Surprise Announcement Highlights Inconsistencies Across Microsoft 365 Consoles

Microsoft’s 17 August announcement that they are not proceeding with support for dark mode in the Teams admin center (TAC) came as a surprise. Originally announced in message center notification MC567496 (2 Jun 2023), I covered the news briefly on June 6 and pointed out that dark mode for TAC had some problems with custom tenant colors. This didn’t seem like a big issue at the time. It’s the kind of fit-and-finish bug that tends to be taken care of before final release.

I don’t know why Microsoft decided not to deliver dark mode for TAC. Microsoft’s announcement simply says “We have made the decision not to proceed with this feature at this time,” which could mean anything. What’s for sure is that the toggle to enable dark mode has disappeared and won’t come back until Microsoft decides what to do next.

The news about TAC got me thinking about why Microsoft doesn’t have a common platform for Microsoft 365 administrative consoles. Despite efforts to make the consoles look and feel similar, the interfaces have their own foibles.

Authorization and Tokens

Take authorization as an example. The admin consoles use modern authentication, so the consoles need to acquire OAuth 2.0 access tokens and renew the tokens when they expire. Making token renewal a seamless experience for administrators seems to be a very complex technical challenge for the console developers.

The Microsoft 365 admin center manages things best. Behind the scenes, the console takes care of token renewal without a hitch. I seldom experience issues with this console, even after keeping the admin center open for extended periods. The SharePoint Online admin center is also pretty good. Other consoles struggle to deliver an elegant solution to token refresh.

For example, the new-and-improved Exchange admin center flashes errors up when it discovers the need to renew an expired token. Flash is the operative word because an error message appears and disappears in the blink of an eye. However, it’s there and I know it’s there and I worry that something more problematic than a brief pause in token renewal is the root cause. It seems like an issue that is highly solvable.

The Microsoft Purview compliance portal takes a more pedantic stance and insists that administrators should sign in regularly (Figure 1). At least you know where you are and what to do to proceed, and an arguable case exists that the compliance portal gives access to solutions that protect confidential information. But the inconsistency in behavior is obvious and jarring.

Teams Admin Center

And then we come to the Teams admin center. This console is fond of launching and appearing to work as normal before suddenly deciding that it should sign out the connected user (Figure 2). This action forces the user to reauthenticate before they can connect to TAC. And it can force the user to sign in again to other Microsoft 365 apps.

I’ve complained to Microsoft about TAC’s odd connection procedure several times. Each time I’m told things will improve. And to be fair to Microsoft, the issue occurs much less frequently now than it did in the past. Perhaps recent changes to the TAC contained some new code to address the problem. But I don’t trust TAC because I’ve experienced the sign-out issue within the last few weeks. I’m now keeping a watching brief on TAC to see if the issue reappears and if so, whether I can identify specific circumstances that might provoke the sign-out.

Dark Mode Support Across Admin Consoles

With the decision made not to support dark mode for TAC, the situation is that two of the five main Microsoft 365 admin consoles support dark mode while three do not:

• Support dark mode: Microsoft 365 admin center (Figure 3), Exchange Online admin center.
• Do not support dark mode: Teams admin center, Microsoft Purview compliance portal, SharePoint Online admin center.

The inconsistent implementation of dark mode is only an indication of the lack of consistency which still exists across the Microsoft 365 admin consoles. It demonstrates that Microsoft still has work to do to make Microsoft 365 administration a unified space. And when they’re doing that, making access token renewal work the same way across all consoles would be a great thing to do.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant

Teams Group Policy Assignment Possible for Many More Policy Types, But Only Using PowerShell for Now

Microsoft published two recent message center posts (MC557818 on May 19, and MC557241 on May 18) that seem to cover much the same ground. In a nutshell, tenants that use Teams group policy assignments to set policies based on group membership rather than individual assignments on a per-account basis now have access to a wider set of policies. The caveat is that you must create and manage group assignments for many policies using the Teams PowerShell module (currently at version 5.2).

Support in PowerShell is available now. Given usual practice, it shouldn’t be too long before Microsoft updates the Teams admin center to accommodate the new functionality.

Teams Group Policy Assignments

The Teams admin center supports group assignments for popular policies like the calling policy, call park policy, teams policy, live events policy, meeting policy, and messaging policy. You know when the Teams admin center supports group-based assignment if you see a tab for this purpose when working with a policy. Figure 1 shows that four group assignments are active for messaging policies.

To process group-based assignments, Teams uses a background process to find the members of the target group and make the assignments. During this process, Teams follows rules to ensure that directly-assigned policies take precedence over group assignments and that group assignments with higher priority have precedence over those with lower priority. Assignments are not immediate and can take up to 24 hours to become effective.

Teams Policies Now Supported for Group Assignment

What’s changing is that Microsoft has introduced support for group-based assignments for many policies in areas like Teams Phone, Teams Premium, and Teams support for VDI,:

• Application Access Policy.
• Call Hold Policy.
• Carrier Emergency Call Routing Policy.
• Cortana Policy.
• Dial Out Policy.
• Education Assignments App Policy.
• Emergency Calling Policy.
• Enhanced Encryption Policy.
• Events Policy.
• External Access Policy.
• Feedback Policy.
• Files Policy.
• IPPhone Policy.
• Media Logging Policy.
• Meeting Branding Policy.
• Meeting Template Permission Policy.
• Mobility Policy.
• Notification And Feeds Policy.
• Room Video Tele Conferencing Policy.
• Synthetic Automated Call Policy.
• Teams Branch Survivability Policy.
• Template Permission Policy.
• VDI Policy.
• Video Interop Service Policy.
• Voice Routing Policy.
• Voicemail Policy.

You can only assign these policies to groups using PowerShell. For example, this command uses the Get-MgGroup cmdlet to retrieve the group identifier for a Microsoft 365 group and uses the identifier as the target to perform a group assignment for a Teams events policy. Giving the assignment a rank of 1 means that Teams will treat this as the most important assignment and will use it unless a direct policy assignment exists for a user:

$GroupId = (Get-MgGroup -Filter "displayName eq 'All tenant member user accounts'").Id
New-CsGroupPolicyAssignment -GroupId $GroupId -PolicyType TeamsEventsPolicy -PolicyName "Webinar Organizers" -Rank 1

Policy assignments based on group membership (Microsoft 365 groups, dynamic Azure AD groups, security groups, and distribution lists) is a good idea for large tenants where clearly defined sets of user accounts share the same policy needs. It rapidly becomes boring to edit multiple accounts to make policies assignments, so if you can use a group for assignments, it’s a good idea.

Introducing Dark Mode in Teams Admin Center

When I refreshed my knowledge of how the Teams admin center deals with group-based assignments, I noted the appearance of dark mode support for the console (announced in MC567496, 2 Jun 2023). I’m not a great fan of dark mode except on mobile devices but recognize that many appreciate having the option.

If you choose to go with dark mode, make sure that any customizations applied to the tenant Microsoft 365 theme show up nicely. In my case, they didn’t, as obvious from Figure 2.

Microsoft can’t account for the color choices made by tenants when they customize their themes, so they can’t be blamed. This time!

Stay updated with developments across the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. We do the research to make sure that our readers understand the technology.

Teams Expiration Policy Removes Inactive Teams

The Groups expiration policy allows organizations to set an expiration period for Microsoft 365 groups and teams. If the groups remain in active use (based on certain Graph signals), Azure AD automatically extends their expiration date. In 2020, Microsoft reported that 79% of groups subject to the expiration policy met the bar for auto-renewal. The other 21% were either deleted by Azure AD or retained because a group owner responded to a prompt to renew. Many Microsoft 365 Groups in use today are teams-enabled and the likelihood is that most of the groups subject to the expiration policy are used with teams.

Unless administrators keep a close eye, it’s possible that Azure AD will remove an important group because the group owner failed to request renewal. For example, when a team comes within 30 days of its expiration date, owners receive notifications in their activity feed that they can use to renew the team (Figure 1).

It’s worth noting that team owners also receive notifications via email to warn about impending expiration. The messages come from msgroupsteam@microsoft.com (the bring your own domain feature for service messages doesn’t cover these emails) and arrive 30 days, 15 days, and one day before Azure AD removes the group. It’s possible for team owners to overlook these messages if they don’t use email.

A New Insight for Teams Administrators

All of which brings me to Microsoft 365 message center notification MC542836, posted on April 17. The announcement covers changes to the Teams admin center (TAC) to give administrators more visibility into the set of teams approaching expiration and the teams already deleted.

To see teams approaching expiration, apply a filter to the set of teams to look for teams expiring in the next 7, 14, or 30 days (Figure 2).

After TAC applies the filter to the set of teams, you can renew selected teams (Figure 3). The expiration date for a renewed teams is set at today plus the expiration period set in the policy. My tenant uses a two-year (730 day) expiration period, which I think is a good compromise between keeping inactive groups forever and expiring groups too soon.

Restoring Deleted Teams

It’s not a disaster when Azure AD removes an expired group because it’s easy to list and restore deleted groups using the Microsoft Entra admin center or PowerShell. However, if an administrator doesn’t restore a deleted group before the 30-day deletion period lapses, Azure AD permanently removes the group and all its connected resources. Monitoring the set of soon-to-be deleted groups is therefore sensible, perhaps using a PowerShell script to report groups and their expiration status.

To make management of deleted teams easier, the second extension to TAC is the addition of an option to View deleted teams to the Actions menu. The Deleted groups option in the Entra admin center lists all kinds of deleted groups while TAC restricts the set of deleted groups it displays to team-enabled groups. A shown in Figure 4, you can select and restore a deleted team at any time during its 30-day deletion retention period.

No Magic in New Options

There’s no magic behind the two new TAC options. Microsoft has taken options available elsewhere and adapted them to work solely with teams. There’s nothing wrong with that approach as it makes sense to provide the functionality to renew and restore teams in the tools people use. And anyway, if you don’t like performing these actions in a GUI, there’s always PowerShell.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Multiple Ways to Make Teams Bulk Policy Assignments

It’s amazing what slips by in the torrent of changes that occur within Microsoft 365. Message center notification MC397476 (last updated 27 July 2022, Microsoft 365 roadmap item 90705) is an example. This is the unassign policies from users in bulk feature that completed roll-out in August 2022.

Revert User Accounts to the Global Policy (Bulk Unassignment)

The idea is simple. Over time, it’s possible that the Teams policies assigned to users become less appropriate. It’s a pain to select user accounts individually to update policy assignments, so this is a method to reset accounts back to the global tenant policy for the following policy types:

• Messaging policy.
• Meeting policy.
• Calling policy.
• Live events policy.
• App setup policy.
• App permission policy.
• Teams policy.

To use the bulk unassign policy feature, go to the Users section of the Teams admin center. The Unassign policies in bulk option is in the top right-hand corner in the Actions drop-down menu. Select the policy type to work with and the Teams admin center displays the set of policies of that type (Figure 1). The greyed-out policies are default policies that don’t currently have any assigned users.

When you select a policy, Teams loads information about the assigned accounts. Click the Unassign button and confirm the action. Teams doesn’t tell you which accounts it processes, just the number of accounts that it successfully reverts to the default (Global) policy for the policy type. Bulk policy unassignments are supported for up to 500 accounts at a time.

Using View Users to Perform Teams Bulk Policy Assignments

Nice as it is to be able to remove (unassign) a non-default policy from a bunch of accounts, the Teams admin center includes what might be a better way to reassign policies (including to revert to the Global policy). MC445744 (13 October 2022, Microsoft 365 roadmap item 97253) covers the change made to allow administrators to view the users and groups covered by a policy.

Many of the major policies managed through the Teams admin center include the Assigned to users and Assigned to groups columns when they list policies (Figure 2).

The links in the columns reveal the set of users assigned the selected policy (Figure 3).

Select the Edit settings option and you can edit the policies assigned to the set of selected users, just like you’d update policies for an individual user or a set of selected users. Direct policy assignments to accounts like this take precedence over group policy assignments.

Other Ways to Process Teams Bulk Policy Assignments

Apart from the options available in the Teams admin center, the other ways to perform Teams bulk policy assignments include:

• Using batch jobs to process policy assignments for up to 5,000 accounts.
• Using Azure Automation runbooks to process policy assignments. The advantage of this method is that you could have a scheduled job to find and process policy assignments for new accounts.

Of course, you can also use PowerShell to find a set of accounts based on some criteria and perform policy assignments on that basis. Here’s an example of assigning a Teams feedback policy (PowerShell is the only way to manage feedback policies) to a set of user accounts based on their department:

Connect-MgGraph -Scopes User.Read.All
[array]$Users = Get-MgUser -Filter "department eq 'IT' and UserType eq 'Member'" | Select-Object UserPrincipalName, DisplayName
ForEach ($User in $Users) {
  Write-Host ("Assigning the feedback policy to {0}" -f $User.DisplayName)
  Grant-CsTeamsFeedbackPolicy -Identity $User.UserPrincipalName -Policy "Tenant Bar Feedback Policy" }

Keep Tracking Change

So much ongoing change happens within the Microsoft 365 ecosystem that it’s impossible to keep up to date with everything. Reviewing older message center notifications (we synchronize message center notifications to a Planner plan) is a good way to catch changes that you missed first time round. After all, no one is perfect.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Hide Teams from Exchange to Clean Up a Potential Mess

Updated 17 October 2023

In mid-2018. Microsoft updated Teams so that the Microsoft 365 Groups created for new teams were hidden from Exchange clients (like OWA) and Exchange address lists (like the GAL). This was accomplished by setting the HiddenFromExchangeClientsEnabled and HiddenFromAddressListsEnabled properties of the groups to True. The idea is that there’s no point in revealing team-enabled groups to Exchange when communications for those groups is centered around Teams messaging and meetings.

Groups Created Using Admin Interfaces

Unfortunately, the change only applied to teams created with the Teams clients (desktop, browser, and mobile) and the New-Team cmdlet from the Microsoft Teams PowerShell module. The groups for teams created using the Teams admin center (Figure 1), Azure AD admin center, Microsoft 365 admin center, New-UnifiedGroup PowerShell cmdlet, or the Microsoft Graph are not hidden from Exchange clients or address lists, with the result being that an organization can end up with some teams being visible and others not.

The logic here is that when an administrator creates a new team or group, it is assumed that they can make whatever decisions are necessary about the settings for the new group. This position is undermined by the fact that there’s no way to update the settings to hide groups available in the Teams admin center or Microsoft 365 admin center, so any adjustments must be done using PowerShell or the Graph.

The PowerShell Solution to Hide Teams from Exchange

Fortunately, the solution is reasonably easy to code in PowerShell. The steps are:

• Find the set of groups used by Teams.
• Reduce the set to the groups still visible to Exchange Online.
• Update the group settings to make them invisible to Exchange Online.

Here’s some code to do the job:

$HiddenGroups = 0
Write-Host "Finding team-enabled Microsoft 365 Groups and checking for any which are visible to Exchange clients"
[array]$Groups = Get-UnifiedGroup -Filter {ResourceProvisioningOptions -eq "Team"} -ResultSize Unlimited 
# Reduce to the set visible to Exchange clients
[array]$Groups = $Groups | Where-Object {$_.HiddenFromExchangeClientsEnabled -eq $False}

# Process the remaining groups and hide them from Exchange
If ($Groups.Count -ne 0) {
  ForEach ($Group in $Groups) { 
     Write-Host "Hiding" $Group.DisplayName
     $HiddenGroups++
     Set-UnifiedGroup -Identity $Group.ExternalDirectoryObjectId -HiddenFromExchangeClientsEnabled:$True -HiddenFromAddressListsEnabled:$True
  }
}
Else { Write-Host "No team-enabled Microsoft 365 Groups are visible to Exchange clients and address lists" }

Write-Host ("All done. {0} team-enabled groups hidden from Exchange clients" -f $HiddenGroups)

You can download the script from the Office 365 for IT Pros GitHub repository.

The Graph Method to Hide Teams from Exchange

Update: Since the original post, Microsoft updated the Graph APIs to allow the retrieval and updating of the settings controlling the display of groups to Outlook clients and visibility to Exchange Online address lists. This code is an example of how to use a combination of Microsoft Graph PowerShell SDK cmdlets and Graph API requests to find teams, check each, and update the settings if necessary.

[array]$Teams = Get-MgGroup -Filter "resourceProvisioningOptions/any(x:x eq 'Team')" | Sort-Object DisplayName
If ($Teams) {
   Write-Host ("Processing {0} teams..." -f $Teams.count)
}
# Parameters if we need to update a group
$Parameters = @{
 "HidefromOutlookClients" = "true" 
 "HidefromAddressLists" = "true" }
[int]$i = 0; [int]$Problems = 0
# Process each team, check if it's visible to Outlook clients and if so, hide it
ForEach ($Team in $Teams) {
  $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}?`$select=id,displayName,description,hideFromOutlookClients,hideFromAddressLists" -f $Team.Id)
  $Data = Invoke-MgGraphRequest -Uri $Uri -Method Get
  If ($Data.hideFromOutlookClients -eq $True) {
     Write-Host ("Team {0} is hidden from Outlook clients" -f $Team.displayName)
  } Else {
     Write-Host ("Hiding Team {0} from Outlook clients and Exchange address lists" -f $Team.displayName) -foregroundcolor Red
     $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}" -f $Team.id)
     $Status = Invoke-MgGraphRequest -Uri $Uri -Method Patch -Body $Parameters
     If ($Status) {
       $i++
     } Else {
       $Problems++
     }
  }
}

Write-Host ("All done. {0} groups hidden successfuily. {1} problems." -f $i, $Problems)

Obviously, this check must occur periodically to process newly-created team-enabled groups to hide teams from Exchange Online clients and in address lists. Something like a scheduled job executing an Azure Automation runbook would do the job.

Learn how to exploit the Office 365 data available to tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Making Teams Client and the Admin Center Produce the Same Type of Teams

Message center notification MC238795 of February 10 says that Microsoft plans “to align experience for creating a team from different Teams interfaces.” This is a complicated way of saying that currently the settings of teams differ depending on where they are created, and Microsoft is making changes to make sure that some important settings are consistent. Specifically, teams created in the Teams client and the Teams admin center (Figure 1) will have the same settings. The change is scheduled for mid-March.

A side effect of the change is that members added to teams created through the Teams admin center will receive “Welcome to Teams” messages rather than “Welcome to Groups.” This might not seem important, but it is because the messages point users to different types of functionality. Teams focuses on chat-based collaboration; Groups focuses on email.

Groups, Teams, and Settings

Every team is underpinned by a Microsoft 365 group. Groups can be used in different ways, but several settings relate to Outlook groups that Teams does not use. The focus is to make team-enabled groups have the same settings.

To explain the problem, let’s look at the relevant properties of a Microsoft 365 group/team created from the Teams desktop or browser client:

Get-UnifiedGroup -Identity "Planning Events" | fl HiddenFromExchangeClientsEnabled, 
HiddenFromAddressListsEnabled, AlwaysSubscribeMembersToCalendarEvents

HiddenFromExchangeClientsEnabled       : True
HiddenFromAddressListsEnabled          : True
AlwaysSubscribeMembersToCalendarEvents : False

The meaning of these settings is as follows:

• HiddenFromExchangeClientsEnabled is True, meaning that the group doesn’t show up in Exchange clients like Outlook and OWA.
• HiddenFromAddressListsEnabled is also True, meaning that the group doesn’t appear in any Exchange Online address list like the GAL and OAB. People can still send email to the group via its SMTP address, but it’s invisible if you go looking in an address list.
• AlwaysSubscribeMembersToCalendarEvents is False, meaning that members of the group do not receive notifications of calendar events. This option is more problematic, because it means that team members don’t receive invitations to channel meetings, even those scheduled with the channel calendar app. Many organizations like to distribution meeting invitations to team members. If you’re in this position and want this to happen for some or all teams, follow the instructions in this article.

By comparison, if we do the same for a Microsoft 365 group/team created from the Teams admin center, we see:

Get-UnifiedGroup -Identity "Teams Writing Group" | fl HiddenFromExchangeClientsEnabled, HiddenFromAddressListsEnabled, AlwaysSubscribeMembersToCalendarEvents

HiddenFromExchangeClientsEnabled       : False
HiddenFromAddressListsEnabled          : False
AlwaysSubscribeMembersToCalendarEvents : True

In other words, unless Microsoft updates the team creation process for the Microsoft 365 admin center, some teams will still be created will inconsistent settings.

Use the Graph!

All of this proves that the Teams developers can make sure that the settings of groups their interfaces create are consistent, but some work is needed to ensure that consistency applies across all of Microsoft 365. Perhaps that’s why MC238795 recommends that organizations use the Teams Graph API to create new teams. The Teams PowerShell module is built on top of the Graph, so let’s see what happens when we run the New-Team cmdlet to create a team-enabled group:

$TeamId = (New-Team -DisplayName "Annual Conference Planners 2021" -MailNickName ConferencePlanners -Description "Team for conference planners" -Visibility Private -Classification Confidential -Owner James.Ryan@office365itpros.com -RetainCreatedGroup:$True)

Get-UnifiedGroup -Identity "ConferencePlanners" | fl HiddenFromExchangeClientsEnabled, HiddenFromAddressListsEnabled, AlwaysSubscribeMembersToCalendarEvents

HiddenFromExchangeClientsEnabled       : True
HiddenFromAddressListsEnabled          : True
AlwaysSubscribeMembersToCalendarEvents : False

Voila! The same result as creating a team using the Teams client and what will happen using the Teams admin center from mid-March.

Learnings

Microsoft’s update imposes consistency across team-enabled groups created using Teams interfaces (admin center, clients, PowerShell, and Graph). However, only new teams will follow the rules as Microsoft will not check and update settings for existing teams. It is easy to do some retrospective processing with a PowerShell script to check the setting of each team-enabled group and update the settings to the desired values (a modified version of the script described in this article will do the job).

Before you go and change anything, take a moment to consider if the settings chosen by Microsoft work well for your organization. Some organizations like to see teams listed in the GAL or to have team members receive calendar updates by email. Teams should work for you rather than the other way round, so make your own mind up.

The Office 365 for IT Pros eBook contains a complete chapter (13) all about working with Microsoft 365 Groups and Teams through PowerShell. It’s the kind of high-value hard-to-find material that’s included in the book. We update content monthly to make sure that it’s accurate, refreshed, and practical. Subscribe today!

Prepopulate New Teams with Channels, Apps, and Tabs

Microsoft announced the ability to create new teams based on customizable templates on May 19. As noted in Office 365 notification MC222406 (September 18), the feature is rolling out in October 2020. Teams templates are described in Microsoft 365 roadmap item 67110, where Microsoft says they expect templates to “standardize team structures, surface relevant apps, and scale best practices.”

According to a Microsoft representative, these templates won’t be available for education tenants as they already have education-specific templates. However, the two types will merge over time.

Out-of-the-box Standard Templates

Templates are prepopulated structures created by Microsoft to make it easy to create teams to do a specific job. Each template consists of a set of channels, tabs, and apps that are automatically added to teams created using the template. Some of the 13 out-of-the-box templates are for general use (like project management); others (like Organize a Store) are for a particular industry. Among the templates published by Microsoft are:

• Adopt Office 365.
• Manage a project.
• Manage an event.
• Onboard employees.
• Organize help desk.
• Coordinate incident response.

As an example of what happens when you create a team using a template, if you use the Manage a Project template, four channels and two apps are added to the new team. The channels are called General, Announcements, Resources, and Planning while the apps are OneNote and Wiki. During the creation process, you can rename the channels to make them more appropriate for the new team. Because it might take some time to create the channels, apps, and tabs contained in a template, you can close the Teams creation screen after you save the details of the new team. Teams will then notify you when the new team is available.

After the team is created, you need to fully build out the new team by taking actions such as:

• Adding team members and owners.
• Adding other apps and channels (including private channels).
• Updating the team photo and other settings.
• Installing connectors.
• Posting a welcome note.
• Uploading files.

Building New Teams Templates

The set of out-of-the-box templates are managed in the Team templates section of the Teams admin center. You can add, edit, or remove templates to meet the needs of the organization. Figure 1 shows the initial step in creating a new template to help teams work on new books. At this point, we define its name, description, and locale (English in this case).

The next step is to add the channels and apps which Teams will automatically create in new teams based on the template. The General channel is always present (essentially, this channel represents the team). For our template, we’ve elected to add two additional channels, each of which will have tabs created for Planner and Microsoft Lists (Figure 2) to help us organize the writing and production of our book.

Because Planner and Lists are added as tabs, they also feature in the list of apps installed by the template. It’s likely that those working on books will want to praise the efforts of authors, technical editors, reviewers, and the overall editor, so we’ve included the Praise app as well.

When everything is defined for the template, click Submit to publish the template and make it available to users. Custom templates are listed ahead of the set of standard templates when shown to people creating new teams (Figure 3).

Useful Tool for Administrators

Time will tell whether Microsoft’s expectation of the positive effects of templates will come true. If many of your teams are created using the same structure, like the teams used to support classes of the same type, templates are certainly a useful tool in the administration toolbox, including if you use the Graph to create teams. The current release of the Teams PowerShell module doesn’t yet support the creation of teams with templates.

This is a small detail of Teams administration and doesn’t feature heavily in the 1,200 pages of the Office 365 for IT Pros eBook. Which just goes to prove how much extra interesting and valuable information the book does contain!

Manage Apps Page in the Teams Admin Center

Without much fanfare, the Teams Admin Center now boasts a new Manage apps page under Teams apps (Figure 1). The new page gives Teams administrators visibility over the apps published to the Teams app store by Microsoft, third-party developers, and custom apps developed in the tenant.

Teams app setup policies and app permission policies have been around for almost a year to give tenants the ability to assign users a set of apps for the app navigation bar and control whether users can access Microsoft, third-party, or custom apps. Allowing control over apps on an individual app basis builds out the Teams app management framework.

Allowing or Blocking Individual Apps

The basic idea for the app inventory is that tenant administrators can review apps and decide which they want to allow tenant users to access. By default, all apps are allowed, so the task is to review apps and block those which don’t seem appropriate or useful for the tenant. Blocked apps can’t be installed by users and won’t be displayed in the app navigation bar if included in an app setup policy.

Figure 2 shows details of a typical app (chosen at random). The important information show here is:

• Publisher: The organization responsible for creating and maintaining the app.
• Version: The current version of the software.
• Categories: For example, Productivity or Business Management. The publisher chooses which categories an app belongs to.
• Certification: The highest level of certification is Microsoft 365 certified app, which means that Microsoft has reviewed and approved the app against a set of security, compliance, and data handling standards. Wrike and Abode Sign are examples of Microsoft 365 certified apps. When an app is marked as publisher attestation, it means that the app’s publisher certifies the app based on a self-assessment report. Many apps are not currently certified, including some from Microsoft.
• Capabilities: Where in Teams the app can be used. If Team, the app can be installed into a team channel. Other categories include Personal, meaning that a user can install the app for their personal use, and Group chat, meaning that the app can be installed to be shared by participants in a group chat.
• App Id: Each app is assigned a unique identifier (GUID) when it is published to the Teams app store. The identifier is the same across all tenants.

It’s surprising that just a few apps are currently certified by Microsoft or self-certified. Presumably becoming certified is something recommended by Microsoft to app developers, so perhaps it just takes time to go through the process.

If you don’t want an app to be available in the tenant, move the App status slider from On to Off.

Org-Wide App Control

The Manage apps page also includes org-wide app settings for apps. These settings are tenant settings to:

• Allow third-party apps: If On, third-party apps can be installed by users. Turning this setting to Off prevents users installing third-party apps and limits them to apps provided by Microsoft.
• Allow new third-party apps published to the store by default: If On, any new third-party apps published to the Teams app store are visible in the tenant’s Teams app store and are available to users, if the app permission policy assigned to their account allows third-party apps. If Off, new third-party apps do not appear in the app store.
• Allow interaction with custom apps: Custom apps are those developed for your organization. If this control is On, users can install and access custom apps. If Off, they cannot (this setting also disables outgoing webhooks). This setting is Off by default for GCC tenants.

Lots of things change in Teams and elsewhere in Microsoft 365 all the time. Stay informed and up-to-date by subscribing to the Office 365 for IT Pros eBook and let us keep an eye on developments for you.

The Lobby’s the First Stop for External Meeting Participants

In Office 365 notification MC209349 published on April 14, Microsoft announced a change to the default meeting policy to enforce lobby entry for external users. Roadmap item 63388 says:

“We are updating the default meeting policy to automatically enforce lobby for all external users who join a Teams meeting, including attendees joining via Audio Conferencing. This policy change will only impact those tenants who have not modified the default meetings policy.”

The change is rolling out to tenants now.

Teams Lobby

The “lobby” referred to in the notification is a temporary holding place for people waiting to join a meeting. Authenticated users can allow people waiting in the lobby to join a meeting. Control over who can enter a meeting without going through the lobby is set by the meeting policy assigned to the organizer’s account. If they want, the organizer can override the policy for specific meetings.

Changes Made to the Default Meeting Policy

Technically, Microsoft is updating two settings affecting participants and guests in the default meeting policy. Figure 1 shows where the changes are made in the Teams Admin Center.

Behind the Scenes

MC209349 refers to the changes in PowerShell terms, where the edits are made with the Set-CSTeamsMeetingPolicy cmdlet:

• AutoAdmittedUsers is set to everyoneInCompany. This means that internal users can join Teams meetings without going through the lobby. However, external users – including those from federated organizations – must wait for admittance.
• AllowPSTNUsersToBypassLobby is set to False. This makes sure that dial-in users cannot bypass the lobby.

To check the values of the default meeting policy afterwards, run:

Get-CSTeamsMeetingPolicy -Identity Default | Format-List

See this page for more information about settings in Teams meetings policies.

Federated Organizations

Teams external access dictates the federation between your tenant and other organizations. This could be through open federation, where you allow communications from any other tenant or closed federation, where you allow federation with tenants based on an allow or block list (but not both).

Customized Default Meeting Policies Unaffected

If you customized the default meeting policy for your tenant in the past, this change won’t overwrite or otherwise affect those customizations. Default Teams policies remain under Microsoft’s control unless a tenant wants to change a default policy. At that point, the policy is copied to the tenant and the change is applied to the copy. A tenant-customized version of a default policy always takes precedence over Microsoft’s version, which is why this change only impacts tenants who have never changed the default meeting policy.

The Office 365 for IT Pros eBook has lots of information about Teams meetings. And best of all, as things change, we update the book and make new versions available to our subscribers.

Slow Progress for the Teams Admin Center

Building out its ability to manage Teams (rather than users or policy settings), the Teams Admin Center now boasts the ability to delete teams and archive or unarchive teams. A more prosaic but still useful addition is the expansion of columns supported by the Manage Teams view to include properties like privacy (public or private) and classification. (Screen shot taken with the Edge Dev browser, just to see would it work – and it does).

Given that Microsoft launched the ability to manage teams in the Teams Admin Center at Ignite 2018, you might wonder why it’s taking Microsoft so long to build out the management features in the console. A dependency on underlying APIs is part of the reason. Team owners can use the Teams clients to remove and archive/unarchive teams, but that doesn’t mean that the same operations are possible using the Graph API (or PowerShell).

The Need for an Updated Graph

Upgrading the Graph to handle Teams management operations appears to be the major factor in several delays, including the provision of APIs to ISVs to handle migration and backup scenarios.

Despite the claims of some vendors to support backups for Teams by copying the compliance records for personal chats and channel conversations from Exchange Online, this is not a true backup. Not all the data is copied and it’s impossible to restore conversations from compliance records. ISVs need Microsoft to deliver a high-speed access API for Teams before backups are possible (if you decide you need backups for Office 365, but that’s another story).

More Complications

Another complicating factor is that much of the recent work done to upgrade the Teams Admin Center has been to support the migration from Skype for Business Online to Teams. A lot of work has been done recently to make the transition easier.

A further complication is that Microsoft has a history of spending less time to develop management utilities and programs to support applications like Teams than they do building out user-facing features. Every few weeks Microsoft trumpets some new client features (like Praise) while a slower pace applies to management features.

Still, we shouldn’t be ungrateful. It’s good to see the portal develop and new capabilities arrive. It would just be nicer if things happened a tad faster.

For more information about managing Teams, see Chapters 13 and 14 of the Office 365 for IT Pros eBook. Chapter 14 is where we do DIY management using PowerShell, which can be more rewarding and functional than the OOTB features.

Teams Bumps Skype for Business Online

In April 2018, Microsoft launched the new Teams and Skype for Business Online Admin Center. The name was just too long, so I shortened it to TSBAC. Now Microsoft has shortened the formal name by dropping the reference to Skype for Business Online. The console and documentation now simply say “Microsoft Teams Admin Center.” I shall call it TAC to go with EAC, the Exchange Admin Center.

Microsoft didn’t announce that they were changing the name. It just happened, which is par for the course for many small details that they update in Office 365. The name change might indicate that the migration from Skype for Business Online is now complete. Of course, tenants who still run Skype for Business Online might choose to differ, but that might not be how the folks in Redmond see the world. Certainly, they have been forcing the pace to urge tenants to move, including removing the choice to use Skype for Business Online from smaller tenants (a good move, in my opinion).

Teams Management

To be fair to our friends in Redmond, the development team has done a good job of moving functionality out of the Office 365 Admin Center and the old Skype for Business Online consoles to TAC. Team management arrived to TAC in September 2018 together with the ability to assign administration roles for Teams. These were big steps forward for TAC. The functionality was delayed by the need to upgrade internal interfaces to allow administrators to manage teams (previously, only team owners could manage team membership, for instance). PowerShell users saw this ability in the November 2018 update (0.9.5). The current version of the Teams PowerShell module is 0.9.6.

Teams Reports

The most recent addition to TAC is the appearance of Teams usage reports in the Analytics and Reports section. Three reports are available, all of which can be generated for 7 or 28 day views.

• Teams User Activity: The number of channel, personal, and 1:1 calls and the date of last activity for tenant and guest users.
• Teams Device Usage: The number of different devices connecting to Teams in the tenant (Android, Mac, Windows, and iOS) plus a list of users and the device types they connect with.
• Teams Usage: A list of active teams showing how many users and guests have interacted with the team, the number of active channels in the team, and the count of messages posted to these channels

Like the usage reports in the Office 365 Admin Center, TAC shows a graph and a list for each report.

Different Teams Reports

The TAC reports are not the same as the Teams usage reports available in the Office 365 Admin Center. The following differences exist:

• You can’t click on a header to sort values.
• Only 7 and 28 day views are available in TAC. The Office 365 Admin Center has 7, 30, 90, and 180-day views.
• The Office 365 Admin Center doesn’t offer a Teams usage report.
• TAC can’t anonymize the user data and always shows names. The settings for Reports in the Office 365 Admin Center includes the option to display anonymous identifiers.
• TAC doesn’t include the option to export the data.
• The reports in the Office 365 Admin Center are usually three days behind in terms of the data analyzed. TAC is two days behind.
• The Office 365 Admin Center reports include a filter capability. TAC does not.
• You can click on a point in the graph in an Office 365 Admin Center report to see details of the activity on that day. TAC reports have a point for each day, but don’t filter the data if you click a point to select a day.
• TAC displays a smaller set of fields than the Office 365 Admin Center reports do.

Another difference is that TAC seems to generate its reports in real-time. You must click the Run report button to see a TAC report while the Office 365 Admin Center displays values as soon as you select a report. This difference might be accounted for by different interfaces used by the two console. Although I don’t know, I suspect that TAC uses the Microsoft Graph to fetch its data while the Office 365 Admin Center uses an earlier interface.

I noted some differences in the values returned by the reports. For example, on February 11, the Office 365 Admin Center usage report says that only 2 channel messages were posted while TAC reports a total of 6.

Future Tuning for Reports in Teams Admin Center

In reporting these differences, I must emphasize that we are comparing usage reports that have been around in the Office 365 Admin Center since mid-2017 against a newly-introduced TAC feature. I expect Microsoft to tune the reports now available in the Teams Admin Center over time and upgrade them to be at least feature-comparable with those in the Office 365 Admin Center. And hopefully, eliminate the different values they report.

For more information about reporting Teams and other aspects of Office 365 (inbuilt methods and third-party products), read Chapter 21 of the Office 365 for IT Pros eBook. Reporting can be a surprisingly complex area and although it’s reasonable to want to depend on the reports included in Office 365, third-party products are usually more feature-rich and powerful.