in June, but there’s no news when it might be available for GCC tenants. Meeting the commitment in Office 365 Roadmap item 51234, Microsoft says that the Files tab has a new look and “many new features,” which might assuage those who didn’t like the simplified version previously used by Teams (I thought that the design of Files had advantages and disadvantages).

Using the New Files Tab

You don’t have to do anything to see the new UI as it is enabled automatically. When you open Files, you’ll see that new views are available, including any customized view created for a document library. The set of options available are more extensive and now include the ability to check-out documents (Figure 1). You can also pin documents to the top of the library, just like you can do inside SharePoint.

You can now set up the synchronization of libraries (with the OneDrive client) from within Teams. and use custom filters and views, all of which makes the Files channel tab more useful.

What’s Missing

Although more functional than the last iteration, the new Files channel tab does omit some options available in SharePoint. For instance, you can’t access the version history of a document, so you can’t restore back to a previous version. You can’t attach a Flow to a document or create an alert. Finally, you can’t access and update document properties. This means that users can’t select retention labels (or sensitivity labels, when Microsoft supports these in the SharePoint user interface), or custom properties such as the “publication date” and “publication” shown in Figure 2.

Although an easy workaround for the issue exists (coach users to open the library with SharePoint Online when they want to perform these actions), it does seem strange that Microsoft didn’t include document properties in the new Files channel tab. Perhaps they’ll do so in the next iteration.

One final point. If you create a SharePoint Document Library tab in a channel, it uses the old Files view rather than the new. This is a little confusing (or at least, it was to me…).

For more information about Teams, read Chapter 13 in the Office 365 for IT Pros eBook. You can find out lots of tips and techniques for SharePoint Online too; it’s in Chapter 8.

Communicate by Email with Teams Channels

Teams supports the ability of users to send email to a channel by publishing special Teams channel email addresses. (The option to generate email addresses is controlled by the Email integration org-wide setting). The addresses used by Teams channels point to hidden mailboxes in a part of Microsoft 365 managed by Microsoft and invisible to the rest of the world, which accounts for the odd email addresses in the teams.ms domain. To retrieve an email address for a channel, use the Get email address option in the […] menu (Figure 1).

You can then paste the email address into a message to send it to the channel. Teams uses a connector to pick up the new message and bring it into the channel, and all is well. A fuller explanation of how Microsoft 365 and Teams process inbound messages and deliver them to the target channel is available here.

However, because the email addresses are a little weird, it’s unlikely that people will remember them. If you think that people will want to email a specific channel regularly, you might like to create an Exchange mail contact to make it easier for them.

Creating a Mail Contact for a Teams Channel

Mail contacts show up in the Exchange Global Address List (GAL), so once an contact exists, it’s easy for users to add them as a message recipient.

• Go to the Exchange Admin Center (EAC) and select Contacts under Recipients.
• Click Add [+] Mail Contact.
• Fill in the details for the new contact. Copy the email address for the channel into the external email address field. It’s a good idea to give the contact a display name that clearly indicates its purpose. In Figure 2, I’ve added a “(Teams)” suffix.

After saving the contact, the object is available in the GAL and can be used to address messages. Outlook clients will take a day or so to pick up the new mail contact in their copy of the Offline Address Book (OAB). However, before the contact appears in the OAB, Outlook users can always consult the GAL to find the new address (Figure 3).

Users Can Delete Teams Channel Email Addresses

The only problem is that users can remove the address for a Teams channel, which invalidates the mail contact. Teams is happy to generate a new email address for the channel if requested (it won’t reuse an address), so you’ll have to update the mail contact with the new address if this happens.

Using Teams Channel Email Addresses Elsewhere

Much the same technique works if you want to add a Teams channel email address as a member of a distribution list. It is, after all, a valid email address, and in most respects, can be used in the same way as any other email address.

For more information about Mail Contacts, read the Exchange Online chapter of the Office 365 for IT Pros eBook. Teams is covered in two chapters – one for the basics and architecture, and the other covers managing a Teams deployment. Together, the two chapters span over 150 pages of invaluable material…

Easily Done, But Prepare for Teams That Expire Afterwards

A contribution to the Microsoft Technical Community offered a solution for how to add all the Teams in an Office 365 tenant to the Office 365 Groups Expiration Policy. Once teams are added to the policy, the groups they belong to expire at the end of the policy lifetime (say, 750 days) and must be renewed by a team owner. If not, the group is soft-deleted for 30 days, during which time it can be recovered. At the end of that period, Office 365 permanently removes the group for the team and all the associated resources.

In any case, the script worked on the basis of finding all the Office 365 Groups in the tenant and then figuring out which groups are team-enabled before adding those groups to the policy. It’s a valid approach, but a better method is to use the Get-Team cmdlet in the Teams PowerShell module because it only returns the set of teams and you don’t have to fiddle around checking what groups are team-enabled.

Once you have the set of teams, it’s easy to add them to the expiration policy using the Add-AzureADMSLifecyclePolicyGroup cmdlet.

Tuning The Solution

A script showing how to add multiple groups to the expiration policy is included in the chapter covering how to manage Groups and Teams in the Office 365 for IT Pros eBook. It was simple to take that script and amend it to process Teams rather than Groups. We can improve the solution further by implementing a check for teams already covered by the policy so we don’t trigger an error when running Add-AzureADMSLifecyclePolicyGroup.

One way to do this is to update one of the fifteen custom attributes available for all mail-enabled objects. In the example, we write the GUID of the policy into this attribute, meaning that we can check for its existence before trying to add a team to the policy. Here’s the code:

# Add all Teams that aren't already covered by the Groups expiration policy 
# to the policy
$PolicyId = (Get-AzureADMSGroupLifecyclePolicy).Id
$TeamsCount = 0
Write-Host "Fetching list of Teams in the tenant…"
$Teams = Get-Team
ForEach ($Team in $Teams) {
  $CheckPolicy = (Get-UnifiedGroup -Identity $Team.GroupId).CustomAttribute3
  If ($CheckPolicy -eq $PolicyId) {
    Write-Host "Team" $Team.DisplayName "is already covered by the expiration policy" }
  Else { 
    Write-Host "Adding team" $Team.DisplayName "to group expiration policy"
    Add-AzureADMSLifecyclePolicyGroup -GroupId $Team.GroupId -Id $PolicyId -ErrorAction SilentlyContinue
    Set-UnifiedGroup -Identity $Team.GroupId -CustomAttribute3 $PolicyId
    $TeamsCount++ }}
Write-Host "All done." $TeamsCount "teams added to policy"

Another advantage of using a custom attribute is that many cmdlets support server-side filtering for this attributes. For instance, to find the set of teams that have been added to the expiration policy, we can run the command:

Get-UnifiedGroup -Filter {CustomAttribute3 -ne $null} | Format-Table DisplayName, CustomAttribute3

Update After Groups Expiration Policy Update

After I wrote the original post, Microsoft updated the Groups expiration policy to be activity based. A side effect of the change was that the Get-UnifiedGroup cmdlet returns the calculated expiration date for groups covered by the policy, meaning that you could use this instead of a custom attribute to figure out what groups are covered by the policy. Thus, we can now base the script on the expiration date as shown below.

$PolicyId = (Get-AzureADMSGroupLifecyclePolicy).Id
Write-Host "Fetching list of Teams in the tenant…"
[array]$Teams = Get-Team
$TeamsCount = 0
ForEach ($Team in $Teams) {
  $CheckPolicy = $Null
  $CheckPolicy = (Get-UnifiedGroup -Identity $Team.GroupId).ExpirationTime
  If ($CheckPolicy -ne $Null) {
    Write-Host "Team" $Team.DisplayName "covered by expiration policy and will expire on" (Get-Date($CheckPolicy) -format g)}
  Else { 
    Write-Host "Adding team" $Team.DisplayName "to group expiration policy" -Foregroundcolor Red
    Add-AzureADMSLifecyclePolicyGroup -GroupId $Team.GroupId -Id $PolicyId -ErrorAction SilentlyContinue
    Set-UnifiedGroup -Identity $Team.GroupId -CustomAttribute3 $PolicyId
    $TeamsCount++ }}
Write-Host "All done." $TeamsCount "Teams added to policy"

In turn, this means that to find the groups covered by the policy you can do the following (unfortunately the ExpirationTime property is not supported for server-side filtering):

[array]$Groups = Get-UnifiedGroup -ResultSize Unlimited |? {$_.ExpirationTime -ne $Null}  
$Groups | Sort Expirationtime | Format-Table DisplayName, ExpirationTime 

Expiring Groups

After you add a bunch of groups to the expiration policy, the likelihood exists that some of those groups will expire because they are already older than the expiration period. For this reason, it’s a good idea to prepare team owners to let them know what to do if they see an expiration notice. If the group is team-enabled, the notification appears in the activity feed of the team owner (Figure 1).

They can then extend the lifetime of the team by editing its settings. Select the team expiration option to view the current expiration date and then click Renew now (Figure 2) if needed.

Need more examples of how to manage Teams and Office 365 Groups (and many other things) with PowerShell? Look no further than the Office 365 for IT Pros eBook. At the last count, the text included over a thousand examples.

Defining the Apps in the Teams App Navigation Bar

The Teams App navigation bar is on the left-hand side of the desktop and browser clients and along the bottom of the mobile client. It’s where icons for pinned apps like the core set of default apps usually thought of as “Teams” (like Files, Chat, and Teams) appear along with a set of
less prominent apps accessed through the ellipsis menu […]. The set of apps shown in the navigation bar and their order are defined in a Teams App Setup policy. By default, all tenants have a default app setup policy called Global and another policy suitable for front-line workers called FrontLineWorker, which includes the Shifts app.

You don’t have to go anywhere near app setup policies if you’re happy with the set of apps in the navigation bar. However, if you want to add some apps or change the order, you do so through an app setup policy. You can have multiple app setup policies within a tenant, each of which is customized for specific groups of users.

Teams App Setup policies are part of a set of features designed to make apps more manageable. App setup policies also control if users are allowed to load custom apps into Teams (needed if they want to switch to developer preview) and pin apps to the navigation bar. Teams App Permission policies, which are announced but not yet available, are also in this set.

Creating a New Teams App Setup Policy

To create a new app setup policy, open the Teams Admin Center, go to the Teams Apps section, and select Setup policies. Select the choice to add a new policy. Teams populates the policy with the core apps (Activity, Teams, Chat, Files, Calendar, Calling). You can then remove apps, add apps, or move the apps up and down within the navigation bar. In Figure 1, I added the Insights, Tasks by Planner, Yammer Communities, and Stream apps. You can also install apps through the policy, as I have done for the Approvals app.

You can add any app from the Teams store to the navigation bar, or any app you publish to your own tenant app catalog (aka the “Company store”).

After settling on the final set and order of apps, save the new policy.

Assigning a Teams App Setup Policy to Users

An apps setup policy only becomes effective when you assign it to a user. You can do this individually by selecting users in the Teams Admin Center and editing the set of policies assigned to the user (Figure 2). After a short period, the user’s Teams client will pick up the change in policy and apply the settings to the client’s navigation bar.

In Figure 3 we can see the effect of applying an app setup policy. The default apps are reordered so that Teams is above the activity feed and three new apps (Planner, Stream, and the Who bot) are included in the bar.

If you remove any of the core apps from the navigation bar, the user can still access them through the ellipsis menu.

When an admin changes the app setup policy assigned to an account, Teams notifies the user that the change happened and advises them that some of their pinned apps might have moved (Figure 4).

PowerShell for Teams App Setup Policies

The Teams PowerShell module includes cmdlets to work with Teams app setup policies. For instance, to see all the policies in a tenant, run the command:

# Get Teams App Setup Policies
Get-CSTeamsAppSetupPolicy

and to see the set of apps and their order in a policy, run a command like this:

# Return list of apps for a selected Teams App Setup Policy
Get-CSTeamsAppSetupPolicy -Identity "App Policy 2" | Select -ExpandProperty Pinnedappbarapps

Id    : 2a84919f-59d8-4441-a975-2a8c2643b741
Order : 1
Id    : 14d6962d-6eeb-4f48-8890-de55454bb136
Order : 2
Id    : 86fcd49b-61a2-4701-b771-54728cd291fb
Order : 3
Id    : 5af6a76b-40fc-4ba1-af29-8f49b08e44fd
Order : 4
Id    : ef56c0de-36fc-4ef8-b417-3d82ba9d073c
Order : 5
Id    : 20c3440d-c67e-4420-9f80-0e50c39693df
Order : 6
Id    : com.microsoft.teamspace.tab.planner
Order : 7
Id    : com.microsoftstream.embed.skypeteamstab
Order : 8
Id    : fc6b6d20-89ed-45fb-9e62-e4b4ca8fbf3f
Order : 9 

It’s usually best to update app setup policies through the GUI of the Teams Admin Center. Where PowerShell comes in very handy is to assign a new policy to a bunch of users, even if the cmdlets in the Skype for Business Online module badly needed to be replaced by new cmdlets in the Teams PowerShell module. In any case, here’s a quick snippet of how to assign a Teams app setup policy to a group of users from a selected department.

# Assign Teams App Setup Policy to users in the Marketing department
$Users = (Get-CSOnlineUser -Filter {Department -eq 'Marketing'})
Foreach ($U in $Users) {
   Write-Host "Assigning Teams App Setup Policy App Policy 2 to" $U.DisplayName
   Grant-CSTeamsAppSetupPolicy -PolicyName "App Policy 2" -Identity $U.UserPrincipalName }

For more information about Teams, read Chapters 11 and 12 of the Office 365 for IT Pros eBook.

Teams Now Tells You About Planner Task Assignments

In an update posted to the Microsoft Technical Community on May 15, Microsoft announced that Teams running in enterprise and education tenants now creates notifications in user activity feeds for Planner task assignments. According to Microsoft, the new feature is available from May 16 (it works in my tenant). There’s no word when this feature might be available in Office 365 sovereign clouds.

Notifications Only for Integrated Plans

Notifications appear when people are assigned tasks using the Planner browser interface, the Planner mobile app, the SharePoint web part for Planner, or when a plan is integrated in Teams via a channel tab. The last point is important because a plan must be integrated with Teams before Planner knows that it needs to generate notifications. Adding a plan to a tab also adds the Planner bot, and it is the bot that posts messages to assignees. Teams treats the messages from the Planner bot like new messages from any other personal chat and flags them to the activity feed, which is how the notifications arrive. And like any other personal chat, the messages sent by the Planner bot also appear under Chats. Figure 1 shows notifications in both the activity feed and chat pane. The list of notifications in the Planner chat is a convenient way to make sure that you don’t miss an assigned task.

Notifications show up in the mobile clients too. Figure 2 shows two Planner notifications in the activity feed in a Teams for iOS client. The Planner bot is a little more obvious in this client as you see the offer to “chat with Planner.” Clicking this link brings you to the set of chats received from the Planner bot. If you click a Planner notification, the link brings you to the task in the Planner app (assuming it is installed on the device). I haven’t tested what happens when the Planner app is unavailable but assume that the link opens Planner in a browser.

Each notification includes the name of the assigned task, the person who assigned the task, the name of the plan, and a link to open Planner in the channel tab. Marking a task complete in Planner doesn’t remove a notification.

Notification Settings

Notifications only show up in Teams if an assignee’s Planner settings allow them (Figure 3). A small but important point…

Learn more about Planner in Chapter 15 of the Office 365 for IT Pros eBook. How to integrate Planner in a Teams channel tab is covered in Chapter 13.

Use PowerShell or the Portal to Configure Office 365 Groups Naming Policy

The naming policy for Office 365 Groups allows tenants to enforce a naming policy for new Office 365 Groups created by users through group-enabled applications like Teams, Outlook, Planner, Stream, and Yammer. The policy does not apply to groups created by administrators.

Since 2016, administrators have configured the naming policy through PowerShell. Now they’ve released a preview to do the same job in the Azure Active Directory portal (Figure 1). Go to the groups section of the portal and you’ll find the naming policy listed under Settings.

There’s no doubt that configuring policy settings through a GUI is much easier than messing around with PowerShell, especially given the somewhat cryptic steps needed to manipulate policy settings for Azure Active Directory policy objects. Apart from setting prefix and suffix variables to add to user-provided names, the portal also allows you to manage blocked words. These are words that you don’t want people to use in group names. Some of the words are functional, like “Payroll” and “CEO,” and some are offensive terms.

Policy Not Retrospective

Remember that the Groups Naming Policy only applies to new groups and doesn’t apply its naming standard retrospectively to old groups. If you want to use the new standard with old groups, you’re going to have to write some PowerShell. Thankfully, this is relatively easy (see Chapter 12 of Office 365 for IT Pros for some hints and sample code).

Premium AAD Feature

Using the Office 365 Groups Naming policy is a premium Azure Active Directory feature requiring users to have Azure Active Directory Premium P1 licenses. Given the revelation at Microsoft’s FY19 Q3 earnings call that Enterprise Mobility and Security has 100 million users (much of the enterprise Office 365 population), this shouldn’t be much of a problem for the organizations that need policies like this to exert control over group sprawl.

For information about the policies used to control Office 365 Groups, read Chapter 12 of the Office 365 for IT Pros eBook.

Teams Group Chat Limits

Office 365 Message Center Update MC179396 (Roadmap item 51235) brings the news that Teams group chats now support an increased limit of 100 participants (from the previous 50). The roll-out of the new limit starts in June and should be complete by the end of July, except for GCC tenants.

Group chats are a useful way of getting together a set of people to discuss and refine an issue before bringing it for wider debate (or announce a decision) in a channel or via email. Unlike a team channel, where any member can see anything, a chat is limited to those invited to join. Chats don’t have owners, and anyone in a chat has the same rights as others, including the ability to remove someone else from the conversation. Files shared in a group chat are stored in the OneDrive for Business account of the sharer instead of a SharePoint site.

It’s good practice to give a name to a group chat. This allows participants to identify the chat in their chat list and it’s also helpful if you ever need to look for something with eDiscovery as the chat name appears in the compliance items captured in Exchange mailboxes of the chat participants.

Teams Shareable File Links with Permissions

Teams has always had the ability to generate links to files stored in its SharePoint sites. Message Center update MC179400 (Roadmap item 51230) tells us that the shareable links created by Teams for posting into channel conversations and chats will now hold permissions in much the same way as the links generated by SharePoint and OneDrive for Business. As shown in Figure 2, you can assign permissions (including the ability to edit) to:

• Anyone with the link (if allowed by the tenant sharing settings for SharePoint Online).
• Tenant users with the link.
• People with existing access (members of the team).
• Specific people.

Once Teams generates a link, you can copy it into a channel conversation or chat. This action converts the link (something like https://tenant.sharepoint.com/:w:/s/O365ExchPro/ER3RMYkKBUBGiPXVqXQFgdkBK-rOsJHA6FSmqrr_75iaeQ?e=jGsU8C ) into a “file chiclet object” (a new term to me).

The new form of shareable links are rolling out to Office 365 tenants in May 2019 and should be available worldwide by the end of June.

These small but important changes are the kind of stuff we track on a daily basis to make sure that the Office 365 for IT Pros eBook is as up-to-date as we can make it. Read Chapter 13 for the latest information about Teams.

A Profusion of Teams Can Consume Storage

When Teams creates a new team, it provisions a SharePoint Online team site along with other resources like a shared notebook and wiki. All of this is goodness, unless you like managing SharePoint storage manually.

SharePoint Site Storage Management

By default, SharePoint Online uses a central pool of storage that all sites draw upon on an as-needed automatic basis up to a maximum of 25 TB per site. Sounds good, because who wants to keep a close eye on site storage quotas to adjust them whenever sites need more space to allow users to store documents and do other useful work. But the downside is that if you allow free creation of Office 365 groups and teams, the central pool can be absorbed quicker than you anticipate and force the tenant to buy more storage from Microsoft just to keep operations running.

Enterprise tenants get 1 TB of SharePoint storage plus 10 GB per licensed Office 365 account. The new SharePoint Online Admin Center makes it easy to see how much storage the tenant has and what sites are consuming most storage. You can also export details of sites to a CSV file to dice and slice the data as you want.

If you use Office 365 retention policies to make sure that documents are kept for specific periods, you’ll discover that more storage is consumed because SharePoint must keep copies of deleted files. In any case, most tenants are happy to leave SharePoint to manage site storage automatically, which is the default management setting for Office 365 tenants. You only need to change the Site storage limits setting to Manual in the SharePoint Admin Center if you want to control the storage allocation for individual sites.

Controlling Individual Site Storage

One reason why you might want to control storage for individual sites is when a tenant makes extensive use of Teams and you don’t want the sites created for teams to be able to grow to 25 TB. In this scenario, you can switch the Site storage limit setting to Manual and then:

• Edit the storage quota for each site through the SharePoint Admin Center, or
• Use PowerShell to set a storage quota for every site associated with Teams and then adjust the quota upwards as necessary for individual sites.

Given the number of sites that you might need to process, the second option (PowerShell) is best.

Setting Storage Quotas for SharePoint Sites with PowerShell

The only complication we face is that the cmdlets needed for the job are spread across three modules: Teams, Exchange Online, and SharePoint Online. Once you’ve loaded the modules and connected to the three endpoints with a tenant administrator account, the code to update sites is pretty simple:

• Find all teams.
• Find the SharePoint site URL for each time (already covered in a previous post).
• Update the storage quota for the site.

Here’s some code to do the work. In this example, we set a 20 GB quota for each site with a warning limit at 98% of quota:

# SetTeamsSitesStorage.PS1
# Set the storage for the SharePoint sites belonging to Teams to a certain storage value
#
# Find Teams
Write-Host "Finding Teams in the Tenant..."
$Teams = (Get-Team -Visibility Public | Select DisplayName, GroupId)
ForEach ($T in $Teams) {
    $SPOUrl = (Get-UnifiedGroup -Identity $T.GroupId | Select -ExpandProperty SharePointSiteURL)
    If ($SPOUrl -ne $Null) {
       Write-Host "Setting SharePoint Site quota to 20 GB for" $T.DisplayName
       # Set storage value for SharePoint site
       Set-SPOSite -Identity $SPOUrl -StorageQuota 20480 -StorageQuotaWarningLevel 20070 }
    Else {Write-Host "Can't Process storage update for" $T.DisplayName "- Please check SharePoint site" -ForegroundColor Red}}}

After you’ve set the storage quotas for the sites owned by Teams, you can set the Site storage limits setting back to Automatic to allow SharePoint to manage storage for the sites that don’t belong to Teams.

Of course, the problem with any procedure like this is that you need to periodically rerun the code to deal with newly-created sites. To avoid reprocessing sites, you could update one of the 15 customized attributes available for Office 365 groups when you set the storage for a site and check if the attribute is set the next time the script runs.

—————————————

For more on managing Teams with PowerShell, read Chapter 14 of the Office 365 for IT Pros eBook.

Teams is Good, But Maybe Not That Good

Those who read what I have written about Microsoft Teams since its preview in November 2016 and general availability in March 2017 know that I like the application. But that doesn’t mean that I take everything generated about Teams by Microsoft as being 100% accurate. They have, after all, to market Teams in a competitive environment. And although Microsoft has done well in having Teams used by over 500,000 organizations, there’s still lots of potential customers to convince or win from major competitors, like Slack.

All of which brings me to the report written by Forrester Consulting and commissioned by Microsoft titled “The Total Economic Impact of Microsoft Teams.” The report was launched on April 23 by Teams GM Lori Wright, who said “For a standard 5,000-user organization, the study reported benefits and costs of roughly $30.3 million and 3.3 million respectively, resulting in an overall net benefit of $27.1 million over three years.”

Any report paid for by a company deserves some suspicion, if only because few authors will be truly independent when they take on a commission to write such a report. I also wonder whether the authors truly understand the Office 365 ecosystem within which Teams operates.

In any case, I don’t want to trash the report line-by-line. Instead, I thought that I would share some thoughts that occurred to me as I read the report. It’s always important to question the findings and assumptions made in a report to figure out where the real truth lies.

Thoughts About the Savings Claimed

I’m not sure that Teams reduces the number and duration of meetings. That hasn’t been my experience in any organization where I have used Teams. Microsoft seems to still love meetings, for instance, even if they have moved from Skype for Business Online to Teams. There’s no doubt that Teams meetings are much better quality than Skype for Business meetings, but streamlining effectiveness within meetings is much more behavioral-based than achieved through technology (MyAnalytics helps here). Claiming $6.9 million savings over 3 years is a stretch.

The report also says that organizations can reduce spend on other communication software and hardware solutions. It’s true that Teams is included in Office 365, but if you want to use Teams for the full-blown meeting and phone-replacement experience, substantial costs might be incurred for Microsoft Phone System calling plans and hardware (either upgrading or replacing devices with Teams-compatible systems). The report claims savings of nearly $650K. In reality, this might be a negative figure, especially for organizations with multiple meeting rooms.

Online meetings replace 150 overnight trips. This is the nirvana promised by all video/audio communication systems. Over many years, I haven’t noticed much reduction in business travel apart from that forced by economic pressures. A cynic might say that you have to spend on better communications hardware before anyone will stop overnight trips. Still, let’s assume that we can convince some of the 3,500 information workers in the composite organization used as the basis for the report to stop some trips by Year 3, so we’ll keep the $233,080 claimed saving.

A big claim for $14.3 million is based on information workers saving 4 hours (each) per week from improved collaboration and information sharing. Hmmm… I’d like to see a CIO put their neck on the line before a board and make a commitment to achieve this level of savings. The simple fact is that it is enormously difficult to measure how improved collaboration and information sharing affects the bottom line in any large organization. You can aspire to using all the functionality available in Office 365 to do things faster, better, and more accurately, but experience tells us that unless an organization invests a lot in user training and ongoing education, people simply won’t know how to use the new technology and will continue working as they have done for years.

Decision makers improve their time-to-decision by 17.7% and so achieve a saving of $451,273 over three years. Another big doubt in my mind. Is Teams responsible for making people more responsive or is it that Outlook mobile is a great on-the-road email client that helps busy executives organize their thinking better? Does the channel chaos in Teams match the panic that can be induced by an overflowing inbox? If life were perfect and users all understood how to use technology to the maximum, we might be able to achieve these kind of savings, but I don’t see this in reality.

$1.4 million is claimed for improved worker satisfaction, integration, and empowerment. There’s no doubt that many people like using Teams (most of those I know in companies that have Teams are in this category). But I wonder if Teams makes that much difference to people. We know that direct line managers are the single biggest influence over how people feel about a company and whether they stay. Working for a poor boss is always going to be a problem, with or without Teams in the equation. However, on balance, I do think that people like Teams and are happier when organizations make tools like this available to them (the same could be said for Slack and Workplace by Facebook).

Less time is spent switching between applications each day to save $4.8 million over three years. The assumption is made here that information workers will use the 15 minutes they apparently save to do something productive because they’ve been saved the need for cognitive re-engagement. Sounds like some consulting assumptions based on not a lot of data to me. Some people will be more productive; some people won’t. Some will continue working in the way that they’ve done before because it works for them.

Costs

To be fair, the report acknowledges that some costs need to be attributed to the deployment and support of Teams. Our composite organization needs to stump up $1.1 million for internal efforts to implement and support Teams. This figure includes a migration from Skype for Business Online (costing $348,480) and follows the main Office 365 deployment before Teams “can be provided to users with the flip of a switch.”

The cost model used proposes 2.5 FTE to look after the Teams deployment on an ongoing basis, or $343,750 yearly (Figure 2). Two of these people are fully engaged in change management and training while the half-person manages Teams. Two people for 3,500 distributed information workers seems low and that half-person is going to be very busy keeping up to date with all the changes that occur inside Office 365 that might affect Teams, understanding the apps, connectors, and bots that people might want to use, writing some code in PowerShell or the Graph to fill in management gaps left by Microsoft, investigating and reporting problems, and perhaps taking some well-earned time off. The integrated nature of Teams means that the half-person must understand Office 365, SharePoint Online, Exchange Online (possibly hybrid Exchange too), Azure Active Directory, Office 365 Groups, PowerShell, Planner, the apps integrated with Teams, and so on. They will be a busy half-person.

Calculations like this make me wonder if the people writing the report had ever actually used Teams or tried to manage the application in production. The answer is that they probably had not, because they are busy writing reports and can’t be concerned with the details of actually understanding the technology.

Some Value in the Report

Although I have many questions about how the authors of the report came to their conclusions, I acknowledge that reports like this are difficult to write because of the assumptions that need to be made to calculate anything. There’s value to be gained by reading the report, throwing away anything that seems outlandish, and asking yourself if what remains can be put into the context of the unique business and technology circumstances pertaining to your organization. This is where real value lies: understand how reports like this are constructed; the questions asked and the responses made; and how a case is constructed to answer the question whether the deployment of a technology has financial benefits. You might be able to create your own version of this report to match your needs, and if you can, there’s value to be gained.

Remember the old adage that external consultants can only ever come up with 50% of an answer based on their experience. You have the other 50% coming from your knowledge of the people, politics, stresses, and technology that exist within the organization. Put the two halves together and you might get a good answer.

Need help understanding the realities of Office 365 and Teams? Look no further than the Office 365 for IT Pros eBook. We might not have fancy financial footwork, but we do have facts – lots of them.

Feature Supported in Both Outlook for iOS and Android

Being able to schedule Teams (and Skype for Business) meetings has always been a popular feature in Outlook desktop and OWA. The feature is now supported in the latest builds of Outlook for iOS and Android and turned up in my client this week when I installed build 3.21.0. The feature was originally announced in Message Center update MC173895 on 20 February, and the roll-out was due to start at the beginning of April, so it’s a little delayed.

Outlook mobile and Teams are both on a roll recently. According to data released with Microsoft’s Q3 FY19 earnings, Outlook mobile is used by more than 100 million people. A reasonable proportion of that set are likely found in the more than 500,000 organizations using Teams. Bringing the two apps closer together adds a lot of value, especially in a mobile-first world.

Skype for Business Online Co-Existence Setting is Important

MC175147 issued on March 2 describes how the Skype for Business Online co-existence setting for the tenant affects if Outlook mobile offers the ability to schedule Teams or Skype for Business Online meetings. if the co-existence mode is set to be “Teams Only” or “Skype for Business” with Teams Collaboration and Meetings, you’ll see the option to schedule Teams meetings.

No Tenant Dependency

Unlike Outlook desktop, the Teams client on your mobile doesn’t have to be connected to your home tenant to be able to create a meeting. Outlook mobile can happily create a meeting in your home tenant while the Teams client is connected to a guest account in another Office 365 tenant.

Exploiting the New Outlook Synchronization Technology

Being able to schedule Teams meetings is not dependent on the new Outlook connection/synchronization architecture. My client still connects to Office 365 using the older REST-based synchronization (my Outlook.com account uses the new technology). Given that Outlook.com and Exchange Online share the same infrastructure, it might seem odd that business accounts persist with the older synchronization when a consumer account benefits from the change, especially when some features (like one-click join of Teams meetings from Outlook mobile described in MC175147) depend on clients using the new technology.

Ross Smith IV of Microsoft explained the situation on 12 March in a response posted in the Microsoft Technical Community saying ” For Outlook mobile, major feature deployment operates with a staggered rollout where we begin with consumer accounts (if applicable) and then deploy to commercial accounts like Office 365. Our primary focus for commercial accounts was moving Government Community Cloud. Now that’s complete, we’ll be focusing on the remaining Office 365 tenants.”

You can discover what synchronization is used by Outlook by looking at the properties of an account. If you see “Microsoft Sync Technology” (as circled in Figure 2), you know that Outlook connects using the new architecture.

Like everything else inside Office 365, it’s likely that the deployment of the new Outlook connection architecture varies from datacenter region to region and even from country to country. I’ll look forward to seeing the new synchronization

We cover Outlook mobile among other Office 365 clients in Chapter 10 of the Office 365 for IT Pros eBook.

Teams and Deep Links

Unless you’re a programmer, you might not be aware of deep links and how Teams uses these special form of URLs to navigate to find information. Deep links are used extensively within the client. For example, if you use the Get link to team option, you’ll get a URL like:

https://teams.microsoft.com/l/team/19%3a3380a323d4114b3193cd0ae15ef116b1%40thread.skype/conversations?groupId=e141d2a4-a14c-4865-928e-31f13397d9de&tenantId=a662313f-14fc-43a2-9a7a-d2e27f4f3478

The link means nothing to humans, but Teams finds it terrifically interesting as it can use the information to navigate to the team.

Deep Link for a Chat

In any case, a deep link can also be used to automate operations, like starting a personal chat with one or more Teams users within your tenant. In this case, the deep link is much simpler. The link below starts a chat with Brian Weakliam, or, if the user has already chatted with Brian, continues that chat:

https://teams.microsoft.com/l/chat/0/0?users=Brian.Weakliam@Office365itpros.com&topicname=Chat

Creating an Email Signature with a Chat Link

This leads us to the idea of putting a chat link in your email signature. Both OWA and Outlook support the creation of HTML format signatures so there’s no problem to insert the link (Figure 1). If you have problems, compose the signature in Word or another editor and paste the results into Outlook or OWA (and yes, it would be nice if the two clients used the same signatures).

The new signature complete with chat link is inserted in outbound messages. Recipients can click the link (Figure 2) to start a chat using either the Teams browser or desktop (if available) client. The link only works when the sender and recipient are in the same Office 365 tenant.

This is the kind of small detail that amuses us when we find it. Learn more amusing and interesting details about Teams in Chapter 13 of the Office 365 for IT Pros eBook!

Exchange Online Address Book Policies

Exchange Address Book Policies (ABPs) lets organizations sub-divide the directory into multiple segments (represented by an ABP), each of which has a Global Address List (GAL), Offline Address Book (OAB), and other address lists. An ABP might be used to define users within a subsidiary company, or those who work in a certain country, or to divide students and teachers, and so on. Once an ABP is assigned to their mailbox, the user can only “see” other users who come within the scope of the ABP.

ABPs don’t create a watertight block against communication. A user limited by an ABP sees the other users defined by the ABP when they view the GAL or OAB, but they can always send email to people outside the ABP by addressing messages using SMTP addresses.

Using ABPs with Teams

Teams is an application built on top of many other parts of Office 365. As such, it shouldn’t come as a huge surprise that Teams uses Exchange ABPs to limit the ability of users to communicate with others within the same organization. There’s a lot of sense in this approach because if you have gone to the bother of defining ABPs for Exchange, you can reuse the same ABPs with Teams.

To enable ABPs for use with Teams, go to the org-wide settings section of the Teams Admin Center, select Teams settings, and scroll to the bottom of the list to move the Search by name slider to On (Figure 1). Then Save the updated settings. It will take some time for clients to become aware of the update and adjust their behavior.

When an ABP is in place, users won’t be able to use chat to communicate with users outside the scope of their assigned ABP. Also, users won’t be able to add people outside their assigned ABP as members of a team.

Discovery is Affected

What’s not known as well is that users cannot search or discover teams when ABPs are in use within a tenant. Normally, when you select the Join or create a team option, Teams displays a set of public and private teams that you might want to join. The list of suggestions is calculated by the Microsoft Graph based on signals from your activity (to know what you do) and the people you communicate with. For instance, if you chat regularly with five or six other people who are all members of a certain team, it’s likely that you might find that team interesting and so Teams will add it to its suggestions (Figure 2).

However, when ABPs are in effect, Teams can’t come up with suggestions because it cannot filter the set of teams returned by the Graph using the scope applied to the user. At least, that’s my understanding of the issue. Because Teams can’t apply the scope, it simply ignores the suggestions and doesn’t suggest anything, meaning that the user nothing except the offer to join a team through a code (Figure 3).

Because Teams has no suggestions to make, it also removes the /Join command (to show a list of suggested teams to join) from the set you can type into the command box.

ABPs are designed for email and not for Teams, so it’s inevitable that applying ABPs to Teams would have some unusual consequences like this. You learn something new every day.

Need more information about how Teams works? Well, the best place we know of is Chapter 13 of the Office 365 for IT Pros eBook. The number of changes in Teams means that Chapter 13 is one of the chapters we update most frequently.

New Option to Remove User from Teams Chat When Required

A group chat is a conversation in Teams between three and 250 people. The participants can be a mixture of tenant member and guest users. Group chats can be very ad-hoc affairs or they can last for an extended period. They can be given names (a good idea to help track what’s being discussed in chats) or not.

Up to now, it has not been possible to remove someone from a group chat, meaning that if you make a mistake and add someone who shouldn’t be in a chat, the only way you could correct the mistake is to create another group chat, add all the other participants, and leave the person you want to exclude out. Obviously, this is not very efficient.

Removing Someone From a Teams Group Chat

The ability to remove users from group chats is controlled by the Teams messaging policy assigned to users. Obviously, people in a chat might be assigned different policies, so it’s possible that some participants in a chat can remove users while others cannot. Assuming that the assigned messaging policy allows, to remove a chat participant, open the chat participant list and click the X beside the name of the person you want to remove. Figure 1 shows the user interface for the Teams desktop and browser clients while Figure 2 shows how to do the same thing with the Teams iOS client.

After a participant has been removed, they still have access to all the messages sent up to the point when they were removed. However, they can no longer send messages (Figure 3).

Guest accounts who are participants in group chats can’t remove other participants. However, both tenant and guest accounts can choose to leave a chat at any time. It’s good housekeeping practice to leave chats that no longer discuss anything of interest to you. The only chat you can’t leave is the chat with self.

Correcting Mistakes

If you make a mistake and remove someone whom you shouldn’t have, you can correct the error by adding them back to the group chat (Figure 4), making sure to include all chat history so the newly-rejoined participant doesn’t lose out on any information that’s been shared in the chat.

You can play games with removing and adding a person. For example, you could remove someone, make some horrible remarks about them, and then rejoin them to the chat but make sure not to include any chat history. The rejoined individual can see all the messages sent in the chat before they were removed and those sent after they rejoined, but not the offensive ones in the middle. They might guess that something happened by looking at the notes of additions and removals Teams records when people join and leave a group chat, but they might not.

Group Chats Not Owned by Anyone

The critical thing to remember is that the Teams architecture regards group chats as being equally owned by the participants. Any participant can remove another participants from a group chat and anyone can add someone to a group chat. It’s all very democratic.

Need to know more about how to use Teams? Read Chapter 13 of the Office 365 for IT Pros eBook. The chapter in the latest update is 90 pages long (in the PDF edition). We must have some useful information there!

Splitting Teams into Favorites and More

In Office 365 Message Center notification MC177587 called “Focus on your active teams,” Microsoft announced that they will be rolling out a feature to declutter Teams clients in early May to be completed worldwide by the end of June. The feature splits the display of teams within the “team gallery” into Favorites, those that a user accesses regularly, and More, or teams that have not been accessed in the last 45 days.

It was inevitable that Microsoft would have to introduce a feature like this. Limited space is available in clients to display the teams list and over time, that list grows. Teams on the list might belong to projects that you participated in at one time but not now, or finished projects, or discussions that you are mildly interested in, and so on. In short, teams can be a chaotic mess.

Automatic Movement to More

The documentation for the feature says “to keep you organized, we’ll automatically move teams you haven’t visited in several weeks to the More menu at the bottom of your teams list.” In other words, background processes periodically scan the set of teams available to users to look for teams that haven’t been accessed in the last 45 days (approximately, depending on when the background scan happens). Any teams meeting these criteria go into the More section of the teams list.

Users are notified when Teams move teams into the More section and have the chance to reverse the process by moving the teams back into Favorites.

For whatever reason, perhaps because disappearing teams used for classes are a bad idea, this feature is unavailable in Teams for Education.

Out of Sight But Always Available

It’s essential to give users a heads-up about this change as otherwise you run the risk that people will panic when teams disappear, even if they are notified (it’s the kind of thing that people click on and forget). Out of sight might mean out of mind in that users can concentrate on the teams most active and important to them, but it’s critical that users understand that all the teams they belong to remain accessible and that they will see activity for hidden teams in their activity feed.

If someone discovers that the automatic check moves a team they want to track into the More section, they can always mark it as a favorite to move it into that list. To restore a hidden team and make it a favorite again, click to expand the More list to view the set of hidden teams (this list is organized alphabetically) or search for a team and then mark it as a favorite.

There’s no way to mark a team as a perpetual favorite.

For more information about Teams, read Chapter 13 of the Office 365 for IT Pros eBook.

Easily Add New Members to Teams

Teams is a vehicle for open communication, which is why structures like org-wide teams exist. In the case of public teams, anyone can join the team by adding themselves to the membership, and in the case of private teams, users can request to join the team. These requests are then processed by team owners, who decide to accept or deny the request.

On April 2, Microsoft issued Office 365 notification MC177013 to say that Teams supports a new option to allow team members to nominate others to join private teams. The change is now rolling out and should be complete by the end of April.

In a nutshell, instead of someone asking to join the team, an existing team member can now propose (request) them for membership. A nomination from someone trusted (because they’re already a team member) is more likely to be accepted by a team owner than a request coming in from J. Random Nobody.

Making a Proposal

To nominate someone, click Add member from the […] menu or the team’s Manage team menu. You can then input the names or email addresses of the people you want to join the team. Only individual tenant accounts can be proposed: you can’t add guest users or use distribution lists to add a set of users.

Once done, click Send Request. Teams notifies the team owners that pending requests are waiting action in their activity feed and via email.

Processing Pending Requests

Team owners can click the link in the email notifications or the entry in the activity feed to be brought to the set of waiting requests. These include requests made by team members and those generated by people who proposed themselves.

The owner can now accept or deny the requests. People who are proposed and accepted don’t receive a notification that they’ve been successful. Instead, Teams adds the team to their list of teams and notes the new membership in the General channel. The user can access the team immediately (if they are logged in) or the next time they start Teams.

Changes like this happen all the time. This one is small (unless you’re being nominated to join a really interesting team), but we’ll note it in Chapter 13 of the Office 365 for IT Pros eBook.

Slow Progress for the Teams Admin Center

Building out its ability to manage Teams (rather than users or policy settings), the Teams Admin Center now boasts the ability to delete teams and archive or unarchive teams. A more prosaic but still useful addition is the expansion of columns supported by the Manage Teams view to include properties like privacy (public or private) and classification. (Screen shot taken with the Edge Dev browser, just to see would it work – and it does).

Given that Microsoft launched the ability to manage teams in the Teams Admin Center at Ignite 2018, you might wonder why it’s taking Microsoft so long to build out the management features in the console. A dependency on underlying APIs is part of the reason. Team owners can use the Teams clients to remove and archive/unarchive teams, but that doesn’t mean that the same operations are possible using the Graph API (or PowerShell).

The Need for an Updated Graph

Upgrading the Graph to handle Teams management operations appears to be the major factor in several delays, including the provision of APIs to ISVs to handle migration and backup scenarios.

Despite the claims of some vendors to support backups for Teams by copying the compliance records for personal chats and channel conversations from Exchange Online, this is not a true backup. Not all the data is copied and it’s impossible to restore conversations from compliance records. ISVs need Microsoft to deliver a high-speed access API for Teams before backups are possible (if you decide you need backups for Office 365, but that’s another story).

More Complications

Another complicating factor is that much of the recent work done to upgrade the Teams Admin Center has been to support the migration from Skype for Business Online to Teams. A lot of work has been done recently to make the transition easier.

A further complication is that Microsoft has a history of spending less time to develop management utilities and programs to support applications like Teams than they do building out user-facing features. Every few weeks Microsoft trumpets some new client features (like Praise) while a slower pace applies to management features.

Still, we shouldn’t be ungrateful. It’s good to see the portal develop and new capabilities arrive. It would just be nicer if things happened a tad faster.

For more information about managing Teams, see Chapters 13 and 14 of the Office 365 for IT Pros eBook. Chapter 14 is where we do DIY management using PowerShell, which can be more rewarding and functional than the OOTB features.

Any Member of a Team Can Delete a Channel

By default, any member of a team can delete a channel. The sole restriction is the General channel, which cannot be removed. If you want to stop team members deleting channels, edit the team settings and uncheck the box to “allow members to delete and restore channels.”

When a channel is deleted, Teams hides the messages that make up channel conversations and starts a 21-day countdown. During this period, a team owner (or a member, if allowed), can restore the channel. Once the period elapses, Teams permanently removes the conversations and they become irrecoverable. However, Teams leaves any data accessed through the channel tabs alone. Although this might surprise some, “Do No Evil” is the right approach.

SharePoint Folders and Teams Channels

Every channel in a team has a folder in the document library in the SharePoint Online site created by Office 365 when it provisions the Office 365 group belonging to a new team. When you create a new channel in a team, Teams creates a folder with the same name in the document library to store files uploaded to the channel. The folder is accessed through the Files tab in the channel (or the SharePoint browser interface). Because Teams creates a folder when it creates a channel, you might think that Teams should remove the channel folder from SharePoint when a channel is deleted. However, this doesn’t happen.

The fundamental reason why the folder is left is that Teams and SharePoint Online have a close but loose relationship. Creating a folder does no harm, but deleting a folder can be very destructive. Teams stores files in the folder, but other applications can store files there too, and users are able to access the folder to work with its content through the SharePoint browser interface. It’s therefore possible that some extra content might be uploaded to the folder that isn’t associated with channel conversations. If Teams deleted the folder along with channel conversations, it would remove that information too. As the support article for the topic notes, the folder also holds some OneNote sections that you might want to keep.

Retention Might Prevent Deletion

Another reason is that Teams cannot assume that it can remove content from SharePoint. The site, document library, or individual files might come within the scope of an Office 365 retention policy, or individual files might be assigned a retention label. In either case, the presence of retention settings can prevent the removal of SharePoint content.

Examine All Channel Tabs

If you want to clean up all traces of a channel, you must first remove it from Teams (and wait for the 21-day countdown to finish) and then remove any other content associated with the channel. The most obvious content is in SharePoint, but there might be other content linked to tabs like plans, forms, and so on. For this reason, before you delete a channel, check out the tabs to understand what content is linked to the channel and then decide what should be removed and when.

For more information about Teams, see Chapter 13 of the Office 365 for IT Pros eBook. Office 365 retention policies and labels are explained in Chapter 19.

Graphical Acknowledgements From Teams

Office 365 message center notification MC176548 tells us that Microsoft began rolling out the “Praise” feature for Teams on March 27. According to the update, Praise gives users the opportunity “to recognize their colleague’s contributions by sending various badges.” Microsoft’s support article for the feature goes even further and encourages us to “Revel in the good vibes,” which sounds awfully like a line from a song by the Beach Boys.

You’ll know when Praise has reached your tenant when Praise icon turns up under the message compose box. In the mobile clients, Praise is in the […] menu, although this might change in the future. Badges can be sent in personal chat and channel conversations by tenant and guest users.

Limited Badges

To praise someone, select the app, select the badge you want to use. There’s only the set provided by Teams to choose from – you can’t add new badges. (It’s already been suggested that a Nerd or Geek badge would be appropriate). In September 2020, Microsoft delivered the ability to create custom badges to allow organizations to create their own accolades.

Sending Praise

Next, select the user (or users) you want to send praise to and enter the custom message to go along with the badge. If you send praise in a channel, you can only select recipients from the members of the team (including guests). If you send praise in a personal chat, the recipients must participate in the chat. When finished, click Preview to see the complete message and then Send to dispatch it to the recipients.

Because praise messages are like @mentions, recipients get a notification in their activity feed. And then they notice that they’ve been praised and get a nice warm glow all the way down to their toes.

In some respects, a praise message looks like one that you could compose with a sticker or GIF plus an @mention to the folks being praised. That’s true, but the praise message looks neater and its purpose is clear: you want to appreciate something someone has done.

Guest Access

Guest members of a team see the praise app but they cannot use it to praise other team members as the app fails to fetch the set of team members to allow the praise to be sent. Guest users can send praise in a personal chat, but the other person’s name doesn’t appear in the message. On the upside, tenant users can praise guests in both chat or channel conversations.

Partial Compliance Record

One thing I noticed is that the compliance record captured in Exchange Online for a Teams praise message doesn’t include any graphic content. Below you can see what Outlook displays after finding and exporting a praise message with an Office 365 content search. The text is similar to what’s displayed in Teams, but it’s not the same. Compliance officers don’t like when things are different, so it remains to be seen if Microsoft will update the capture of these messages so that the compliance records are a true copy.

Some Will Like Praise, Some Won’t

Not being one of the fabled millennial community, I don’t quite know if I like praise or not. I have never had a problem saying thank you or acknowledging people in other ways, so I guess this is just another way of getting the job done. Maybe it will grow on me, much like @mentions and reactions.

Praise is not available for tenants in the GCC sovereign cloud, probably because government employees are far too busy to engage in badge-driven tomfoolery.

Need more information about Teams? Read Chapter 13 of the Office 365 for IT Pros eBook. We don’t cover Praise today, but it will be in the April 2019 update, along with all the other stuff that’s changed inside Office 365.

Teams Communication with Users in other Microsoft 365 Tenants

Updated 1 June 2023.

In the context of a messaging application like Teams, federation means that your tenant allows connections with people belonging to other organizations. For example, if my tenant is federated with Microsoft’s tenant, I can use Teams federated chat to message and call users belonging to the Microsoft tenant.

Being able to reach outside the boundaries of your tenant is a big thing for a communications client. Teams was slow to make this happen, but now External Access (the term Teams uses for federation) works well if you enable the feature in your tenant by turning it on in the org-wide setting section of the Teams Admin Center. You can also set up a list of allowed or blocked domains. If no list exists, any user in another Office 365 tenant can connect to users in your tenant.

Finding an External User

External access is not the same as the access enjoyed by Azure AD guest accounts. It’s much more limited (think chats and calls) whereas guest access can allow someone to have extensive access to tenant resources (groups, teams, sites, individual documents). Along with the ability to chat and call (on an individual basis), external users can see presence information for other people. And most important, they can search your tenant directory to find people.

An external user can’t browse your directory. Searching means that they can input an email address (or SIP address) into the search box to instruct Teams to look up the name in the tenant owning the domain name part of the email address (Figure 1). And if a match is found, Teams launches a 1:1 chat. The trick is to have Teams search externally (see below). If you don’t see this option, you know external access isn’t enabled in your tenant.

A Potential Lack of Emojis in Teams Federated Chat

Once the chat starts, you’ll discover other limitations. Most importantly, you can’t share files with an external user (you can upload a file to OneDrive or another sharing site and then send a link). Somewhat less critically, you can’t use emojis or reactions (like) in a response unless both tenants are configured in “TeamsOnly” mode. Both the iOS and Android clients support emojis in their native keyboards and it’s possible to insert them with the desktop client using the Windows + ; (Windows key plus semi-colon) combination.

Fewer text formatting options are available too. Teams gives a visible indicator (Figure 2) that you’re using a federated communication by displaying the address of the external user in the title bar.

Apart from these restrictions, a chat with an external user is much the same as with a tenant or guest user. Apart from a potential lack of emojis, it’s as easy to communicate externally with Teams as it was with Skype for Business.

Controlling Teams Federated Chat

At the organization level, the Teams admin center (Figure 3) offers these options to control Teams external access/federated chat:

• Allow all external domains. This is the default, chosen because Microsoft wants to encourage organizations to communicate and collaborate together.
• Block all external domains.
• Block only specific external domains.
• Allow only specific external domains. This is the option I suggest organizations adopt, if only to avoid potential attacks like the GIFShell demonstration. It’s possible to update the allowed external domains list with PowerShell. I show how to do this in an article explaining how to add external domains for guest accounts present in the tenant.

For more information about Teams, read Chapter 13 of Office 365 for IT Pros. Teams meetings are covered in Chapter 16.

Teams New Features On the Way

Teams won the Best in Show award for the second year running at the Enterprise Connect show in Orlando, FL today. As is normal, Microsoft trotted out a series of announcements to excite and delight fans, including the long-awaited announcement of private channels (aka secure channels), scheduled for availability “later this year.” Microsoft hasn’t released details of how private channels will work or how they will make it possible for members of a private channel to have secure access to content without other team members being able to see that content.

Background blurring in video meetings is due to get more interesting with the advent of customized backgrounds. Essentially, Teams replaces your real background with an image of your choice (think of a beach in Hawaii…). I’m a lot more impressed though by content cameras and intelligent capture, which allows Teams to remove someone blocking the view of a whiteboard during meetings. See the Teams blog for information about other features due soon.

Growth Rate Increasing

Microsoft’s press release also included the news that Teams is now used by 500,000 organizations, a growth of 80,000 organizations over the figure announced at Microsoft’s Q2 FY19 results in January. Microsoft also says that 91 of the Fortune 100 use Teams, a gain of 2 since January and that 150 of the 500,000 organizations have more than 10,000 users. The new numbers put an even better light on Teams versus Slack and Workplace as Teams is now adding 40,000 organizations per month.

Need more information about Teams? Read Chapter 13 of the Office 365 for IT Pros eBook and you’ll find lots of interesting nuggets. Chapter 16 covers using Teams for meetings and the transition from Skype for Business Online.

Teams: Following and Favorites are Confusing

In message MC175213 posted on March 5, Microsoft announced that they’re changing the “channel action” terminology used in Teams to describe how users organize teams and receive notifications of activity in team channels. Apparently, the old model of marking some teams as favorites and following what happens in interesting channels can be confusing.

Favorites follows a similar model to that used in Outlook. When you mark a team as a favorites, Teams moves that team to the top of the list of teams shown in the client, just like Outlook moves favorite folders to the top of its folder list. Other, non-favorite teams, are found further down the list. The user can drag and drop favorite teams to organize them into their preferred order.

Show and Hide

In the new approach, you’ll be able to use the Show option to mark a team to appear in the list of teams visible in the client, and Hide to remove a team from the list. Hidden teams remain accessible to the user, but need to be exposed by clicking a More link. The idea is that the words Show and Hide more accurately represent what the user actually does to mark teams they interact with most often or put other teams that they still want to access (but not as often) into a place that’s easily accessible. Current teams marked as favorites will have the Show flag set while the other teams will have the Hide flag set.

Notifications

Today, you follow a channel to make its activity appear in your activity feed or unfollow it when you want notifications of what happens in the channel to disappear. It’s a relatively simple on-off model. Microsoft has been asked by customers (including some high-voted User Voice requests) to improve how notifications are handled and that’s what seems to be coming down the tracks as “additional notification preferences” are promised.

It’s likely that Microsoft will allow users some control over the kinds of notifications that they get from a channel. Sometimes team members can make profuse use of @channel and @team mentions to make sure that their opinions are broadcast to all and sundry. It would be nice to be able decide exactly what types of messages you want to see (for instance, don’t show me replies even if an @channel mention is used). We’ll see in due course.

Signs of Maturity

Changes like this are signs that Teams is maturing nicely. Flaws in terminology and structure only appear with use and are confirmed by a large volume of user interactions in multiple diverse organizations. The size of the Teams installed base and its use in 420,000 organizations is enough for Microsoft to have a reasonable spectrum of opinions about how to improve the client. Although I was never confused by the old model, it seems like I was in the minority.

The new code will roll out to Teams clients beginning in March. Microsoft says that roll-out will be complete worldwide by the end of May. I can’t wait!

Change like this drives the authors of books crazy because we have to change text and graphics to reflect the new terminology. When we see the new code show up in Teams, we’ll start the process of reviewing and updating Chapter 13 of the Office 365 for IT Pros eBook. What joy! But it does prove the advantage of the ePublishing model for technical books about cloud topics…

The Battle Between Teams and Slack

At the end of January 2019, Microsoft said that the adoption of Teams had accelerated to reach 420,000 organizations. Just around the same time, Slack announced that their daily active user count had reached 10 million and that 85,000 organizations pay for Slack. This number represents a growth of over 50% in customers who pay, which is obviously good news for Slack as they head for either an IPO or direct offering of shares to the public.

Slack didn’t say how many users pay to use the platform. The last figure on the statista.com site (May 2018) put the number at around three million. At the time, Slack’s user count was around eight million, so given the growth in two million users overall, the number of paid users might be around four million.

The Question of Payment

Microsoft’s data didn’t specify how many of the organizations using Teams pay for the privilege. The free version of Teams seems to be popular, but given that Microsoft bundles Teams in Office 365 Business Premium, Enterprise, Education, and Government plans, it’s probable that most use comes from companies who pay through their Office 365 subscriptions.

The close integration between Teams and other parts of Office 365, especially SharePoint Online, and the transition of workload from Skype for Business Online to Teams are other factors that drive user growth.

Teams Numbers

Last October, we calculated the number of people using Teams might be as high as 33 million. Given the growth since, that number might now be in the 40 million range. Only Microsoft knows and they’re not saying. However, given that Office 365 continues to grow at approximately 3 million users per month, Teams has a lot of potential growth ahead of it.

One thing Microsoft did say in January is that 89 of the Fortune 100 use Teams. Slack claims that 65 of the same companies use their product, so a considerable overlap exists between Teams and Slack. However, we do not know how many of these companies have elected to use both (for different user communities) or how many are in the process of migrating from Slack to Teams or vice versa.

Workplace Competing Against Teams or Yammer?

Another point of comparison comes from Workplace by Facebook. Although sometimes considered a competitor for Teams, Workplace is more often compared to Yammer. In February 2019, Facebook said that they had 2 million paid users of the platform, with 150 companies having 10,000 users or more (representing a remarkably high percentage of the overall user number).

This compares to Microsoft’s assertion (at the Ignite conference in September) that they had 60 customers with more than 10,000 people using Teams. Given the growth in Teams since, that number is likely higher. The largest Teams customer reported to date is Accenture, with over 170,000 users.

Workplace has had some success going up against Yammer recently, as in the case of GSK. The recently-added support of larger teams of up to 5,000 members might make Teams a more competitive offering when Microsoft goes to bat against Facebook, especially as Teams boasts better integration with the rest of Office 365 and hooks for developers to exploit than Yammer does.

It’s all getting very interesting in the chat-spaced collaboration space, and we haven’t even mentioned WebEx Teams…

For more information about Teams, read Chapter 13 of the Office 365 for IT Pros eBook. We cover much more than business stuff there…

Teams Hits the Buffers

Everything was progressing normally until lunchtime (UTC) Monday when my Teams desktop decided that it didn’t want to connect to the Teams back-end services any longer. Dutifully reporting “D’oh Something went wrong…” and issuing a totally unhelpful 500 error code because the client couldn’t connect to https://teams.microsoft.com (or even just https:// at times), the problem turned out to be the first major world-wide outage for Teams.

During the incident the Teams mobile client continued working. This is probably due to the way that the desktop/browser clients authenticate once an hour to refresh their tokens while the mobile client uses a different mechanism. The desktop and browser clients are built with Electron and the desktop client is essentially a wrapper around the browser client. Hence the common behavior. In any case, once the time came for the client to reauthenticate itself, it failed and “D’oh” appeared. No amount of signing out and back in again helped because the problem existed in the Teams back-end services and the client could not obtain the necessary token.

No Joy Found in Teams Logs

Examining the Teams logs (click the Teams logo in the system tray and select Get Logs from the menu) didn’t shed any light onto the problem. Here’s an example:

Scenario.Name: desktop_win_sso, Scenario.Step: stop, Scenario.Status: success,  
Mon Feb 18 2019 15:35:47 GMT+0000 (GMT Standard Time) <23544> -- event -- name: desktop_page_bad_response, responseCode: 500, errorUrl: https://,  
Mon Feb 18 2019 15:35:47 GMT+0000 (GMT Standard Time) <23544> -- info -- Handled get response details with http response code 500: https:// 

If you search the internet, the advice for dealing with a 500 error is often to remove all Teams credentials from the Windows Credential Manager. That can help if you have some local corruption, but it has absolutely no effect when a back-end service is bust.

Understanding the Status of Incident TM173756

The Microsoft 365 Status Twitter account informed the world that incident TM173756 was progressing. Further information was available in the Office 365 Admin Center. According to the Admin Center, the incident began at 8:23 UTC. I wasn’t affected until around 13:00 as part of a spike in problems (perhaps when the throttling referred to below happened) reported to DownDetector.com happened. Microsoft’s summary given when the incident finished at 18:00 UTC was:

Final status: Further investigation determined that rerouting traffic to alternate healthy infrastructure didn’t have the desired effect. Engineers implemented a configuration change to improve efficiency of Teams authentication components to completely remediate impact.

Preliminary root cause: A transient error, or currently unidentified update caused Teams front-end services to encounter errors when attempting to fetch password store keys. The errors resulted in many retries to the service that contains the key values, and eventually the service throttled attempts to fetch further keys in order to prevent further impact to other services. Engineers updated the configuration within the authentication service to mitigate password store key retrieval issues.

Not that regular users knew about these sources of information and were able to find out what was happening. All they knew was that they couldn’t get into Teams. Because Teams is an online service with no offline capability (unlike Outlook, for instance), user productivity within Teams fell dramatically. On the upside, resources connected to Teams like Planner and SharePoint continued to be available and accessible to users.

Because this was the first major worldwide outage for Teams, we haven’t seen the effect of a major problem for Teams before. With over 420,000 organizations now using Teams, the potential impact on customers was obvious.

The Post-Incident Report

Within 48 hours of a serious incident, Microsoft issues a Post-Incident Report (PIR) to explain what happened and the actions they propose to take to avoid similar situations in the future. The preliminary version of the PIR is now available to Office 365 tenants affected by the outage through the Service Health (History) section of the Office 365 Admin Center (or download using the link below). The findings of the PIR might change over time as more information becomes available to Microsoft.

Although the “underlying catalyst of the issue is still under investigation” (Microsoft-speak to say that they still don’t know exactly what caused the problem), the PIR gives some insight into the problem and how Microsoft worked to restore service.

Analyzing the Outage

Stepping through the PIR, we find the following:

• The first report to indicate a problem appeared in telemetry at 8:23 UTC.
• Microsoft seemed to regard the telemetry as being inconsistencies rather than a real issue until 13:29 UTC when load spiked, possibly due to load coming from U.S.-based tenants at the start of their working day. You can see the spike in the DownDetecter.com graph.
• 28 minutes later, Microsoft made the incident a high-priority investigation and started to analyze the telemetry. The delay is possibly due to waiting to see if the underlying cause of the spike rectified itself as well as the time needed to understand exactly what was going on.
• Pretty quickly, engineers figured out that the problem was confined to the browser and desktop clients. However, it then took a further hour before they reviewed recent changes and decided to roll back a change made on February 15 (15:24 UTC).
• The rollback had no effect. At 15:51 UTC, attention focused on Azure Key Vault, one of the services Teams depends on. Given that users had issues signing into Teams, the problem was always likely to lie along the authentication route. Some 30 minutes later, engineers found that “service automation” had throttled access to Key Vault to stop multiple retries by Teams clients from affecting other services that depend on Key Vault.
• at 16:30 UTC, a failover to “alternative authentication components” began (we’re not told what these components are) and 14 minutes later after the failover completed, the service health began to improve for U.S.-based customers. European customers took longer (my service was restored at 18:00 UTC).
• Some problems were noted after the failure that were fixed by a configuration change. The incident finished at 18:00 UTC.

The PIR notes that Microsoft has made a fix to stop the same issue happening again.

Overall, some criticism might be made of the five-and-a-half hour delay between the first observation that an issue might exist and the time when Microsoft engineering swung into high-priority action. However, the nature of cloud services is that they generate a ton of telemetry and not every signal means that a problem exists. The PIR notes that “internal automation” triggered an alert when a threshold was reached (13:29 UTC), which corresponds to when user load increased.

As you’d expect, Office 365 administration is highly automated to help humans decide when they need to intervene, which is exactly what happened here. Once the problem was declared an incident, things progressed reasonably quickly given the scale of the impact on users. What’s interesting is that this was a world-wide outage affecting users in multiple Office 365 datacenter regions. This points to a single point of failure (like the MFA service outage in November 2018). It would be good if Microsoft addressed these weaknesses too as they investigate and remedy errors in the service.

Slack has Outages Too

Slack is the major competitor for Teams. To be fair to Teams, Slack has its own problems and outages. It just goes to show that at times cloud services will experience issues. The question is less about how issues occur, it’s more about how quickly service providers recover and their communication with customers. In this instance, Teams recovered reasonably quickly but Microsoft has still work to do when it comes to communications.

Chapter 13 of the Office 365 for IT Pros eBook is the best place to learn about Teams. You might also want to delve into Chapter 4, because that’s where we cover things like the Office 365 Admin Center. And Chapter 2 is where we talk about PIRs. We have lots of stuff that’s relevant to this discussion.

Something’s Always Changing inside Office 365

The Office 365 for IT Pros writing team does our very best to track the ongoing changes within the service so that we can analyze and report on important updates in the book. Given the volume of change, not all of which shows up in the Office 365 Roadmap or publicly announced by Microsoft, it’s a task that keeps us busy. This week was no exception. Here are some interesting things that happened.

Microsoft Responses to Dutch Complaints about Office

In November 2018, a Data Protection Impact Assessment (DPIA) report for the Dutch Government slammed Microsoft because of the volume and type of data gathered by Office 2016 and the Office Online Apps. Microsoft uses the data to track how people use their technology and identify problems, but in the era of GDPR you’ve got to be careful about consent, ownership, and control of data.

Politico.eu reports that Microsoft has committed to update the Office desktop products by the end of April 2019. What’s missing is any discussion about changes for the Office Online Apps, specifically SharePoint Online, or the other information gathered by Office 365 in places like the audit log (see my Petri.com article for details). I feel there’s more to come here.

Yammer Feels Pressure from Teams

The news that Yammer had lost out to Workplace by Facebook in GSK was known last November. To balance the ledger, Microsoft has large multinationals like Shell and public bodies like the Belgian Police to talk about how they use Yammer. On the surface, it’s OK to lose some customers if you’re gaining others.

But the fact that Teams now supports teams with up to 5,000 members puts pressure on Yammer from an internal source. Microsoft marketing uses an inner-outer loop analogy to position Teams and Yammer and worked quite well when the largest team maxed out at 2,500 members. Doubling the limit makes Teams a bigger danger to Yammer because it cuts the number of companies who need to deploy Yammer to support large-scale conversations.

Things aren’t all rosy for Teams. A 5,000-member conversation could be bedlam and the management tools mightn’t be quite ready to support such large groups. On the upside for Teams, it is better integrated into Office 365 than Yammer is, especially in terms of compliance and eDiscovery. It’s also true that the market growth is in Teams, so where this all leaves Yammer, even if its new management delivers what was promised at Ignite 2018, is anyone’s guess.

Exchange Fixes a Privilege Elevation Vulnerability

On Patch Tuesday this week, Microsoft issued updates for Exchange 2010, 2013, 2016, and 2019 to address a privilege elevation vulnerability. Unusually, Microsoft changed the internal architecture to address problems in Exchange Web Services (EWS) push notifications and its connection to Active Directory.

It’s interesting that although many reports were published about the original problem and the dire consequences that might ensue should an attack penetrate your Exchange server, relatively few sites followed up with coverage about the fixes. This proves that bad news is always easier to sell than good. It’s also worth noting that no evidence exists that the techniques exploited by the vulnerability were ever used to attack Exchange outside test conditions.

The EWS fix has been in production in Exchange Online for some time and no problems have been noted with clients that consume push notifications (to learn about new mail, for instance). It’s a nice example of how Office 365 validates fixes at massive scale before code is delivered to on-premises customers. On the other hand, it can be argued that the vulnerability is yet another reminder why it’s easier to run email in the cloud…

Charting Microsoft 365 E3 and E5

Microsoft employee Aaron Dunnage did the community a favor by publishing some graphics to illustrate the component parts of the Microsoft 365 E3 and E5 plans. Only licensing specialists find the details of the licenses and add-ons you might need for different Office 365 features, so it’s nice to have a graphic overview. A reduced-size version is shown below. To get the real thing, go to Aaron’s Github repository.

With so much changing that affects how Office 365 works, don’t you think you need to learn from a book that’s always being updated? Subscribe to Office 365 for IT Pros today!