No Detail Available About How Hide Inactive Channels Feature Works

In July 2024, I discussed the initial deployment of the Teams feature to automatically hide inactive channels. Time moves on and the inactive channels are being hidden worldwide because the feature is now generally available in commercial Microsoft 365 tenants. GCC tenants should have it soon and GCC High and DOD tenants by the end of October 2024.

Two common comments about the feature have surfaced in the Microsoft Technical Community. The first is that the measurement of how Microsoft defines an inactive channel is opaque. In their original announcement, Microsoft says that the decision to hide a channel is because a user hasn’t “interacted with [the channel] over the past 45 days.” No further explanation is available what constitutes an interaction. Based on unscientific testing, it seems that opening the channel to read messages is sufficient rather than the more emphatic interaction of posting new topics, replying to messages, or responding with a reaction.

Hide Inactive Channels and the Lack of a Tenant-Level Control

The second issue is the lack of tenant control over the feature. Teams hides channels whether tenant administrators) like it or not. A user-level setting exists in the general section Teams settings app (Figure 1), but there’s nothing available in a Teams policy or a tenant-level property to disable hiding inactive channels. I don’t see anything in a Graph API that might disable hiding inactive channels either.

Users have the option to run the hide channel process interactively (the Hide now button).

Hide Inactive Channels and Notification Suppression

Hiding inactive channels has a side effect that users might not expect. Message center notification MC793969 (last updated 31 May 2024) covers the suppression of some notifications from hidden channels. When Teams hides a channel, it also suppresses notifications in the user activity feed for team and channel mentions, reactions, replies, and apps. The only notifications that now appear are where the user is tagged or personally mentioned.

This is a similar change to the one in MC793965 (17 May 2024) where Teams suppresses notifications for muted chats while allowing notifications for personal mentions.

The changes in MC793969 and MC793965 are both generally available. I think a fair case can be made that suppressing notifications from muted chats is perfectly acceptable because the user makes an explicit choice to mute a chat, presumably with good reason. It would be strange to want to see notifications for activities in a chat after muting it.

But muting notifications for hidden channels is a different case when some channels are hidden by users and some through an automatic process that people don’t understand well. Missing some newly-hidden channels in the channel list is easy and won’t do too much damage as it’s easy to find and unhide a channel if necessary. But it might be different if someone depends on notifications to keep track of what’s happening in a channel.

Some Tuning Required

Hiding inactive channels and suppressing notifications are part of a general Microsoft effort to make Teams a more manageable application from a user perspective. Being faced with a channel list that extends over hundreds of items can be very off-putting, as can seeing a flood of notifications in an activity feed. Removing unwanted clamor from the activity feed is a good idea. It might be even better if users had some control over whether they wanted to continue to receive notifications from channels that Teams automatically hides.

Learn about using Teams and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

And Why You Might Need to Change Account to Attend a Teams Meeting

Earlier this week I discussed a change made in how Teams copies text from messages that reduces user irritation. Let me balance the books by explaining a different aspect of Teams that continues to vex me.

I’m waiting to be accepted into a Teams meeting and wondering why I’m forced to wait in the lobby. I know that the organization wants people to use their guest accounts when attending meetings because of concerns about data leakage, so it’s annoying to have to twiddle my thumbs in the virtual lobby as the minutes tick by. And then the answer strikes: I’m attempting to join the meeting using my account rather than a guest account. After exiting, I rejoin after selecting my guest identity and enter the meeting without pausing in the lobby.

The UI to Change User Accounts

All of this happens because of what seems to be a major (to me) UI flaw in Teams. Figure 1 is the screen that appears when attempting to join a Teams meeting in a host tenant. By default, the user account from the home tenant is selected. If other accounts are available, the Change option appears to allow the user to select a different account. Teams knows if you have a guest account for the host tenant because it is listed under Accounts and Orgs in Teams settings.

You can switch to the account by selecting it from the list (Figure 2).

Because the meeting is limited to tenant and guest accounts, a connection request using the guest account sails through without meeting any lobby restrictions.

I can appreciate what the Teams UI designers were trying to do when they placed the Change button on the dialog. It makes sense to offer users the choice to switch accounts. The problem is that the option is just a tad too subtle and that leads to it being overlooked. I know I am not the only one in this situation because it has happened to a bunch of people who might know better.

Managing Access to Confidential Calls

MVPs are members of the Microsoft Most Valuable Professional program. Part of the benefits of being an MVP are product briefings about new features or plans that Microsoft has to improve their software, including Teams. All such briefings are under a strict Non-Disclosure Agreement (NDA) and people are required to join meetings using the guest account created for them by Microsoft. The restriction is enforced by the lobby setting for meetings to allow tenant accounts and guests to bypass the lobby. It is a reasonable restriction because Microsoft needs to know who they’re talking to, and a guest account is a good indication that an external person has been vetted for access to a tenant.

I commonly attend several product briefings each week. And on a regular basis, I fail to switch to my guest account before attempting to join calls. The result is that I spend time waiting in the lobby thinking that it would be nice if someone started the call soon before I realize what’s going on or a presenter recognizes my name in the lobby and lets me in. I’ve been known to become distracted while waiting to be admitted from the lobby and miss the entire call.

Automatic Switching Would Help

Teams knows what the meeting setting is for lobby bypass. It knows if the person joining a call can bypass the lobby with one or more accounts. It would be terrific if Teams could apply some intelligence to the situation and prompt the user to change if their current account can’t bypass the lobby. I might make more calls then.

Make sure that you’re not surprised about changes that appear inside Microsoft 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Who Thought that Including Metadata in Teams Pasted Text Was a Good Idea?

In an example of finally listening to user feedback, Microsoft announced in MC878422 (30 August 2024) that Teams no longer includes metadata in messages copied from chats or channel conversations. The change is effective now and means that instead of having Teams insert a timestamp and the name of the person who created the text, only the text is pasted. This is exactly the way the feature should have worked since day zero. Quite why anyone thought it was a good idea to insert additional information into copied text is one of the great mysteries of Teams development.

MC878422 notes: “Many users have voiced frustrations over copying messages in Teams, particularly the inclusion of metadata like names and timestamps. Customer feedback has been clear, signaling that this feature was adding more noise than value to user workflow.”

Copying Metadata is An Old Lync Feature

It seems likely that inserting the timestamp and author name is an idea that came to Teams from Lync Server 2013 and Skype for Business. A support article from the time describes how to change the default setting of copying message, name, and time to copying just the message. Nearly eight years after Teams entered preview in November 2016, the opportunity to update a setting as in Lync Server 2013 never appeared. The net result is that Teams users had to manually remove the unwanted metadata from copied text after pasting it into another app. Thankfully, the change “helps maintain focus and reduces unnecessary noise.”

I’ve no idea about how many of the 320 million monthly active Teams users found this aspect of the product annoying, but it’s been high up on my list along with in-product advertising and a constant stream of irritating pop-up messages.

Mic Pending is a Feature You Probably Never Knew Exists

In a more positive note, Juan Rivera, Corporate Vice President @ Microsoft. Teams Calling, Meetings & Devices Engineering posted on LinkedIn about a feature called Mic Pending state, which apparently is now rolled out to all tenants.

I have never thought much about the process required to implement the mute/unmute button in a call, but apparently Microsoft has done the work to make sure that when users hit the mic button (Figure 1), the action occurs immediately. If something gets in the way to prevent mute/unmute happening, Teams displays a “pending” icon if it notices that the action has taken more than 100 milliseconds.

The issue being addressed is to make sure that people have confidence that Teams will mute their microphone immediately they press the button and unmute the microphone in a similarly effective manner. It seems like some folks have been caught by a delay in muting. The button displayed in a Teams meeting showed that the microphone was off when it was still live. You can see how this could end up with something being heard or captured on a Teams recording that people would have preferred not to have been captured. Calling your boss a flaming idiot over an open microphone that you thought was muted is possibly not a good thing to do.

According to the post, Microsoft believe that Teams delivers 99.99+% reliability for the mute/unmute toggle, which should mean that the status for the microphone shown on screen can be trusted. Of course, the paranoid amongst us will always give a microphone two or three seconds before we consider it to be truly off.

Two Good Changes

The one thing about Teams is that it’s always changing. People like the Office 365 for IT Pros writing team have no shortage of topics to cover when it comes to Teams. Thankfully, the two topics covered here are both positive, even if mic pending hasn’t come to our attention before.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

But Advanced Collaboration Analytics Remains a Teams Premium Feature

According to message center notification MC862237 (14 August 2024), Microsoft plans to update the External domain activity report that’s available through the Reports section and the Collaboration activity dashboard in the Teams admin center. This report is designed to allow tenant administrators to know which domains users communicate with and which users are communicating externally. It’s good knowledge to have because it allows an organization to more accurately configure external access for Teams.

Default Open Access for Collaboration

The default state of external access for Teams allows federated communications with any other Microsoft 365 tenant that runs Teams. According to the last Microsoft numbers, Teams has 320 million monthly active users out of 400 million Office 365 “paid seats,” so allowing open external access essentially means that a tenant allows users to communicate with any other Microsoft 365 tenant.

Given the current state of cyberthreat, maintaining open communications of this nature is an unreachable state of utopia. The GIFShell exploit in 2012 proved the basics of how an attacker might compromise a target account using federated Teams chat. Tenants should configure an external access allow list composed of other domains that they’re willing to communicate with. It’s just too easy for attackers to spin up a tenant, add a Teams license, and start to probe (Teams began to block federated collaboration with trial tenants from July 29, 2024).

The New External Domain Activity Report has More Detail

Microsoft plans to roll out the updated report in September 2024. The update can’t come soon enough because the current report is devoid of detail. Only users with Teams Premium licenses appear, which accounts for the rather sparse content from my tenant (Figure 1).

Microsoft says that the new report will include:

• Total chat messages exchanged between each external domain and your tenant.
• Number of chat messages sent by each external domain to your tenant.
• The list of users from your tenant that communicate with each external domain.
• For each user, the number of chat messages sent between each external domain and the user, and the number of messages sent by that user to the external domain.

Nice as the new report will be, it’s regrettable that this kind of information is restricted to Teams Premium. According to the latest Microsoft results, Teams Premium represents about 3 million users, or less than 1 percent of the installed base. At $10 per user per month (a $7 introductory price is available until December 31, 2024), Microsoft obviously wants to drive that percentage higher. However, this kind of fundamental information is important for tenant security and should be available to all.

Including the report in Advanced Collaboration Analytics grants the report a status it simply doesn’t have. Other items shown in the collaboration activity dashboard (Figure 2), like noting the domains in the external access allow list that haven’t been used in the last 60 days, are much more worthy of the designation.

Like other reports generated from Graph usage data, the cards in the collaboration activity dashboard that include user or team names respect the privacy control setting. Unlike the Microsoft 365 admin center, which obfuscates private data if the privacy control is set, the Teams admin center simply doesn’t display data.

DIY Analytics

If you don’t want to pay for Teams Premium but would like to generate some of the same analyses that Microsoft include in Advanced Collaboration Analytics, it’s possible to do so with PowerShell or Graph API requests. As an example, this article describes how to create an external access allow list by analyzing federated chat messages using the Microsoft Graph PowerShell SDK. Once the basic data is generated, it can be sliced and diced in different ways.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

When Someone Exits the Organization, They Might Leave Active Teams Online Meetings Behind

Last week, I discussed the issue of handling the information contained in Teams chats participated in by an ex-employee. Another common problem that emerges when someone leaves is how to handle meetings organized by the leaver. For instance, I received a note to ask:

“We have an important Teams meeting. The organizer of that meeting has left. There are co-organizers, so the meeting chat and recordings can be retained. One problem is that the “missed activity emails” from Teams are sent in the name of the original organizer. Is it possible to change these to be sent by a co-organizer or change the meeting’s “owner” (which would hopefully change the sender of these mails). The issue is bothersome because some of the recipients of these mails are senior leadership, and they ask why the messages come from an ex-employee.”

I’m assuming that this refers to a personal meeting. In other words, someone created a recurring meeting in their calendar (Outlook or Teams) and invited a bunch of people to attend rather than creating a channel meeting.

Creating a Teams Online Meeting

When someone creates an online Teams meeting, two things happen. First, an online meeting is created for participants to come together and share audio and video feeds. This object is controlled by Teams and is an instance of the onlineMeeting Graph resource. Second, the join link for the online meeting are written back into the calendar properties for the event so that they can be included in the meeting invitation and shared with participants. Figure 1 shows the join link for a Teams meeting as viewed in an Outlook calendar event.

The Teams online meeting object now takes precedence in terms of running meetings. The calendar event in participant mailboxes allows users to know when a meeting is scheduled and have Outlook issue reminder. However, the options used to control the online meeting such as allowing reactions, chat, the URL to join the meeting, and whether to record the meeting automatically are properties of the online meeting object. The meeting object shares its participant list with the Outlook calendar and has relationships with the recording, transcript, and attendance report.

No Way to Change a Teams Online Meeting Organizer

Coming back to the original question, can anything be done to transfer the organizer role for meetings to another user after the original organizer leaves the organization? The answer is no. The creation of an online Teams meeting sets the organizer in stone and no change is possible thereafter. The Update onlineMeeting Graph API explicitly prohibits changing the meeting organizer, saying “the organizer of the meeting cannot be modified after the meeting is created.”

Removing the calendar events from the ex-employee’s calendar has no effect on the online spaces and their settings. It just deletes the events from the calendar.

Three Ways to Tackle the Problem

If a meeting organizer cannot be changed, how should organizations handle the problem created when someone leaves an organization with active Teams meetings in place? Only three answers seem possible.

1. Leave the active online meetings in place. While meetings are active, they can be managed by co-organizers. Eventually the meetings will expire to mitigate the issue.
2. Create a replacement meeting with the same time slot, settings, and participants. The new meeting (potentially created by a utility account) becomes the active event. If the original organizer’s mailbox is still available, someone can be granted permission to access the mailbox and cancel (delete) the original meeting. Before cancelling the meeting, make sure that any required artifacts like transcripts and recordings are secure. Otherwise, the original online meeting can be left in place and participants can either delete their instance of the event from their calendar or leave it intact.
3. Use a dedicated utility account to create important company events. A utility account is a regular user account (not a shared mailbox) dedicated to event management. The account is licensed for Exchange Online and Teams. Nominated individuals can be granted access to the account to create and manage meetings. The advantage of this approach is that it doesn’t matter if someone leaves the organization because the meetings belong to the organization rather than an individual. Defining what an important event is and figuring out how users can apply for the creation of an online meeting is something for individual organizations to determine. The person who requests such a meeting should be made a co-organizer to allow them to handle the day-to-day management of the event, like adding or removing participants.

The second option is the right course if you’re handling the problem of dealing with active meetings organized by ex-employees and are forced to act. However, before creating replacement events, consider implementing the idea of using a utility account to manage important company events. Asking someone else to create a replacement event will certainly work, but what happens when that person decides to leave?

Learn about using Exchange Online and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Filtering Blocked or Unblocked Apps

After writing about the Teams Application-Centric Management (ACM) model that replaces app permission policies for Teams apps, I received this question:

One shortcoming of this new model is that it isn’t clear/easy to see what apps you’ve approved or blocked in the manage apps section. You can sort by App status which gets you part of the way there, but it would be really nice if you could filter by app status, do you know if that will be forthcoming?

As I don’t work for Microsoft, I have no idea what the Teams development group is working on to make app status a filterable field in the Teams admin center. Certainly, introducing a filter that can highlight blocked or approved apps seems like a good idea. With over 2,500 apps to manage (Figure 1), any change that helps administrators to focus is appreciated.

When a tenant switches to ACM, the Available to property controls whether an app is blocked or available. The “No one” permission shown in Figure 1 is the same as an app blocked status used by app permission policies. In any case, ACM doesn’t matter because a filter isn’t available for the Available to property either.

Filtering Apps with PowerShell

Given that Teams boasts a comprehensive PowerShell module in addition to Teams cmdlets in the Microsoft Graph PowerShell SDK, there surely must be a way to retrieve apps from the Teams app catalog to report app details using whatever filter is required? Alas, this doesn’t seem to be possible because the cmdlets (and the underlying Graph API requests) return details of the apps known within a tenant. There doesn’t appear to be a cmdlet to return all 2,500-plus apps, even if these are listed in the Teams admin center.

For example, the Get-TeamsApp cmdlet from the Teams PowerShell module returns app information from the tenant app store:

[array]$Apps = Get-TeamsApp

In my tenant, the cmdlet returned 67 apps, including some duplicates such as the Activity app:

Id                                                       DisplayName
--                                                       -----------
69a8054f-7aeb-4e25-a0c5-1837c1a22446                     Activity
14d6962d-6eeb-4f48-8890-de55454bb136                     Activity

Teams is an app built from apps and some of the apps have been redesigned over time, so it’s unsurprising to find multiple entries for some apps. As we’ll see later, this is exactly what happens. The apps have different versions.

The Graph PowerShell SDK Alternative

According to the documentation for the List apps request, the Get-MgAppCatalogTeamApp cmdlet (from the Graph {PowerShell SDK) lists apps from the Microsoft Teams app catalog. This includes apps from the Microsoft Teams store and apps from your organization’s app catalog (the tenant app catalog). Running the cmdlet produced 68 apps.

The Queues (preview) and Dataverse Chat Sync apps are not reported by Get-TeamsApp. The queues app is a new Teams Premium feature for customer call management described in message center notification MC814579 (Microsoft 365 roadmap item 379980). Following its deprecation, the Viva Topics app is now considered as specific to the tenant rather than a Microsoft app included in the app catalog:

Get-MgAppCatalogTeamApp -Filter "distributionMethod eq 'organization'"

Id                                   DisplayName DistributionMethod ExternalId
--                                   ----------- ------------------ ----------
8905c282-649c-44fc-8795-70ec764137c0 Viva Topics organization       f7df4001-86d8-4235-af76-2e7e97f1eaca

The SDK cmdlet returns more information about apps. However, it doesn’t reveal any details about app permissions (ACM) or a blocked/unblocked status. Instead, the details are limited to descriptions and information about when an app was last modified (which isn’t populated for most apps). Here’s a quick script to extract and report some details about apps:

Connect-MgGraph -NoWelcome -Scopes AppCatalog.Read.All
$Report = [System.Collections.Generic.List[Object]]::new()
[array]$TeamsApps = Get-MgAppCatalogTeamApp -ExpandProperty AppDefinitions | Sort-Object DisplayName

ForEach ($App in $TeamsApps) {
    $ReportLine = [PSCustomObject] @{ 
        DisplayName     = $App.DisplayName
        Version         = $App.AppDefinitions.Version
        Id              = $App.id
        Description     = $App.AppDefinitions.Description
        LastModified    = $App.AppDefinitions.LastModifiedDateTime
    }
    $Report.Add($ReportLine)
}
$Report | Out-GridView -Title 'Teams App Details'

Figure 2 shows the output. As you can see, the two entries for the Activity app have differet version numbers and descriptions:

More Information Needed about Teams Apps

Maybe I am missing something fundamental, but I came up blank after spending a couple of days poking around to see if I can find better information. What’s for sure is that better programmatic access to the full Teams app catalog would be appreciated along with better filtering capabilities in the Teams admin center. Is that too much to ask?

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Teams Chat Messages Can Hold Lots of Important Content

Recently, I have written about the choice between shared mailboxes and inactive mailboxes to preserve email content and some of the PII issues that can arise when users gain access to the OneDrive for Business accounts belonging to other people. Both scenarios are related to dealing with the information accumulated in Microsoft 365 by people who leave the organization for one reason or another.

Mailboxes and OneDrive for Business accounts hold information created by their owners for many workloads, like Loop components, Teams meeting recordings, and whiteboards. But one thing they don’t hold is the user’s Teams chat messages. Given the widespread use of Teams by 320 million Microsoft 365 users, a fair chance exists that some important business information exists in chats participated in by ex-employees. Neither the Microsoft 365 admin center nor the Teams admin center includes an option to preserve chats during the account removal process. The question therefore is how to access chats to recover any information required by the business.

Cosmos DB, Compliance Records, and Exchange Mailboxes

Teams chat messages are “owned” by all the participants in a chat. In other words, the departure of one participant from a chat does not remove the chat messages from the Teams messaging database stored in Azure Cosmos DB. Deletion of messages only occurs after the last participant leaves the chat.

When an administrator removes an ex-employee’s account, Teams notes the fact and removes any chat messages the user had sole access to such as messages in the Chat with Self or chats where all other participants have left (shown as ‘Just me’ in the chats list). Removal isn’t immediate and doesn’t happen until Entra ID permanently removes the user account after the 30-day grace period allowed for recovery.

If a Teams retention policy is in force, it doesn’t affect the items stored in Cosmos DB. Instead, retention processing works against the compliance records captured by the Microsoft 365 substrate for Teams chats and stored in the hidden TeamsMessagesData folder in the user’s mailbox. Compliance records are captured in the user’s mailbox for every interaction in a chat, including those from other participants in the conversation. Compliance messages are also captured for channel conversations and are stored in the TeamsMessageData folder of the group mailbox used by the team.

People commonly mistake the storage of compliance messages to mean that Teams stores its messages in Exchange Online mailboxes. This is incorrect. The compliance items held in Exchange Online are incomplete copies of the “real” messages captured to allow Purview compliance solutions to process Teams content. For example, Communication Compliance policies examine compliance records to find violations of organizational policies.

Using Compliance Records

If the account comes within the scope of a Teams retention policy, Purview retains the compliance records stored in the Exchange Online mailbox until the hold lapses. While the hold exists, it’s possible to run a content search against the mailbox to find compliance records. This then creates the possibility of running content searches against the user’s mailbox to:

• Look for references to keywords that might identify important corporate information. For instance, references to project code names.
• Find all Teams chat messages in the mailbox and export the data to a PST for examination by the compliance team or an external expert. The PST could remain under the control of the compliance team after the hold lapses on a “just in case” basis.

To export the compliance records for Teams chat messages, create a new content search. Limit the search to just the target user’s mailbox and use the kind:MicrosoftTeams keyword. Figure 1 shows the sample review for a search of compliance records stored in my mailbox.

I’ve used Teams since its preview in November 2016. As shown in Figure 1, compliance records dating back to at least September 2018 are in the mailbox. According to the search statistics, the search found 24,103 items. Fewer items would be present if a retention policy to govern Teams chat messages (and Copilot for Microsoft 365 interactions) was active.

Although a content search will find and export all the compliance records for Teams chat messages, the difficulty is that a separate compliance record exists for each message in a thread. Chats can be very busy with many interjections occurring over a short period. The result is that finding relevant records of any importance can take a lot of effort. Purview advanced eDiscovery can assemble Teams threads if searching for specific keywords and that can be helpful to understand the context and flow of a conversation.

The Focus on OneDrive Overlooks Teams

It takes time before organizations realize the need to preserve different information. In one way, Microsoft has made it easy to retain the information associated with ex-employees by using OneDrive for Business as the de facto standard for personal information storage within Microsoft 365. Between OneDrive for Business and Exchange Online, it seemed like all the information that could possibly be wanted was accessible. Even though Teams compliance records are in Exchange Online, I suspect that the compliance data for chats are overlooked when accounts are deleted. I could be wrong, but I might be right.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Meeting Transcripts Deserve Protection

A bunch of changes have been rolling out for Teams meetings to tighten control over the artifacts generated during calls. The catalyst for the updates appears to be the recent change to store Teams meeting transcripts in OneDrive for Business. Meeting transcripts are critical artifacts in many ways because they are used as the basis for intelligent recaps, Copilot for Microsoft 365 queries, and closed captioning. Because transcripts can capture confidential information in participant contributions during calls, it’s sensible for organizations to protect this data appropriately. Let’s discuss the recent changes.

Controlling Access to Teams Meeting Transcripts and Recordings

First, MC795083 (22 May 2024) reports that meeting organizers can dictate who gets access to meeting recordings, transcript, and the AI recap (which is generated from the transcript). The setting to control access is now part of meeting options (Figure 1). Meeting participants not granted access still see the artifacts listed in meeting chat but won’t be able to open or download the files.

Associated with this change is message center notification MC781595 (last updated 13 June 2024, Microsoft 365 roadmap item 332800). As described, you might assume that Microsoft is introducing a new policy to allow tenant administrators to restrict permissions to download meeting transcript files. In fact, it’s an extension of the existing SharePoint Online block file download policy. Blocking downloads of Teams meeting recordings has existed since March 2023. Now that transcripts and full recordings are stored in MP4 files that look the same, the block download policy for Teams meeting recordings apply to the transcript-only files too. The downside is that the block file download policy requires SharePoint advanced management licenses.

Change to Participant Agreement Policy Setting

Teams meetings can be either transcribed or recorded. In both cases, Teams generates an MP4 file that’s stored in the meeting organizer’s OneDrive for Business account. The difference between transcription only and full recording is that the MP4 file for full recording contains a video stream and transcript while transcript files only contain the captions that collectively form the meeting transcript.

In any case, message center notification MC794819 (21 May 2024) reports that the participant agreement setting (aka explicit consent) in Teams meeting policies (Figure 2) now covers processing of all types of user generated content, including transcript only MP4 files and the analysis of a meeting generated by Copilot for Microsoft 365 from the meeting chat and transcript.

When the policy setting is enabled for a meeting where recording or transcription is used, participants must indicate their consent to be recorded by unmuting their microphone, enabling their camera, or sharing their screen (any of the 3 actions will do). If the participant fails to heed the warning (Figure 3) and give consent, they can participate in the call in view-only mode.

No Enriched Audit Records for Teams Meetings

One update that I see no sign of is the change announced in MC791598 (last updated 22 May 2024) to “enrich” audit records for Teams meetings with consent data. This information is available in attendance reports, which capture actions to turn unmute microphones or turn on cameras (both meaning a user gives consent). However, I see no trace of any ‘Added information about meeting participants” audit records despite the promise that worldwide deployment would complete in mid-June 2024 and the description in Microsoft documentation.

Taking Care of Generated Notes

Teams meeting transcripts can be a tremendously valuable tool, especially when generative AI uses transcripts to produce recaps of meetings for those who can’t attend an event or those who need a little help to remember commitments made during calls. Although the captured text isn’t guaranteed 100% accurate (and won’t be more than 95% in my experience), it’s still better than most attempts to capture what happens during meetings in handwritten notes. The downside is the need to protect transcripts. The changes described here help.

earn more about how the Office 365 applications really work on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Teams ACM Makes It Easier to Manage Access to Teams Apps

Over the years, I have become accustomed to using app permission policies to control access to Teams apps. Now a new sheriff is in town and App-centric management (ACM) is the replacement for app permissions policies.

ACM means that apps store a permission list to say who can use the app. The permission can be:

• Everyone: The app is available to anyone in the organization, including guests.
• Specific users or groups: The app is available only to selected users (including guests) and groups. The groups can be Microsoft 365 groups, security groups, dynamic groups, and distribution lists.
• No one: The app is blocked to everyone in the organization.

Microsoft says that ACM simplifies the app management process because administrators no longer need to edit (or create) an app permission policy and assign the policy to users to allow the users to install apps. Instead, an administrator select the target app in the Teams admin center (Figure 1) and edit the availability for the app to whatever permission should apply.

Getting to Teams ACM

Moving from app permission policies to ACM is a one-time, non-reversable migration run by invoking a wizard in the Teams admin center. You can pause the migration at any time but will eventually have to let it run to completion (Figure 2). During this process, the wizard checks the app permission policies currently defined in the tenant and updates the apps specified in the policies with equivalent ACM permissions to allow users to continue to access the same set of apps.

The time required for the migration depends on the number of app permission policies in the tenant and the number of ACM assignments the wizard must make. The tenant completed in just a few minutes in my tenant, but I suspect that it might take much longer in a large tenant.

Once the migration completes, you cannot access app permission policies through the Teams admin center, but you can with cmdlets from the Teams PowerShell module. For example:

Get-CsTeamsAppPermissionPolicy -Identity 'Global'

The apps defined in the policy are listed in the DefaultCatalogApps and GlobalCatalogApps property. To check the permissions assigned by the migration, select any app and use its identifier to find the app name.

Get-TeamsApp -Id 44263ed4-f1ac-4e96-93aa-d24dd50459ea

ExternalId Id                                   DisplayName      DistributionMethod
---------- --                                   -----------      ------------------
           44263ed4-f1ac-4e96-93aa-d24dd50459ea Channel calendar store

Now go to the Teams admin center and check the availability of the app (Figure 3).

The transition to ACM is simple and should not cause any problems for tenants. The best thing about the changeover is that it removes one policy from the set required to manage user accounts and that can’t be a bad thing.

Better Permission Visibility for Teams Apps

Teams Apps use Graph permissions to access user and organizational data. The app developer requests consent for the permissions, which then need an administrator to grant consent.

Details of permissions are available in app properties. However, the presentation of their details has been a tad obscure in the past. Microsoft introduced a change earlier this year (MC713370) to do a better job of highlighting the permissions and the data that the permissions allow access to. For instance, the Teams channel calendar app can use the permissions shown in Figure 4. The text is deliberately geared for humans to understand.

Figure 4 covers an app that has been granted consent. Figure 5 shows the increased level of detail available to an administrator before they grant consent to an app.

Of course, to fully comprehend what data the app is asking to be allowed access, administrators still need to understand Graph permissions and the differences between delegated and app permissions. But at least the information is there and presented in a way that makes it easy to look up a permission to check it out.

Small But Important Changes for Teams App Management

With over 2,500 apps available in the Teams app store, it’s important that every detail of managing apps is as simple and precise as possible. Changes like the changeover to ACM and better presentation of Graph permissions might seem small in the overall scheme, but they really make a difference, and that’s what counts.

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Rename General Channel with a “Meaningful Name”

Message Center notification MC814583 (July 16, 2024, Microsoft 365 roadmap item 395931) announces that team owners can soon rename the General channel (or the local language version of General when Teams isn’t run in English). For years, Microsoft resisted this request because the General channel is (in effect) the heart of a team. A team must have at least one channel and General is the default channel created in every team.

In the early days of Teams, it seemed like the General channel had a protected status where only team owners could post messages to the channel. The idea was to reserve the General channel for important announcements and the like and offload discussions to other channels dedicated to different topics. There’s value in this idea but perhaps not as much as people thought. It takes a certain discipline to always use the General channel for announcements.

Now Microsoft says that team owners can rename the General channel and give it a “meaningful name” to reflect the core role the channel has within a team. Renaming the General channel updates the channel’s display name, which can be up to 50 characters long. Some restrictions on characters that can be in the name do exist, but just like any other channel name, you can include emojis if you like (Figure 1). This must surely count as a meaningful name.

The warning shown in Figure 1 that once a team owner renames the General channel to some other name, they can’t reverse the process and use the General name again. “General” is a reserved name that can’t be assigned to any channel except when a team is created. I guess Microsoft could have created some extra code to track renames for General channels to allow channels to become General again, but it’s easier to say that the word General can never be used for a channel name.

Availability of Rename General Channel

The new feature is available in the Teams 2.1 desktop and browser clients. Microsoft plans to roll out the update to targeted release tenants in early August 2024. General Availability for commercial tenants will follow in mid-August 2024. GCC, GCC-High, and DOD tenants should get the update in September 2024.

Programmatic Ability to Rename General Channel

Current versions of the Graph Update Channel API block renames of the General channel (“General channel cannot be patched”), so the Update-MgTeamChannel cmdlet from the Microsoft Graph PowerShell SDK doesn’t work either. When the restrictions are lifted, you should be able to run a command like this to rename the General channel:

Update-MgTeamChannel -ChannelId '19:L2cxcx_ObbZSwEuRcwo1jEjIGZoxhAR-Fchi-PSujiM1@thread.tacv2' -DisplayName 'Everyone is a Winner' -TeamId $TeamId

A Small But Important Change in the Evolution of Channels

As I noted earlier this year, Microsoft is emphasizing better use of channels in an attempt to reduce the number of inactive or underused teams. With a team now capable of supporting a mixture of 1,000 regular, shared, and private channels, there’s certainly lots of potential to explore in maximizing the use of channels. Perhaps being able to rename the General channel will make it less of a special place than it’s been in past and make it into what the General channel is becoming: just another regular channel in a team.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Joins SharePoint Online and Microsoft 365 Groups in Connector Retirement

On June 11, I wrote about the retirement of Office Connectors for Microsoft 365 Groups and SharePoint Online and speculated that support for Connectors in Teams wouldn’t last. Well, Microsoft published message center notification MC808160 on 3 July 2024 to announce the retirement of Office Connectors from Teams starting on August 15, 2024. It looks as if the retirement involves some work for Microsoft to do because it’s not due to complete until January 1, 2025.

A note in the Microsoft Developer Blog explains more about why Microsoft is retiring Connectors from Teams. The timeline is:

• Microsoft will block the creation of new connectors on August 15.
• Existing connectors will stop working on October 1, 2024.

Microsoft says that when users with active connectors post to Teams, the connector will include a notice about the impending retirement at the bottom of the message posted to the target channel.

The Future is Workflows

Microsoft says that the Workflows app (Power Automate) is the replacement and where they plan to invest future development resources, It’s hard to argue against the consolidation of “citizen development” around a single platform. Moving from Connectors to workflows is straightforward for “standard” connectors like RSS (Figure 1) or if a replacement template is available in the workflows catalog.

Things get more interesting if you’ve built PowerShell scripts to generate payloads to inject into Teams channels via the incoming webhook connector. The development of the necessary code for a relatively simple example of reporting Microsoft 365 service health in an adaptive card took more hours than I anticipated. One issue that I still haven’t solved is how to run a workflow using a service account or service principal. The implementation in Teams appears to be tied to user accounts for authentication. This is fine when a user is active within the tenant but not so good when people leave.

The Problem with Connectors

The problem with Microsoft retiring Office Connectors for Teams is that tenant administrators have no way of knowing what connectors are installed where. There’s no report in the Teams admin center, so we must resort to PowerShell. Looking through the Graph documentation, we find the List apps in team API, or its Microsoft Graph PowerShell SDK equivalent cmdlet, Get-MgTeamInstalledApp.

The API returns all the apps installed in a team, including the apps preinstalled by Microsoft and those used for connectors (above everything else, Teams is an app composed of apps). However, it’s easy to come up with a list of connector apps and use that list to filter what comes back from Teams.

For instance, I defined an array with entries for SharePoint News, RSS, the incoming webhook, and “Happy Communities” (a customized name for Viva Communities). If you think that another Office connector is in use, add its name to the array.

[array]$TargetApps = "SharePoint News", "RSS", "Incoming Webhook", "Happy Communities"

After populating the array, it’s easy to fetch a list of teams and run through each team to determine if any of these apps are present:

ForEach ($Team in $Teams) {
    $TeamName = $Team.DisplayName
    Write-Host "Analyzing team: $TeamName"
    $Apps = Get-MgTeamInstalledApp -TeamId $Team.id -ExpandProperty TeamsAppDefinition
    If ($Apps) {
        ForEach ($App in $Apps) {
            If ($App.TeamsAppDefinition.DisplayName -in $TargetApps) {
                $Report.Add([PSCustomObject]@{
                    TeamName = $TeamName
                    AppName = $App.TeamsAppDefinition.DisplayName
                    Description = $App.TeamsAppDefinition.ShortDescription
                    AppVersion = $App.TeamsAppDefinition.Version
                    AppState = $App.TeamsAppDefinition.PublishingState
                    AppId = $App.TeamsAppDefinition.Id
                })
            }
        }
    }
}

Hey Presto! The script generates a list of teams and connectors to check (Figure 2). You can see that the connectors are associated with teams rather than individual channels, so some manual checking of each team is necessary to find which connector is targeted by the connectors.

You can download the full script from GitHub.

More Help Needed from Microsoft

I don’t mind the retirement of Office Connectors for Teams. Once Microsoft started along the path with SharePoint Online and Microsoft 365 Groups, it was always highly unlikely that Office Connectors would remain a Teams-only option. What I do mind is the lack of preparation and assistance that Microsoft gives to customers who might have been using connectors for years. It wouldn’t have taken much for Microsoft to create a list of connectors in teams as described above.

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Stop Annoying In-Product Messages Promoting Events and What’s New Updates

Just as Microsoft settled into the normal stupor surrounding the July 4 holiday, the Teams development group issued message center notification MC808161 (3 July 2024) to announce a new policy setting to disable some in-product messages displayed in Teams clients. The new setting is something that should have been in place when Microsoft started to push in-product messages to promote events like the Microsoft 365 conference (Figure 1) in April 2023, but it’s better later than never.

A Really Bad Idea

I hated in-product messages the first time I saw them. To me, Microsoft has no right to communicate with users belonging to my tenant and no right to advise users what training events they might like to attend. It’s one thing to pump ads to consumers of a free service and quite another to do the same (which is what in-product messages are) to people who pay a monthly license fee.

Advertising conferences chosen simply because events align with Microsoft marketing priorities is simply an abuse of Microsoft’s position as a cloud service provider and adds weight to the argument that Microsoft should be restrained by government intervention. Some will wonder if the latest European Union investigation into anti-competitive behavior around Teams prompted Microsoft to act. I don’t think so because controls over in-product messages were discussed by Microsoft last year in response to complaints from many MVPs.

Squashing In-Product Messages

Applying the policy block for in-product messages can only be done using PowerShell. The instructions to control in-product messages mention the New-CsTeamsUpdateManagementPolicy cmdlet from the Microsoft Teams PowerShell module (I used version 6.3). This implies that you need to create a new policy. You don’t. There should be an existing policy in place that can be updated.

Looking at the DisabledInProductMessages parameter with PowerShell, it seems to be an array. The documentation implies that the parameter takes a string value and that only a single type of in-product message can be disabled. In short, you must choose either:

• 91382d07-8b89-444c-bbcb-cfe43133af33: What’s New Messages
• edf2633e-9827-44de-b34c-8b8b9717e84c: Conferences

However, the Set–CsTeamsUpdateManagementPolicy cmdlet is quite happy to accept an array containing both values. Here’s what I ran to update the default update management policy with both values:

[array]$DisabledMessages = "edf2633e-9827-44de-b34c-8b8b9717e84c", "91382d07-8b89-444c-bbcb-cfe43133af33"
Set-CsTeamsUpdateManagementPolicy -Identity Global -DisabledInProductMessages $DisabledMessages
Get-CsTeamsUpdateManagementPolicy -Identity Global
Identity                  : Global
DisabledInProductMessages : {edf2633e-9827-44de-b34c-8b8b9717e84c, 91382d07-8b89-444c-bbcb-cfe43133af33}

PowerShell documentation has been known to be incorrect in the past, and it seems like this is the way the cmdlet is designed to work. In any case, my tenant is configured as shown above and I look forward to peace from annoying ad placements about both conferences and what’s new messages.

Only for Teams

The policy settings only cover Teams clients. Other products take their own course, as evident in the example of the Power Platform admin center and the two ads placed for the Power Platform community conference (Figure 2).

Let’s hope that the Power BI and any other development group that’s tempted to abuse their customers follow the lead set by Teams and provide tenants with a method to eradicate in-product messages.

Getting in the Way of Work

In-product messages get in the way of useful work. People are distracted by whatever message is being relayed. That’s a direct impact on the effectiveness and efficiency of customer organizations inflicted by Microsoft without invitation or permission.

A better way to promote conferences is to use the Microsoft 365 message center and allow tenant administrators to decide what information to pass on within their organization. This approach might not get messages in front of as many “eyeballs,” but it does offer the advantage of not making people unhappy when they see blatant advertising that doesn’t add a jot of value.

Make sure that you’re not surprised about changes that appear inside Microsoft 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Prevent Inactive Channels from Cluttering User Views

In another step in Microsoft’s overhaul of Teams channels, message center notification MC804771 (24 June 2024, Microsoft 365 roadmap item 325780) announces the implementation of a new housekeeping function to clean up user channel lists by hiding unactive channels (Figure 1).

The change will only be effective in commercial and government tenants. Education tenants won’t have their channels cleaned up. The update to the Teams 2.1 client for Windows, MacOS, and browsers will appear in mid-July for targeted release tenants and reach general availability for commercial tenants in mid-August 2024 with worldwide deployment scheduled to complete by mid-September. GCC, GCC High, and DoD tenants will see the update about a month later.

Channel clean up happens for both member and guest user accounts.

The Chaos of Inactive Channels

Tenants are well aware of the problem of digital rot caused by too many teams. Each team can now have up to 1,000 channels, and Microsoft is keen for customers to create channels rather than teams to reduce the amount of digital debris in their tenants. A shared or private channel can often replace a team, especially as both come with a dedicated SharePoint Online site to store documents.

It would be nice if those who created channels always maintained those channels, but this doesn’t happen in the real world. Like teams, channels can be created only become inactive or uninteresting to users quickly. It might be that the channel isn’t needed, that people discuss the topic created for the channel in a group chat instead, or that the topic simply isn’t worth a separate channel. For whatever reason, people lose interest and inactive channels find their way into user channel lists.

To solve the problem, Teams will automatically detect and hide inactive channels that users have not interacted with recently. Microsoft hasn’t said what period is used of inactivity Teams uses to make the determination or what interaction means. Based on experience with the preview version of the feature, interaction seems to mean open a channel to view conversations. Microsoft says that 45 days is the point used to decide if a user is active in a channel. It seems like Teams checks for inactive channels every couple of weeks.

When Teams detects inactive channels, it offers the chance for the user to review the set and make the call to unhide some of the channels (Figure 2).

It’s a good idea to review the set of inactive channels selected by Teams because useful channels that are temporarily inactive will appear in the list.

Settings for Channel Cleanup

The Teams Settings app includes the ability for users to opt out of automatic channel cleanup as well as an option to initiate the cleanup process on demand (Figure 3).

If you opt to clean up now, Teams checks the current channel list and displays any that it believes to be inactive.

The important thing to remember is that a hidden channel is still available to a user and can be unhidden at any time by viewing the set of channels for a team and unhiding any that they want to see.

Inform Users About Channel Clean Up

Automatic clean up processes are usually a good idea and hiding inactive channels is an example of one that’s worthwhile. However, like anything else that affects users, some explanation is necessary for people to understand why and what is happening. No one wants a bunch of help desk calls asking where a favorite (but inactive) channel has gone.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Shared Tab for Files and Hyperlinks Replaces Files

Message center notification MC800850 (11 June 2024, Microsoft 365 roadmap item 396169) is about another tweak Microsoft is making to the user interface of the new Teams client. On the surface, renaming the Files tab in Chat to be Shared is an innocuous change, but the update goes deeper.

The update is for the Teams Windows and Mac desktop clients and the browser client, and the new software will roll out to targeted tenants in early July 2024. General availability will follow soon afterward, and full worldwide deployment should be complete by the end of July. As with any date, don’t declare success until you see the change appear in your tenant.

The Shared Tab

The Files tab is a shortcut to allow users to see and access the files shared in a chat. It is a default tab for Chat and cannot be removed by users. The Files tab served its purpose, but the simple fact is that other objects, notably hyperlinks, are also commonly shared in chats. The new Shared tab exposes both files and hyperlinks in what Microsoft calls “a new, richer format” (code for a slightly nicer listing layout). The tab is available in one-to-one and group chats with tenant members and guests. It is not available in federated chats (with people in other tenants).

Figure 1 shows the new Shared tab in use in a chat between myself and Vasil Michev, who’s a guest in my tenant. We share many hyperlinks in the chat, including Graph API URIs, which are probably less exciting than links to documents or websites.

When a chat participant opens the Shared tab, Teams fetches the most recent items. It seems like Teams tries to find files and hyperlinks shared in the last two months, but you can scroll back to find older files. During testing, I could find files and hyperlinks back as far as December 2020, which seems reasonable. This might or might not have been the first time I shared something in the chat, but 42 months later I can’t remember!

No Change in Channels

Microsoft is not changing the Files tab for channels. This tab serves a completely different purpose because it lists the files in the channel’s SharePoint Online folder. The focus for the Files channels tab is to maintain feature parity with the SharePoint browser interface. Teams has steadily improved this position over the years and the two are pretty close now.

Future Updates for the Shared Tab

Microsoft says that they will enable image previews for hyperlinks and a keyword search facility in the Shared tab “soon after the rollout.” The keyword search seems to be available now (Figure 2), so perhaps plans changed after the message center notification was written.

Microsoft also discusses the next version of the Shared tab that includes support for media links (images, videos, GIFs, etc.). No dates are given for “soon” or the next version.

Change Doesn’t Please Everyone

Sometimes people complain when Microsoft introduces features that don’t seem to be as important from a business or technology perspective. Certainly, I received plenty of feedback on that point after writing about custom emojis. I don’t think custom emojis are very important to Teams, but others obviously do.

The thing to remember is that the Teams development group serves a very large installed base of over 320 million monthly active users. The base spans very large enterprise tenants like Accenture and Microsoft. It also includes a mix of small businesses, educational, and government tenants. All have their own demands and priorities. This change will please some and annoy others. It’s just the nature of software development.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Block for Federated Communications Imposed on July 29, 2024

In a development reported in message center notification MC805200 (25 June 2024), Microsoft is moving to block a potential attack vector that might be exploited by malicious actors who attempt to launch phishing or abuse attacks against Teams by blocking federated chat from trial tenants. I say “potential” because although demonstrations of how such an attack might happen in the GIFShell and JumpSec exploits, I am unaware of any successful attack.

In any case, an easy fix for phishing attempts from any unknown tenant already exists by not amending the tenant’s external access configuration to restrict federation to a curated tenant list. I advise every tenant to do this because there’s really no need to allow open access to your tenant unless you want to invite unwanted communications. It’s easy to use PowerShell to update the allowed tenant list automatically based on conditions like guest user accounts created within the tenant or even existing federated chats found for user accounts.

But applying an allow list to external federation goes against the philosophy of open federation for chat espoused by Microsoft. I think this kind of thinking is wrong in the current threat climate. All it does is open customers to exploits, which then means that Microsoft is forced to introduce controls.

In this case, Microsoft is introducing a new tenant-wide control for the federation configuration to block external access with trial-only tenants. The new control is called ExternalAccessWithTrialTenants and is set to Blocked by default.

Blocked means that users from trial tenants are unable to search for people or create federated chats with users in your tenant and Teams will remove any users from trial tenants from existing chats. Users from trial tenants will be unable to participate in Teams calls hosted by your tenant, unless those calls permit anonymous join. Likewise, users from your tenant will be unable to connect with users belonging to trial tenants.

If you follow my advice and limit federated communications to an allow list of selected domains, the ExternalAccessWithTrialTenants has no effect because the allow list takes precedence. Trial-only tenants are only permitted if added to the allow list.

Deployment Starts Now

Microsoft says that the deployment of the new setting is complete worldwide, so you should be able to see it by running the Get-CsTenantFederationConfiguration cmdlet from the latest version of the Microsoft Teams PowerShell module:

Get-CsTenantFederationConfiguration | Format-List ExternalAccessWithTrialTenants

ExternalAccessWithTrialTenants: Blocked

Microsoft plans to implement the block on July 29, 2024. If you take no action, federated chat with trial tenants will cease. After that time, if you really want to open your tenant to communications with trial tenants, you can run the Set-CsTenantFederationConfiguration cmdlet to update ExternalAccessWithTrialTenants to Allowed. Don’t make this change.

Trial Tenants

Trial tenants are often used by attackers to secure a foothold within Microsoft 365 that they can use to probe other tenants, including by reaching out to people that they know about (probably through harvesting of email addresses) for a federated chat. In this context, a trial tenant is deemed to be one with a Teams service plan with trial subscriptions. Once a tenant purchases a license that includes a Teams service plan (like Office 365 E3), the tenant is no longer deemed to be a trial. Potential attackers don’t have to spend a lot of money to avoid being detected as trial tenants.

The block applies to Skype for Business on-premises users. That’s because the tenant external access configuration applies to Skype for Business as well as Teams in other Microsoft 365 organizations (Figure 1).

Exceptions

With the block in places, it will still be possible to add users from trial tenants to shared channels or as guest members of teams. You can block these points of entry by using an Entra ID B2B Collaboration policy to limit collaboration with named tenants.

Open Collaboration is Not Always Great

Flaws in technology have a nasty habit of being exposed. Open federation is a nice concept and in a perfect world where everyone behaved, it would be the right approach. It’s like Microsoft’s attitude to Microsoft 365 groups where everyone can create new groups. The fallacy of that approach and the problems it creates for tenant administration were pointed out in explicit terms to Microsoft in 2015. They persisted and created the problem of team rot and digital debris that afflicts so many tenants today. Then Copilot for Microsoft 365 comes along and exposes how easy it is for AI to consume confidential material. Microsoft responds with Restricted SharePoint Search, a terrible solution to a predictable problem of their making.

Plans hatched in Redmond don’t always work out as expected…

Make sure that you’re not surprised about changes that appear inside Microsoft 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Replacing the Incoming Webhook Connector with the Teams Post to Channel Workflow

Last week, I discussed the looming end in sight for Office 365 connectors following their retirement from SharePoint Online and Microsoft 365 Groups. Connectors are still supported to bring information into Teams channels and the incoming webhook connector is a popular choice to create posts in channels from different network sources. For instance, this article describes how to post a notification about a report about expiring Microsoft 365 groups while this article discusses how to post information about service degradation for Office 365 workloads.

Both articles show how to use PowerShell to format the information sent for posting to a channel through the incoming webhook connector. I wanted to do the same thing with Power Automate workflows, specifically with the workflow called Post to a channel when a webhook request is received, which seems very close in concept to the incoming webhook connector: both publish a public URL for information to be sent to, and both demand that the information is formatted in a certain way.

The problem I ran into is a dearth of knowledge about how to construct the request body with PowerShell to send to the workflow. I knew that an adaptive card is used, but the example in Microsoft’s documentation wasn’t a great starting point. But persistence pays and the examples of formatting cards for Teams are better, and the adaptive card designer helped to debug various elements. In the end, I had a solution, and here’s how it works.

Create the Workflow

Channels have a workflows option in their overflow […] menu. Go to the channel you want to use as the target for the notifications and select Workflows (Figure 1).

Select Post to a channel when a webhook request is received from the screen listing available workflow templates (Figure 2).

The workflow needs an account to authenticate connections and post to the channel (this is different to the incoming webhook connector, which doesn’t need to authenticate using an account). The account must be a member of the host team. If, like me, the organization uses a utility account for this kind of operation, you’ll need to add the account to the team or select one of the existing team members. Figure 3 shows that the utility account is selected and validated (green tick). If you want to use a different account, click the […] menu and choose another account to connect.

After collecting all the necessary information, the dialog displays the name of the target team and channel. You can choose a different team or channel at this point. Once the correct target is chosen, click Add workflow. Power Automate proceeds to create the workflow and responds with the workflow URI (Figure 4).

Copy the URL and keep it safe because it is needed to tell Power Automate where to post payloads. When a payload arrives, Power Automate parses its content and if it’s OK, posts the content to the target channel.

If you forget to copy the URI, you can find it by opening the Workflows app, selecting the workflow, and copying it from the When a Teams webhook request is received step (Figure 5). To avoid potential confusion if multiple workflows of the same type are in use, I suggest that you take the opportunity to rename the workflow to make its purpose obvious.

Posting Requests to the Workflow

It’s at this point that we do some PowerShell magic to create the request sent to the workflow URI. To create a realistic example, I decided to use the Get Service Health Graph API to retrieve the current health status for critical services running in the tenant, like Exchange Online, SharePoint Online, Teams, and so on.

The request is an adaptive card, which is composed of elements like text blocks, images, and fact set. I settled on a simple design composed of an image, a heading (text block), and a fact set. A fact has a name and a value. In this case, the name is a service (like “OneDrive for Business”) and the value is the current service health status (like “service degraded”).

I created a prototype adaptive card with indicators where to add the header and facts. Creating the facts is a matter of retrieving the service health status, filtering the data to extract the status for critical services, adding a graphic indicator for each depending on the health status. After generating the data, it was then a matter of formatting it in JSON to meet the requirements of the adaptive card schema and inserting the facts and header into the right places in the prototype adaptive card. The final step is to submit the request using the Invoke-MgGraphRequest cmdlet. Figure 6 shows the result.

You can download the script from GitHub.

Normal Migration Woes

I am no Power Automate expert and profess no insight into how Power Automate works behind the scenes. I approached this exercise from the perspective of a tenant administrator who needs to replace the incoming webhook connector with a workflow. Persistence, some experience with PowerShell, knowledge of how to navigate Microsoft documentation, and trial and error got me a result in a few hours.

Overall, the transition was harder than I expected, but that might be due to lack of knowledge. It’s always difficult to do things when you suffer from that problem. I’ll chalk the experience down to normal migration woes.

Learn about using Teams, Power Automate, and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

An Overlooked Feature to Block Downloads for Channel Meeting Recordings

Given the size of Microsoft 365 and the fact that you might not use some app features very often, a good likelihood exists that you’ve never heard of some features. Or you might have forgotten that a feature exists. I experienced this feeling during the review of the Managing Videos chapter for the Office 365 for IT Pros eBook (2025 edition) when Vasil Michev, our technical editor, pointed out that the chapter didn’t mention the ChannelRecordingDownload setting for the Teams meeting policy.

This oversight on our part is inexcusable. The setting has existed for quite a while. It’s mentioned in message center notification MC222640, updated August 2, 2021, and our sole excuse is that this update occurred with a bunch of other changes intended to facilitate the migration of Stream classic to Stream on SharePoint. We’ll address the deficit here.

Updating Meeting Policies to Block Download Access for Channel Meeting Recordings

By default, the value of the ChannelRecordingDownload setting in Teams meeting policies is “Allow.” This means that the SharePoint app (app@sharepoint) saves recordings of channel meetings in the Recordings folder for the channel. For instance, recordings for meetings hosted in the General channel end up in General\Recordings while recordings for meeting in a shared channel end up in the Recordings folder. Private channels don’t have a mailbox and don’t support channel meetings. All channel members have access to the MP4 files created for recordings, including the ability to download the files.

Updating the ChannelRecordingDownload setting to block access to channel meeting recordings is not supported by the Teams admin center Instead, use the Set-CsTeamsMeetingPolicy cmdlet from the Teams PowerShell module to update Teams meeting policies. For example:

Set-CsTeamsMeetingPolicy -Identity "Allow Meeting Recording" –ChannelRecordingDownload Block

You might also need to run the Grant-CsTeamsMeetingPolicy cmdlet to assign the updated policy to the set of accounts that you want to block from downloading.

Grant-CsTeamsMeetingPolicy -PolicyName "Allow Meeting Recording" -Identity Ken.Bowers@office365itpros.com

Where Channel Meeting Recordings Go

After updating the meeting policy, SharePoint applies different rules to the storage of and access to channel meeting recordings. Remember that a channel meeting doesn’t really have an owner or organizer. The person who creates a channel meeting acts as the organizer in that they manage invitations and other meeting settings. However, they do not own the recording in the same way as they would for a personal meeting.

When saving channel meeting recording in SharePoint Online, the SharePoint app checks the meeting policy assigned to the organizer and finds that the policy blocks downloads for channel meeting recordings. Instead of saving the MP4 file in the Recordings folder, it saves the file in the Recordings\ViewOnly folder and alters permissions on the file so that only channel owners can download the recording. Everyone else, including the meeting organizer (unless they are also a channel owner) are limited to online view-only access (Figure 1).

The Microsoft documentation offers sparse information on this point and a quick internet search didn’t turn up much else. I guess everyone else missed this change.

The Can View Only Permission

In other related news, an associated change described in message center notification MC699712 (19 December 2023) might also have escaped your attention. This is the update for the share link settings for Stream videos stored in OneDrive for Business and SharePoint Online.

The change introduced the “Can view, but not download” option to the permission drop down (Figure 2) to make it easier for people to share videos that they didn’t want downloaded. It was possible to block downloads for video files beforehand, but it required additional steps to block downloads.

channel member creates a sharing link for a video file in the \ViewOnly folder, they’re restricted to sending a sharing request to the channel owners to request access. This occurs even when sharing with other channel members, even though those channel members already have access.

The Joy of Finding an Overlooked Setting

I’m not particularly worried about the downloading of my videos that other users have access to through Stream. However, I can understand that this might be a concern for others, and it’s good that Microsoft 365 includes controls to limit access in a reasonably painless manner, even if I have totally overlooked the settings for years.

Learn about using Stream on SharePoint and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Support for Office 365 Connectors Ceasing for Microsoft 365 Groups and SharePoint Online

Message center notification MC798683 (4 June 2024) announces the retirement of Microsoft 365 Groups connectors, a form of what are called Office 365 connectors. The retirement process commences on August 5, 2024, and finishes on September 5, 2024. After that time, connectors will no longer be supported within Outlook (Win32), OWA, and the new Outlook for Windows (aka Monarch).

Connectors take notifications from online data sources and post messages into a target destination. In this case, the target is the Inbox in the mailbox of the Microsoft 365 group configured with the connector. These connectors are used with Outlook groups rather than Teams. You can’t configure a connector for the other folders in a group mailbox, and you can’t configure a connector for any other type of mailbox.

Messages delivered through an Office 365 connector are limited to 28 KB and aren’t intended to be complete articles. Instead, they let users know that something has happened, give them a short snippet about the event, and provide a link to follow for more complete information. Using a connector to post messages from an RSS feed is one of the most common uses, but third-party companies like Asana and Trello have created connectors to bring snippets about information from their services to Outlook and other Microsoft 365 targets.

Microsoft recommends that organizations replace group connectors with the Power Automate app, which has its own set of connectors for different data sources, including the ability to create a cloud flow to post messages to the group mailbox. Some of the Power Automate Connectors (like Salesforce and Jira) require a Power Automate premium license.

Connectors and SharePoint Online

A further blow for Office 365 Connectors comes in message center notification MC793656 (16 May 2024), which announces the retirement of connectors from SharePoint Online webparts. Microsoft says that this is due to “limited usage.” Based on anecdotal evidence and personal experience, I can’t recall ever seeing an Office 365 connector configured with a SharePoint Online webpart.

In any case, from June 15, 2024, site owners are unable to add connectors to SharePoint Online. On August 1, 2024, they’ll be unable to update or manage existing connectors and the connectors will stop receiving inbound notifications.

Teams, Office 365 Connectors, and Workflows

Teams still supports Office 365 connectors, which are configured on a per-channel basis because the target for new notifications are channel conversations. Each notification creates a new conversation.

MC798683 points out that Teams channels also support workflows created using the workflows app (“powered by” Power Automate), and workflows recently turned up in the […] menu for Teams chats (MC683929, last updated 24 May 2024).

I shall have to pay more attention to workflows in the future. I know that the basic stuff works very well (like bringing an RSS feed into a channel). I’m more interested in finding out how to replace the incoming webhook connector, which is used in many ways to bring information from applications into Teams.

So far, my experiments with the Post to a channel when a webhook request is received workflow have not been successful. This seems to work in the same way (publish a URL to post messages to) and it’s easy to find the URL, but more difficult to get the workflow to run. I eventually managed and published my experience about posting an adaptive card to Teams.

Moving to a Single Answer for No-Code Automation

All of this seems to be part of a cunning plan to turn Microsoft 365 users into citizen developers by popularizing the use of Power Automate and the Microsoft Power Platform (Figure 1) for no-code automation wherever possible. According to Microsoft (January 2024), Power Automate has 33 million monthly active users in 350,000 organizations. My assumption is that PowerShell and the Graph are the answer for code-based automation.

It’s hard to argue against rationalization and it does make sense to settle on a single no-code automation platform for Microsoft 365, something that wasn’t viable when Office 365 Connectors appeared around 2016. As always, don’t be surprised when change happens inside Microsoft 365. Just be prepared to cope with the change.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Users Can Add Teams Custom Emojis for Everyone to Share

Borrowing a tad from Slack (which has had the ability to upload custom emojis for years), message center notification MC795750 (updated 31 May 2024, Microsoft 365 roadmap item 80659) announces that Teams users will soon be able to add custom emojis and reactions by uploading image (PNG) or GIF files. Once uploaded, custom emojis are accessible to everyone in the tenant, which can support a maximum of 5,000 custom emojis.

Microsoft plans to make the feature available to targeted release tenants in late June 2024. General availability will follow in early July 2024 with GCC High and DoD tenants getting custom emojis in August 2024.

Custom Emojis On By Default

The ability to upload custom emojis is controlled by the CreateCustomEmojis setting in Teams messaging policies. Microsoft plans to ship the feature enabled, meaning that the setting should be True in all messaging policies. There will also be a setting in the Teams admin cenrer to disable or enable custom emojis tenant-wide.

Here’s how to use the Get-CsTeamsMessagingPolicy cmdlet from the MicrosoftTeams PowerShell module to check the values for the CreateCustomEmojis (create and upload new emojis) and DeleteCustomEmojis (delete custom emojis) settings.

Get-CsTeamsMessagingPolicy | Format-Table identity, *emojis*

Identity                                    CreateCustomEmojis DeleteCustomEmojis
--------                                    ------------------ ------------------
Global                                                   False              False
Tag:Advanced                                              True              False
Tag:Advanced Users                                        True              False
Tag:Restricted - No Chat                                  True              False

You need the latest version of the MicrosoftTeams module to manage custom emojis.

To turn custom emojis off, run the Set-CsTeamsMessagingPolicy cmdlet to update messaging policies. In this example, custom emojis are disabled for any account assigned the Advanced messaging policy.

Set-CsTeamsMessagingPolicy -Identity Advanced -CreateCustomEmojis $false -DeleteCustomEmojis $false

Teams admin center receives an update in June (Figure 1) to allow administrators to manage the emoji settings in messaging policies without using PowerShell. Global and Teams administrators can delete custom emojis no matter what the messaging policy assigned to their account dictates.

Adding a Custom Emoji

To add a custom emoji, open the emoji and reactions menu and select the custom category (to the far right side of the other categories). If your account is allowed to add a custom emoji, you’ll see a plus sign. Click the plus sign to select the file for the new emoji. Only PNG and GIF files are supported. I took a photo from a recent trip to Disney World featuring a certain mouse and edited it to isolate the mouse character. I then saved the file as a PNG. Microsoft doesn’t say if the file should be under a certain size, but I took no chances and made sure that it was less than a megabyte. I uploaded the file and Teams invited me to name the emoji (Figure 2). You can see in the preview how the emoji will look in different situations.

Guest accounts cannot add a custom emoji. However, they can use the custom emojis created by tenant members. Seeing the custom emojis in a host tenant gives an interesting insight into the culture of that organization (Figure 3).

Deleting a Custom Emoji

Once uploaded, custom emojis become available to all users and show up in the custom section. Users granted the ability to remove custom emojis can select and delete emojis from the same place (Figure 4).

Microsoft says that it can take up to 24 hours for a deleted emoji to disappear.

Prepare for Some Interesting Teams Custom Emojis

On May 31, 2024, Microsoft updated MC795750 to say that the custom emojis feature will not come to organizations with education licenses. I think this is a reasonable decision. There’s no doubt that teachers have better things to do than keep an eye out for inapproptiate emojis appearing in chats and channels.

In the corporate world, based on experience with Slack, it’s probable that organizations will see a surprising array of custom emojis appear after users discover that this capability exists (and they will, and fast). Some custom emojis will be marvelously witty; others will be scandalous and offensive. With up to five thousand custom emojis per tenant, there’s lots of room to experiment with all sorts of images. Let the games commence.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Notify When Available Tracks the Availability of Other Users

Usually, the Teams developers can be criticized for informing customers about new features a long time in advance of actual availability. In a change to normal practice, Microsoft published message center notification MC797120 about the Notify when available feature for the new Teams client on May 30 and observed that they had been rolling out the feature to targeted release tenants since mid-May. General release tenants should see the feature showing up any date now because worldwide general deployment is scheduled to complete in early June.

Possibly the reason why Microsoft went ahead and released Notify when available feature without any warning is that this functionality exists in the old Teams client but not in the new 2.1 client (see “Features that are changing in the new Teams”). Users had complained about the loss of the feature (here’s an example of one of many questions on the topic from the Microsoft Answers forum). Releasing Notify when available removes one more thing off the “Make Teams 2.1 complete” list. I hope Microsoft moves on to restore the save messages option soon.

What Notify When Available Does

Notify when available is a mechanism to tell Teams that you’re interested in knowing when the presence status for another user changes to available. The kind of scenario that this feature is useful in is when you know that someone is going to be heavily committed to other tasks during a day, but you need to speak to them for a moment.

Taking out a subscription on their presence status makes Teams aware that you want to know when the person changes their presence to available. When that happens, Teams sends a notification that the person is now available and it’s up to you to reach out and contact them.

Using Notify When Available

The easiest way to know when someone is available is to find the person you want to communicate with in your chat list (not in a popped-out chat window). Perhaps they’re available now, in which case you can connect, or it will be like the situation shown in Figure 1 where Sean Landy is busy. To create the subscription, select Notify when available from the […] menu.

Once a subscription is in place, you’ll continue to receive a notification (Figure 2) each time the user changes their presence status to available.

Because Teams monitors the presence status for the account, the change to “Available” is detected immediately, and the notification arrives soon afterward. Changes in presence to other states like Busy, Appear offline, etc. do not generate a notification.

Disabling Notifications

Although it’s possible to leave a subscription in place permanently and continue to receive notifications when someone is available, most people only need to be notified once or twice. To remove a subscription, open the […] menu for the user and select Turn off notifications.

To view all subscriptions currently active, go to the People section in Notifications settings in the Teams Settings app (Figure 2). You can now turn off whichever subscription you’re no longer interested in contacting or add subscriptions for some new people.

To stop receiving notifications, you can turn them off in your app settings (#2 above).

For the record, here’s the Microsoft support article for the Notify when available feature.

Transitions are Hard

There’s no doubt that transitions are hard, especially for client software that’s packed full of features accumulated over years. In that light, Microsoft has done a reasonable job of replaced the original Teams client with Teams 2.1. Certainly, they’re in a place that the new Outlook for Windows developers would like to be, a larger installed base transitioned and most people happy. I wonder will the situation be the same when Microsoft eventually retires Outlook classic in 2029?

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Meeting Audit Events for Meeting and Participant Details

Last week’s news that Microsoft has started to make a set of premium audit events available to customers with Purview Audit (standard) licenses was welcome. The idea is that customers can use significant audit events like MailItemsAccessed and Send in forensic investigations of user activity that are often necessary when account compromise is suspected. Previously, Purview audit only generated these events for accounts with Purview Audit (Premium) licenses.

Teams Meetings Audit Events

Along with the Exchange events, Microsoft is making an additional fifteen Teams audit events available to Purview Audit standard customers. Among the set are audit events to capture details of meetings and meeting participants. The MeetingDetail event captures information such as the start and end time for a meeting, the URL to join the meeting, and the modalities used in a meeting such as audio and video. The MeetingParticipant event captures details of user participation in a meeting including their join and leave times and is like the information recorded in the attendance report.

I wrote about the Teams meeting audit events after their introduction in 2021 and explained how to generate a report from the audit records (I have since updated the script to use the Microsoft Graph PowerShell SDK to resolve user identifiers instead of the Azure AD module). The same script works today, and you can get it using the link in the original article.

In passing, MC772556 (updated 17 May 2024, Microsoft 365 roadmap item 381953) announces that Microsoft plans to shorten the URL created for Teams meetings to introduce a simplified syntax and make the links easier to share. Old URLs will continue to work after the introduction of the new version, now scheduled for August 2024.

A Delay in Audit Event Generation

In my 2021 article, I noted that Teams meeting audit events are generated some time after a meeting concludes. Workloads usually generate audit events soon after an action like a file modification or group creation completes. Teams meeting audit events appear in the audit log several hours after a meeting finishes. The same continues today. It’s possible that the delay occurs because a meeting can last past its scheduled time and can restart after an initial event concludes. The delay might exist to allow Teams to be sure that meetings are over before it generates the audit events.

Some Data Missing from Teams Meeting Audit Events

In addition, the meeting detail event doesn’t include some important properties about the scheduled event. For instance, the meeting subject isn’t captured (Figure 1), nor is the scheduled start and end times. Instead, the event records the actual start and end times of a meeting. Not capturing the meeting subject might be for privacy reasons.

Looking at the meeting participant detail events, we see the duration (in seconds) of the connection by individual participants to a meeting, details of the device used, and the meeting type (scheduled or ad hoc). But it seems like the audit events don’t capture details of guest users who join meetings when signed into teams in their host tenants.

On the other hand, Teams meeting audit events do capture the participation of people from other tenants who don’t have guest accounts in your tenant (federated participants). The upshot is that the participation information for some meetings is incomplete. It’s fine if you only ever want to report on the activity of internal users, but the big picture misses some important data.

Real Forensic Information

My conclusion is that if it’s necessary to report full details about Teams meetings, including attendance reports, you must use the Get OnlineMeeting Graph API. This is how the Teams clients fetch information about meetings.

Some complications exist. First, you need an Entra ID app registration to hold the application permissions necessary to read calendar events from user mailboxes and the meeting details. Second, unlike using other Graph application permissions to access data from all accounts in a tenant, Teams uses application access policies to protect online event information. An application access policy grants access to an app to online event information for specific accounts. Another complication is the formatting of the meeting identifiers used to access online events.

Once you have all the necessary access, reporting Teams meetings is a matter of finding online events in user calendars and retrieving the information for each event. I’ll write about how to create the definitive report about Teams online meetings when I finish up the script.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Calendar Notifications Appear in Teams Activity Feed

Introduced by MC704955 (last updated 2 April 2024, Microsoft 365 roadmap item 314355), after several weeks, I have come to the conclusion that I hate the calendar notifications that now arrive in the Teams activity feed. According to the deployment schedule, almost all tenants should have the feature by now.

Calendar notifications arrive for

• Meeting invitations (including channel meetings where the organizer sends personal invitations).
• Meeting updates, including cancellations.
• Meeting forwards (that the user organized).

Calendar events pop up as unread notifications in the activity feed, cluttering the feed that’s already heavily trafficked by @mentions, replies, invocations to renew expiring teams, and the like. In fact, I get two sets of notifications because Outlook notifies me about new invitations and updates too. At least, Outlook would if I had not configured its calendar long ago to accept invitations automatically.

Suppressing Calendar Notifications in Teams

The good news is that you can suppress calendar notifications in Teams too. If you hover over the timestamp for a calendar notification (like 16:22 in Figure 1), an ellipsis menu appears. Select the “turn off calendar” option and the activity feed becomes a more pleasant place again.

This experience reminds me once again of the value of paying attention to the notification settings in the Teams client. As obvious from this 2021 post, it’s an ongoing battle because new sources of notifications (like the calendar) appear over time.

“Turn off calendar” disables most calendar notifications in the settings app (Figure 2). It doesn’t disable notifications for when people forward meetings that you organize. You can turn that setting off too if you like.

Reduced Filters in the Activity Feed

After sorting out calendar notifications, let’s turn our attention to message center notification MC793967 (17 May 2024), a candidate for the worst written message center post of the year. This feature, rolling out to general availability soon, removes much of the filtering capability for the activity feed. Microsoft explains that they’re doing this “To solve for discoverability and ease of usage of @Mentions in activity” (whatever that means) by introducing two “selectable pills” (normal people call these “buttons”) to filter for @mention and unread notifications (Figure 3).

The other filters previously available are retired. These include replies, reactions, apps, and voicemail, all of which seem pretty useful. No doubt Microsoft’s wonderous telemetry will prove otherwise.

To replace the retired filters, Microsoft says “we recommend the utilization of upfront mentions pill, which address the bullseye of filtering needs in Activity feed.” I have no idea what this mangled attempt at an English sentence means. Surely Copilot could have rewritten the text for clarity and conciseness? You could interpret the words to mean that Microsoft believes that @mentions are the most important notifications for users (probably true) with unread a close second. Hence the two filter options.

It’s also worth noting that a secondary filter option exists. Press CTRL+Shift+F (Windows) or click the funnel icon and you can input some words to filter the current list of notifications. For instance, if the selected filter is for unread notifications and you input “Paul” as a filter, the activity feed shows you unread notifications from users with Paul in their display name and notifications with Paul in their text.

Cleaning up Teams

All of this is part of Microsoft’s efforts to clean up what had become a cluttered Teams client. They want the Teams 2.1 client to be easy to use with the most important elements highlighted to users. I’ve no problem with that aspiration, but it would be good if communication was better.

Keep up to date with developments in Teams by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

Teams Meeting Transcripts Exclusively Stored in OneDrive for Business

Microsoft is making a bunch of changes to the handling of Teams meeting transcripts. The most important change is the standardization on OneDrive for Business as the storage location for transcript information, described in message center notification MC726122 (last updated 1 May 2024, Microsoft 365 roadmap item 365720). Targeted release tenants will see the change in early June 2024 and Microsoft hopes to achieve worldwide general availability by late August 2024.

In 2021, Teams was the first application to move workload to the Stream on SharePoint platform. Stream was in the middle of a transition from the old Azure-based application to Stream on SharePoint, and customers still had the option to use either platform. During the transition, Stream stopped creating transcripts automatically for newly uploaded videos. Seeking stability and to support indexing of transcripts, Teams stored the transcript information in the meeting organizer’s Exchange Online mailbox.

Now, Stream on SharePoint is the only option for video storage and automatic transcript generation is performed, so meeting recordings end up with transcripts stored in Exchange Online and Stream. Microsoft is rationalizing the situation by eliminating the copy stored in Exchange Online. This step makes perfect sense because it is consistent with the way that Stream handles transcripts for other videos.

How Teams Meeting Transcripts are Generated

Microsoft is beginning by implementing the change for Teams meeting recordings that only have a transcript (no audio or video content is captured). This happens when a meeting organizer enables a transcript without recording. In the past, Teams wrote the transcript into Exchange Online. When the change is effective, Teams creates an MP4 file in the Recording folder of the meeting organizer’s OneDrive for Business account. To create the file, the normal bot that joins meetings to listen to the audio feed from participants to create the transcript, generates the transcript as normal and then removes the audio track, leaving the MP4 file with just the VTT-formatted captions that compose the transcript.

Figure 1 shows a OneDrive for Business account with two meeting recordings. The first contains only a transcript. The second is a regular recording. Note the “meeting transcript” suffix used for the first and “meeting recording” for the second.

Teams will still write a copy of the transcript for transcript-only recordings into Exchange Online. The situation is different for Teams meeting recordings with audio. The transcript for these recordings is stored in the MP4 file. A copy is also stored in Exchange Online. In other cases, Microsoft emphasizes that Teams will only use the transcript stored in OneDrive for Business.

Phase Out of Exchange Storage for Teams Meeting Transcripts

Eventually, Teams will cease writing a copy into Exchange Online so that the only transcript data is that stored in OneDrive for Business. Microsoft says, “At the same time, meeting transcripts will stop saving in Exchange Online altogether and all transcript storage will be standardized on OneDrive only.” I’m unsure what is meant by “at the same time.”

As you’d expect, standardization on a single location makes it easier to delete transcripts either by the meeting organizer or by retention policies (both the recording and transcript can be removed at the same time).

More Help Coming to Manage Consent and Access

Meeting transcripts are more important now than ever before. Apart from providing captions during playback of meeting recordings, the Teams Premium intelligent recap facility uses transcripts to generate meeting notes and action items. They’re also used by Copilot for Microsoft 365 to allow users to ask questions about meeting proceedings.

To protect the privacy of people and make sure that transcripts are only generated for meetings where everyone consents to recordings, Microsoft has several changes in the pipeline to better manage consent and access, including:

• MC781595: Policy to control the download of Teams meeting recordings. Requires SharePoint-Syntex advanced management licenses.
• MC791598: Consent given by users for recording is captured in the audit logs (requirement for consent must be enabled in the Teams meeting policy)
• MC794819: Explicit consent for all forms of recording.
• MC764456: Explicit consent to transcribe a meeting.
• MC795083: Policy to manage access to meeting transcripts, recordings, AI-generated recap, and Copilot features.

Learn about using Teams and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Use Loop Workspaces to Organize Recurring Meeting Notes and Documents

Microsoft is keen to demonstrate the value of integration across the Microsoft 365 suite. They also take every opportunity to hype new products to drive usage and adoption. Both elements are present in message center notification MC792605 (13 May 2024), which tells us that organizers of recurring Teams meetings will be prompted to create a Loop workspace to hold the information used by the meeting. The prompt is in the meeting chat (Figure 1).

The idea is that the Loop workspace serves as a durable container for content worked on over a series of meetings. If the meeting organizer chooses to create the workspace, the meeting participants receive invitations to join the workspace and the organizer can add files shared in the meeting, As meetings in the series progress, Teams will automatically add files, whiteboards, loop components, and so on that are shared in the meeting chat to the workspace.

Deployment Timeline

Deployment to targeted release tenants is ongoing now. General availability is due soon thereafter. Initially, the feature is limited to recurring meetings with between three and 50 participants. Microsoft says that they will increase the limit for meeting participants in the future and add support for modern groups (Microsoft 365 groups). I’m not quite sure what that last statement means, unless it’s saying that Loop will support sharing with the membership of a Microsoft 365 group.

Loop Licensing Could be an Issue

On the surface, using a Loop workspace to manage the files shared by participants of a recurring meeting sounds like an excellent idea. However, there are two issues that need consideration.

First, Microsoft doesn’t restrict the creation of Loop workspaces through licensing today, but they will restrict creation to accounts holding Microsoft 365 licenses after July 1, 2024. Users who share Loop workspaces can still access workspace content after that date, but they cannot create new workspaces or add or remove users to workspaces. This limits the usefulness of the feature to meeting organizers with the required licenses.

The Loop workspaces report PowerShell script described in this article includes details of licenses assigned to workspace owners. You can use the report to figure out if some licensing adjustments are necessary. While you’re considering the licenses assigned to Loop workspace owners, consider reviewing the full set of licenses (and their costs) assigned to users across the tenant using the Microsoft 365 tenant licensing report script.

Waiting for Guest Support Through Loop External Access

The second issue is that many Teams meetings involve guest users. I participate in recurring meetings in three other Microsoft 365 tenants, but until Loop supports external access to workspaces, guest accounts cannot access the information stored in workspaces created to support recurring meetings. Microsoft has promised that external access for Loop is coming, but there’s no sign that the initial support announced in MC736437 (for tenants without sensitivity labels) due to arrive in April is available yet. Some recent tweets from Microsoft imply that external access is about to arrive, but we’ll have to wait for it.

Tenants that use sensitivity labels won’t get support for external access to Loop workspaces until later. The tenants I participate in as a guest all use sensitivity labels, so I guess that I’ll just have to wait a little longer before those meetings can embrace Loop instead of standard OneDrive file sharing.

A Good Idea for Some

You might think that I believe using a Loop workspace to hold information for recurring meetings is not a useful feature. That’s not true. It’s a good feature if you have the necessary licenses and don’t need to share anything with guests (until that feature is released). Sometimes I think Microsoft operates on the basis that everyone has high-end licenses and only ever collaborates within a tenant. That isn’t the way the real world works, and that’s why I am slightly negative about this feature.

On another note, this kind of integration between Microsoft 365 products is the kind of thing that regulators like the European Union worry about because they create a barrier for competition by preventing the ability to use features if a customer chooses to use a different technology (such as replacing Teams with Slack). Innovation can sometimes be a double-edged sword.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Anti-Competitive Behavior and the Slack Complaint

A recent report in the Financial Times (behind a firewall, so here’s a summary that can be accessed without payment) says that the European Union is preparing to introduce new anti-trust charges against Microsoft due to anti-competitive practices around the way it bundles and sells Teams.

The origin goes back to a 2020 complaint filed by Slack against Microsoft where Slack accused Microsoft of “illegal and anti-competitive practice of abusing its market dominance to extinguish competition in breach of European Union competition law. Microsoft has illegally tied its Teams product into its market-dominant Office productivity suite, force installing it for millions, blocking its removal, and hiding the true cost to enterprise customers.”

European antitrust proceedings take their own time to develop. Eventually, in July 2023, the European Union decided to open an antitrust investigation based on the Slack complaint. Microsoft responded by unbundling Teams from Office 365 for new customer purchases within the European Economic Area (EEA). On April 1, 2024, Microsoft announced the unbundling of Teams from Office 365 worldwide. Like the EEA move, the decision only affects new customers, who must buy separate Teams Enterprise licenses ($5.25/month in the U.S.) if they wish to use Teams.

Microsoft’s move to unbundle Teams doesn’t appear to have assuaged the European Union. There’s an obvious reason why. According to Microsoft, Teams has 320 million monthly active users. Microsoft cited the number in their FY24 Q1 results in October 2023 and hasn’t updated it since (Jeff Teper repeated the figure at the recent Microsoft 365 conference). I imagine that even if growth is slowing, some increase has happened in the two quarters since.

The Competition Between Slack and Teams

When Slack filed its complaint, it competed fiercely with Teams. Then the Covid pandemic came along, and Microsoft poured resources into teleconferencing (in particular) to help people cope with working from home. The result was a massive growth in Teams usage, leaving Slack in its dust as Microsoft focused more on Zoom than its original competitor. Based on official Microsoft numbers, Teams is used by 80% of the 400 million Office 365 paid seats, so there’s not much room for a competitor to take share. According to DemandSage.com, Slack has 65 million monthly active users, or around 20% of the Teams number.

Unbundling Teams from Office 365 won’t create a more level playing field, especially in the lucrative market for enterprise customers. These organizations value the integration of Teams with other Office 365 workloads like SharePoint Online, OneDrive for Business, Exchange Online, and Planner. Many will consider using Teams with Copilot for Microsoft 365 or Teams Premium to gain advantage of the additional functionality enabled by those licenses.

It’s hard to see how Slack could create a cogent argument for a customer to use its technology instead of Teams alongside the rest of Office 365, especially as the monthly cost for Slack is higher than the Teams Enterprise License. The monthly cost of the Slack Business plan is almost equivalent to Teams Enterprise plus Teams Premium (Figure 1).

Given the choice between buying the market leader that’s integrated with the rest of Office 365 versus bringing in a third-party product that’s not integrated, what decision do you think a rational CIO will make?

No Ability to Move Away from Teams

Another problem is that the task of moving an organization from Teams to move to Slack or another platform is horrendously complicated. I’ve long said that Teams is the most difficult of any Office 365 workload to backup. It’s even harder to restore, and that task has not become easier over the years. Extracting chats and channel conversations might be possible, but then things become difficult with shared files stored in user OneDrive accounts like Loop components, Teams meeting recordings, compliance records, call logs, and so on.

There’s also the small matter of the thousands of apps developers have built for Teams and the data used by those apps. People who have done a tenant-to-tenant migration involving Teams know about the difficulties involved in migrating to the same platform. Moving to a different platform sets a whole new benchmark for problems when a workload that’s heavily integrated with a platform is involved.

Seeking a Remedy for Teams Anti-Competitive Behavior

According to the Financial Times, European Union officials are concerned that unbundling is insufficient to enable fair competition. I’m no expert in European anti-trust law, but if no technical remedy exists because the European Union discounts the unbundling of Teams, then the likely outcome (if charges are proven) appears to be a fine. The European Union can levy fines of up to 10% of a company’s worldwide revenues, so there’s lots of latitude to impose a very big fine.

One thing’s for sure. Microsoft and the European Union will go through a long, complicated, and difficult negotiation to establish if they can construct a remedy that satisfies all parties. It will be interesting to see how this situation evolves.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Slash Commands Designed to Speed Access to Common Functions

For many years, Teams clients have supported shorthand commands invoked with the slash (/) key in the command box at the top of the screen. The idea behind these commands is to speed access to essential features. Originally, the set of commands focused on setting the online status for a user. Over time, Microsoft added more commands to the set, including fast access to apps like GitHub.

Now, announced in message center notification MC785024 (24 April 2024, Microsoft 365 Roadmap 120469), Teams supports slash commands in the compose message box for both chats and channel conversations. The feature is supported in the desktop, browser, and mobile clients and is scheduled for release in mid-May. General availability is expected to complete deployment to all tenants by the end of June 2024.

Available Slash Commands

As the name implies, slash commands are invoked by entering a forward slash in the message compose box. This action causes Teams to list the available commands, which are different to the set available in the command box (the same commands to set a user’s status are available):

• Apps: Add an app.
• Available: Set your online status to Available.
• Away: Set your online status to Away.
• Brb: Set your online status to Be right Back.
• Busy: Set your online status to Busy.
• Code: Insert a code block.
• Dnd: Set your online status to Do not Disturb.
• Loop: Add a Loop paragraph component.
• Offline: Set your online status to Offline.
• Settings: Open the settings app.
• Shortcuts: Open a screen to show details of available keyboard shortcuts.

The slash command only works if it is the first element in a message. For instance, Figure 1 shows the slash commands revealed when composing a channel message. The command works because nothing precedes it in the message. If you insert a forward slash after the text, it has no effect, and you won’t see the commands.

Despite what’s stated in MC785024, there’s no way to mute a conversation using a slash command. Also, while the list of commands mentions inserting a Loop paragraph, the other components supported by Teams are available and can be selected after inserting the paragraph component (Figure 2). Only a single Loop component can be inserted into a message.

A code block can be inserted into a message along with a Loop component. This is the Teams code block which is a static component. If you want to share code, you’re better off inserting Loop and choosing its code component because people can then adjust the code as necessary.

No Administrative Control

There’s no administrative control available to enable or disable slash commands. They are part of the base Teams client user interface. Of course, if you don’t want people to use slash commands, don’t tell them that the facility exists. It’s unlikely that someone will find that slash commands exist through a process of inserting random characters in messages. Or maybe that’s not true.

Will People Use Slash Commands?

Nice as it is to have slash shortcut commands, I doubt this will make much difference to the average user. If people want to set their online status, they’ll probably continue to do this using the command box. There are options to insert a code block or Loop component into a message, and I don’t think that many add an app to a message. I’ve been known to be wrong before, and clearly Microsoft believes that the demand exists for this feature. Maybe the demand comes from internal Microsoft users. Who can say?

Follow Response Advances the State of the Calendar Art

It’s genuinely difficult to find innovation in calendaring. After so many years of so many people working on developing features to make user and shared calendars as productive as possible, it’s seldom that a new capability appears that makes people sit up and take notice. I think that the Follow option (MC786325, 26 April 2024, Microsoft 365 roadmap item 154557) is in that category, especially for those with heavily-scheduled calendars. The option rolled out to targeted release tenants in late April 2024. General availability is expected to start in mid-June 2024 and complete by the end of July 2024.

The Follow option is available when responding to meeting requests in OWA, the Monarch client, and Teams. The option is not currently available in Outlook classic (Windows or Mac) or Outlook mobile. If meeting organizers use Outlook classic, they see Follow responses as tentative. This problem will disappear after Microsoft upgrades Outlook classic to support Follow responses, as I hope they do soon.

Essentially, instead of accepting or declining a meeting, a meeting participant can indicate that they are interested in the meeting content and want to stay informed, even if they can’t attend in person or online.

Meeting Artefacts Core Underpinning for Follow Responses

Follow is a feature made possible by the preservation of meeting artefacts such as chat, transcribe, meeting recap, and shared files. It’s great that these elements capture what happened during a meeting and are available afterward for review, but until now the items have only been available to meeting participants. If you decline a meeting, you become a non-participant and have zero access.

You can’t respond to every calendar meeting request with Follow. It wouldn’t make sense to Follow a one-to-one meeting because you’re telling the other person that they can go ahead with the meeting but you’re not going to be there. In short, a meeting’s got to have enough participants to happen even if you’re absent.

Two big things happen if you respond to a meeting request with Follow (Figure 1). First, the meeting remains on your calendar. However, your availability is unaffected because a followed meeting does not block out time, meaning that it’s possible to accept another (more important) meeting. Second, you retain access to meeting artefacts.

Meeting Organizers Responsibilities

Obviously, if a meeting organizer receives some Follow responses (Figure 2), it’s a big hint for them to make sure that the meeting is recorded and transcribed. The text shown in the meeting response is part of the meeting body, so it appears in all versions of Outlook, even when a meeting organizer uses Outlook classic and sees a Follow response as tentative.

To remind the organizer what they should do to facilitate those following the meeting, Teams prompts the meeting organizer when they join the meeting to take action to record the proceedings (Figure 3).

I often use Copilot for Microsoft 365 to generate a summary of the key points and action items that I then edit to add emphasis (and correct some of Copilot’s little flaws) before circulating the information via email. Sure, this isn’t the same as making the data available through Teams, but some appreciate getting the quick summary via email.

A Real Improvement

Adding an onsite status for a meeting is another example of where Microsoft is developing the calendar app. It’s a worthy change, but it’s not of the same import as the Follow response. This feature is something to bring to the attention of people who make heavy use of their calendars.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Team Channel Collaboration Might be the Most Important Method in the Future

Among the blur of new features appearing in Teams and the transition to the new Teams 2.1 client is a small but important change in focus to the creation process for new teams and channels. The change to how people create teams is described in MC697434 (last updated on 19 January 2024, Microsoft 365 roadmap item 163364) and is now available everywhere.

Essentially, the change simplifies the flow of team creation by removing complexities such as creating teams from existing Microsoft 365 groups or templates to a separate screen that is only called when necessary. Everything is trimmed back to the basics of giving a name to a new team, describing its purpose, and setting its access type (private or public), with or without reference to a container management sensitivity label.

If you’re interested in managing the discoverability of private teams, container management labels are the way to go as label settings can control how users see private teams in the Join team experience.

All the other options that enrich but complicate the team creation process are now in a separate screen (Figure 1). Organizations that have invested heavily in developing team templates might dislike the change, but the advantage of simplifying of one of the most important processes in Teams cannot be denied.

Team Channel Collaboration Might be the Better Option

The initial screen shown to users who go to create a team includes the option to create a channel instead (Figure 2). The two options are presented alongside quite deliberately. In many instances, people create teams where they could create a channel. By showing the option to create a channel alongside a team, the hope is that those intending to create a team might stop and choose a channel instead.

A single team can now support up to 1,000 channels (including deleted channels). The channels can be any mixture of regular, shared, and private channels with the sole restriction being that there can be a maximum of 30 private channels in a team.

With so many channels available, there’s plenty of room for a new channel to host conversations about a topic. If extra privacy is needed, a private channel can support up to 250 members (all of whom must be team members). If the need is to share information more generally, a shared channel can handle the job within and outside the tenant. Once the topic is resolved or comes to a natural conclusion, the recently-introduced channel archive feature is available to preserve its contents.

The expansion to 1,000 channels was a significant signpost to the future. Creating too many teams is a recipe for wasteful consumption of resources, the accumulation of digital debris in disused teams and SharePoint sites, and the danger that users will lose sight of value in a mass of teams (not all of which are well named or well managed).

Some Hints for the Future

At the Microsoft 365 Community Conference in Orlando, Microsoft speakers gave some hints that channels receive a lot of current focus in their thinking about how to bring collaboration forward. All types of channels are owned by a team at present, but in the future, it might be possible to have a standalone channel that isn’t limited to the membership of a Microsoft 365 group and the resources available to that group.

Making such a change would challenge the way we think about Teams, especially the one-to-one association that currently exists between a team and a Microsoft 365 group. Challenges still exist in the current model, notably in areas like app support for shared channels where Planner is a much desired but still unavailable app. A new type of channel might be needed to break the mould. We’ll see in time.

Reduce the Number of Teams Created in Microsoft 365 Tenants

In the interim, it seems wise to avoid creating new teams unless they are absolutely necessary. Coach users to understand that they don’t need the full-fledged structured resources that come along with a team for what is often an expanded form of group chat. Instead, whenever possible, use channels in existing teams. Given what we know from the past, better use of channels will probably reduce the digital rot within tenants, and given the hints for the future, might prepare everyone for where Microsoft just might have earmarked as the way to develop the next generation of Teams.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Teams Video Messages Can Use Blurring or Images as a Background Effect for Clips Recorded on iOS client

Teams introduced the ability to send one-minute-long video messages in chat in September 2022. The process uses Stream components to record the clip (and trim to the required length) before posting. Everything works, but the increasing use of mobile devices means that people want to be able to communicate on the go using any device, which brings us to message center notification MC718553 (last updated 27 March 2024, Microsoft 365 roadmap item 380852).

MC718553 announces the ability to record video clips on Apple iOS devices with limited background effects. Unlike Teams background effects used by the desktop and browser clients, the iOS client uses images stored in the device’s photo library. Before they record a video clip, users can choose to paint their background with an image or two types (light and heavy) blur. The one-minute limit for clip length remains in force.

Microsoft expects to complete roll-out of the new feature by May 2024 to commercial, GCC, GCC High, and DoD tenants.

Requirements for Teams Video Messages

I’m no video expert and I seldom use videos in chat. It seems easier to write down what I need to say and move on. However, I recognize that the world is changing, and many find it easier and more productive to express themselves in a quick video. The world’s big enough to accommodate all sorts, which brings us back to how to make a video clip.

You can only send a video message if the AllowVideoMessages setting in the Teams messaging policy governing your account is true. If not, you’re limited to sending photos from mobile devices. Administrators can check in the Teams Admin Center (Figure 1) or by running the Get-CsTeamsMessagingPolicy cmdlet:

Get-CsTeamsMessagingPolicy | Format-Table identity, allowvideomessages

Identity       AllowVideoMessages
--------       ------------------
Global                       True
Tag:Default                  True
Tag:EduFaculty               True
Tag:EduStudent               True

You can post Teams video messages to chats and channel conversations. At this point, I think this is the only way to post a video message to a channel conversation.

Making One-Minute Clips

The magic begins when a user selects the Teams camera next to the message compose box when replying to a chat or channel conversation. The right-hand icon exposes options to select an image or one of the two types of blurs. You can change the image during filming if you’re quick and dexterous enough to do this kind of thing without making a complete mess of the video.

Eventually, the right background image is combined with the right position for the message sender (Figure 2), and everything is ready to record the video clip. Click on the canvas (where the background image and your face are combined) to reveal the video controls and click the record button to start. Keep talking until the minute’s up or you run out of words to say. If the length of the clip exceeds a minute, you’ll need to trim it to get under the maximum length. Send the message and Teams adds it to the target chat or conversation.

Figure 3 shows the result of a video clip sent from an iPhone playing in a channel conversation. I was able to post to standard, private, and shared channels. Unlike chats, where Teams stores the video files in its own store, clips sent to channels end up as MP4 files in the SharePoint folder for the channel. Clips posted to channel conversations use the Stream player for playback.

Like the previous iteration of video messages, the […] menu allows chat participants and channel members to download either the transcript or the video.

Compliance Still an Issue for Teams Video Messages

When Microsoft introduced video messages, I pointed out that the compliance records captured for these messages didn’t include any metadata that might be useful to eDiscovery investigators. It is entirely possible to send video clips that convey threatening or abusive content, plan illegal operations, or reveal sensitive or confidential information, all of which is ignored by communications compliance policies and data loss prevention policies, and invisible to eDiscovery searches.

I pointed this issue out to Microsoft in 2022 and suggested that some form of transcription might help. That suggestion appears to have fallen on deaf ears. I’m used to being ignored.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Removing the Share to Teams Outlook Add-in

I’ve never had more than a passing relationship with Microsoft 365 integrated apps (Figure 1). The most I have done is deploy some Outlook add-ins to Exchange Online mailboxes like the Message Header Analyzer.

All of which meant that I probably wasn’t the best person to ask how to remove the Share to Teams Outlook add-in for selected mailboxes. The Share to Teams add-in allows an Outlook user to post a message from Outlook to a one-to-one or group chat or to create a new conversation in a team channel (Figure 2).

Essentially, the add-on signs into Teams for the user and posts the message using a Graph API request. The add-on only works for the user’s home tenant. You can’t use it to post as a guest member to a host tenant. I quite like the add-in but admit that I don’t use it very often. At this point, Share to Teams seems like something that Microsoft had to develop to help people move from email-centric work habits to the chat-based nature of Teams.

Whether Share to Teams helped very much is an open question, but its existence was probably enough to reassure people that it is possible to send information to and from between Outlook and Teams, which has an equivalent Share to Outlook feature to transmit messages in the opposite direction.

Exchange Online App Management Cmdlets

Some research revealed that PowerShell offers a viable solution. The Exchange Online management module contains cmdlets to create, list, remove, and disable apps. For instance, the Get-App cmdlet reveals details of the installed apps for a mailbox:

Get-App -Mailbox lotte.vetler | Format-Table AppId, DisplayName, ProviderName

AppId                                DisplayName             ProviderName
-----                                -----------             ------------
131a8b55-bd40-4fec-b2e6-d68bf5929976 Translator              Microsoft
afde34e6-58a4-4122-8a52-ef402180a878 Polls                   Microsoft Corporation
545d8236-721a-468f-85d8-254eca7cb0da Share to Teams          Microsoft
6b47614e-0125-454b-9f76-bd5aef85ac7b Send to OneNote         Microsoft Corporation
fe93bfe1-7947-460a-a5e0-7a5906b51360 Viva Insights           Microsoft
62916641-fc48-44ae-a2a3-163811f1c945 Message Header Analyzer Stephen Griffin
6046742c-3aee-485e-a4ac-92ab7199db2e Report Message          Microsoft Corporation
c61bb978-adb2-4344-abe9-d599aa75704f EmailTranslator V1.1    Avishkaram
f60b8ac7-c3e3-4e42-8dad-e4e1fea59ff7 Action Items            Microsoft
7a774f0c-7a6f-11e0-85ad-07fb4824019b Bing Maps               Microsoft
a216ceed-7791-4635-a752-5a4ac0a5eb93 My Templates            Microsoft
bc13b9d0-5ba2-446a-956b-c583bdc94d5e Suggested Meetings      Microsoft
d39dee0e-fdc3-4015-af8d-94d4d49294b3 Unsubscribe             Microsoft

The AppId identifier is important because it’s the required value to pass to tell the cmdlet which app to manage.

Scripting Disabling an App

The first task is to identify the set of mailboxes to process. I don’t know why the desire existed to remove the Share to Teams add-in. Perhaps it’s because a division within the company has decided that their users should not use the add-in. Maybe some senior manager took a dislike to the add-in. Or maybe it’s the result of a decision to separate Outlook and Teams communications. For whatever reason, it’s still important to find mailboxes to process. You can do this with the Get-ExoMailbox cmdlet.

Once the targets are identified, it’s a matter of looping through the mailboxes to use the Disable-App cmdlet to turn off the add-in for each mailbox. This code fetches a set of mailboxes based on a value in a custom attribute and checks each to extract the set of enabled apps. If that set includes the Share to Teams app, the Disable-App cmdlet turns Share to Teams off.

$TargetAppId = "545d8236-721a-468f-85d8-254eca7cb0da"  # Id for the Share to Teams app
$TargetAppName = "Share to Teams"
[int]$RemovedApps = 0
[array]$Mbx = Get-ExoMailbox -Filter {CustomAttribute9 -eq 'NoApp'} -RecipientTypeDetails UserMailbox
ForEach ($M in $Mbx) {
    Write-Host ("Checking mailbox {0} for the {1} app" -f $M.displayName, $TargetAppName)
    [array]$InstalledApps = Get-App -Mailbox $M.Alias | `
         Where-Object {$_.Enabled -eq $true} | Select-Object -ExpandProperty AppId
    If ($InstalledApps -contains $TargetAppId) {
        Write-Host ("Disabling app for {0}" -f $M.displayName) -ForegroundColor Yellow
        Disable-App -Identity $TargetAppId -Mailbox $M.Alias -Confirm:$False 
        $RemovedApps++
    } Else {
        Write-Host ("App {0} not installed for {1}" -f $TargetAppName, $M.displayName)
    }
}
Write-Host ("Removed {0} instances of the {1} app from {2} scanned mailboxes" -f $RemovedApps, $TargetAppName, $Mbx.count)

Disabling Outlook Add-ins Isn’t Immediate

It usually takes several hours before Outlook picks up the newly disabled status for the add-in. The app data is cached within the service and refreshed periodically. That refresh must happen before clients can detect the change. There’s nothing you can do to accelerate the process, so consume some of your favorite beverage and chill out.

Learn more about how the Office 365 applications really work on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.

Final Retirement of the Teams Classic Client in July 2025

The current Teams classic client is the last iteration of the original client launched in preview in November 2016 as a “chat-based workspace” (Figure 1) Teams reached general availability in February 2017 and remained the focus for customers until the arrival of the preview of the Teams 2.1 client (code name “Emblem”) in March 2023.

Why version 2.1 instead of Teams 2.0? Well, the Teams 2.0 client was the first run at a new architecture that appeared as the chat client in Windows 11. That client lacked any of the enterprise features that Teams built its 320 million installed base on, and really wasn’t very good. That problem is addressed in the single desktop application “unified Teams client” (Microsoft 365 roadmap 383006), which is now rolling out.

Many Changes Since 2016

The elements of the original Teams client from 2016 are recognizable when compared to the final release of the V1.0 client but so much changed over the seven years of active development. The most notable

• Worldwide deployment to support customer data residency needs.
• Scalability improvements from the original 600-member limit for a team to 10.000.
• Support for compliance functionality like retention, data loss prevention, and communications compliance policies.
• Massive change and increased functionality in calling, meetings, and webinars, including the migration from Skype for Business Online and the introduction of the Teams Phone ecosystem.
• Shared and private channels, and up to 1,000 channels per team.
• Support for automation through PowerShell module and Graph APIs.
• Development of the Teams app ecosystem, including app setup and permissions policies and bulk deployment.

All the above happened using the original Electron-based client. Soon after its release, Teams took over from Outlook as the favorite example of a piggy application when it came to the consumption of workstation resources. Increased functionality extracts its price, but Electron added more on top.

Teams Classic Client Retirement Schedule

Which brings us to message center notification MC783985 (23 April 2024), which lays out the retirement schedule for the classic Teams client.

On July 1, 2024, the Teams classic client exits support. Users will see nagging messages to remind them that support is no longer available. This “helpful” communication has already started (Figure 2) to join the other annoying messages surfacing in Teams.

Starting on October 23, 2024, Microsoft will block use of the classic client on older platforms such as Windows 7 (still heavily used by large organizations), Windows 8 and 8.1 (ignored by most), and macOS Sierra (10.2). Users of these platforms can switch to the new Teams browser client, but can’t use the new client because of the requirement to use Windows 10 version 10.0.19041 or higher or macOS Monterey (12) or higher.

On July 1, 2025, the Teams classic client reaches “end of availability” and is blocked. Users who attempt to use the classic client see a non-dismissible dialog telling them that they must upgrade. Those using supported platforms can choose between the new client desktop or browser versions. It’s worth noting that Microsoft now supports the new client with the Firefox browser for Windows, macOS, and Linux and the Safari browser for macOS. Previously, the new client only supported Chrome and Edge.

Smooth Transition to Teams 2.1

I haven’t heard of many issues as organizations make the transition to the new Teams client. The new client is faster, consumes fewer resources, and boasts a wonderful account switching capability that makes it much easier to move between tenants. You can even run the new client with a classic skin to make it look like the old client.

Some issues remain for Microsoft to resolve, but that’s always the case in software transitions. Balancing the lack of some features that exist in the old client and are not yet in the new are the introduction of new functionality like enhanced noise suppression during meetings (MC780744) and intelligent message translation for chats (MC748379). A trnslation capability for Teams channel conversations and chats has existed since 2018, so I’m not quite sure what the “intelligent translation” means, especially when translation doesn’t work sometimes. Figure 4 shows the same message sent twice to a group chat. One translated, one didn’t.

I guess the intelligence comes from the way that translation happens automatically if you configure this in Teams Settings. And to be fair, it does work – most of the time. The joys of software…

Learn about using Teams and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

A “Ringless” Meet Now for Chat Participants

Message Center notification MC762503 (30 March 2024) gives details about a new Meet Now experience for Teams group chats (chats with more than two participants). The Meet Now feature is not a new concept. It’s a feature that has been available for channel conversations and group chats since the earliest days of the Teams product. Basically, Meet Now is a shortcut to start an audio or video online meeting with the participants in a channel or chat conversation without needing to schedule a calendar event.

The change is described in Microsoft 365 roadmap item 128191 and is available for the new Teams (2.1) client (desktop and browser) plus the mobile clients. Rollout to targeted tenants is due in early May 2024 followed soon afterward by general availability worldwide.

Improving How Meet Now Works in Group Chats

Until now, the user interface offered the option of starting a video or audio call (Figure 1).

The new experience replaces the dual video/audio call options with a single Meet Now button (Figure 2). Microsoft says that this starts an: “instant, ringless live discussion with your colleagues, without scheduling a meeting.”

The choice of words used to describe the update is interesting. Microsoft says that Meet Now initiates a: “ringless, live discussion.” A group chat is already a discussion, so the important word is ringless. What happens is that Teams launches an online meeting without “ringing” the participants. Instead, an icon in the menu bar informs group chat participants that a meeting is in progress (Figure 3).

Starting the meeting without ringing means that the group chat participants are not disturbed by a notification to join the meeting. They can join or ignore the meeting as they wish. All the normal meeting capabilities such as recording and transcription are available. Any artifacts generated during the meeting are added to the group chat after the meeting finishes. It’s the kind of change that drives documentation writers (and book authors) up the wall because of the update to the user interface and flow. But no one cares about documentation anymore, do they?

Not an Earthshattering Change

The new Meet Now experience is not an earthshattering change. Rather, it’s an update in the same category as being able to add a custom picture to a group chat – nice but not essential. In this case, the update for the Meet Now feature simplifies the way it works, so it is an improvement without advancing the state of the art.

More Changes Coming

The probability is that we will see other updates of this nature over the next few months. Microsoft’s big effort to introduce the Teams 2.1 client is now tapering down and engineers can devote more energy to rounding out the new client with features that might not have been on the original priority list (or cut to make the target date). That’s not to say that these changes aren’t important. It’s always good to receive updates that refine and improve how software works, and that’s what the new Meet Now implementation does.

So much change (even small ones), all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Scripting Teams Urgent Messages for a Set of Users

A reader asked if it was possible to write a PowerShell script to send chats to a set of people when something important happened, like a failure in an important piece of plant or a medical emergency. They explained that they have the facility to broadcast this kind of information via email, but a lot of their internal communications have moved to Teams and they’d like to move this kind of scripted communication too.

Teams supports urgent messages for one-to-one chats. Originally, these messages were called priority notifications and Microsoft planned to charge for their use. That idea disappeared in the mists of the Covid pandemic, and anyone can send urgent messages today. The nice thing about urgent messages is that Teams pings the recipient every two minutes until they read the message or twenty minutes elapses.

Compose and Send Teams Urgent Messages with PowerShell

The Teams PowerShell module is designed for administrative activities and doesn’t support access to user data like chats. To compose and send chats, you must use Graph API requests or cmdlets from the Microsoft Graph PowerShell SDK, which is what I chose to do.

The outline of the script is as follows:

• Run the Connect-MgGraph cmdlet to connect to the Graph. Delegated permissions must be used, and I specified the Chat.ReadWrite and User.Read.All permissions.
• Because the script works with delegated permissions, the chats are sent by the signed-in user. The script runs the Get-MgContext cmdlet to find out what that account is.
• The script sends chats to a set of users. Any Entra ID group will do.
• The New-MgChatMessage cmdlet eventually sends the chat message. Because I want to include an inline image and a mention in the message, work must be done to construct the payload needed to tell Teams what content to post.
• In Graph requests, this information is transmitted in JSON format. PowerShell cmdlets don’t accept parameters in the same way. Three different parameters are involved – the body, the mention, and the hosted content (image uploaded to Teams). Each parameter is passed as a hash table or array, and if the parameter takes an array, it’s likely to include some hash tables. Internally, Teams converts these structures to JSON and submits them to the Graph request. You don’t need to care about that, but constructing the various arrays and hash tables takes some trial and error to get right. The examples included in Microsoft documentation are helpful but are static examples of JSON that are hard to work with programmatically. I use a different approach. Here’s an example of creating the hash table to hold details of the inline image:

# Create a hash table to hold the image content that's used with the HostedContents parameter
$ContentDataDetails = @{}
$ContentDataDetails.Add("@microsoft.graph.temporaryId", "1")
$ContentDataDetails.Add("contentBytes", [System.IO.File]::ReadAllBytes("$ContentFile"))
$ContentDataDetails.Add("contentType", "image/jpeg")
[array]$ContentData = $ContentDataDetails

• After populating the hash tables and arrays, the script runs the New-MgChat cmdlet. If an existing one-on-one chat exists for the two users, Teams returns the identifier of that chat thread. If not, Teams creates a new chat thread and returns that identifier.
• The script runs the New-MgChatMessage cmdlet to post the prepared message to the target chat thread. Setting the importance parameter to “urgent” marks this as a Teams urgent message.

$ChatMessage = New-MgChatMessage -ChatId $NewChat.Id -Body $Body -Mentions $MentionIds -HostedContents $ContentData -Importance Urgent

The Urgent Teams Message

Figure 1 shows an example of the chat message posted to threads. You can see the inline image and that an @mention exists for James Ryan. If the recipient hovers over the mention, Teams displays the profile card for James Ryan to reveal details like contact information.

You can download the script from GitHub.

Plain Sailing After Understanding Parameter Formatting

There’s no doubt that it’s more complicated to create and send one-to-one chats than it is to send email to a group of recipients, especially if you stray away from a very simple message body. However, much of the complexity is getting your head around the formatting of parameter input. Once you understand that, it’s reasonably easy to master the rest of the code.

Learn about using the Microsoft Graph PowerShell SDK and the rest of Microsoft 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Standard Group Chat Pictures Instead of Avatars

The announcement in message center notification MC717970 (last updated 4 April 2024) that Microsoft is introducing “custom avatars for group chats” is not what you think. No mesh avatars are involved. Microsoft 365 roadmap item 119305 clarifies the situation by saying that the avatars referred to in MC717970 are no more than the profile picture for group chats.

What’s happening is that any member of a group chat (including guest accounts) can choose from a set of “pre-selected illustrations” (no doubt selected to communicate what happens in typical group conversations) or one of the 1,800 emojis available in Teams. And if they can’t find a suitable picture, they can upload a file and use that instead. Apparently, pictures add “a layer of inclusivity and expression” to group chats.

The update began rolling out in mid-March and should be complete worldwide by mid-April. You probably have it now but don’t realize that the facility exists.

Adding a Group Chat Picture

Until now, group chats get a default picture generated from the profile pictures of the participants (or their initials, if no pictures exist). Figure 1 shows a typical example. Note that this group chat has already been renamed to clearly communicate the intention of the chat. Using appropriate names also makes group chats easier to find in the chat list because you don’t end up with a bunch of chats named after the chat participants.

The problem with the generated group chat pictures is that they don’t stand out in the chat list. One generated picture looks much the same as the others, which makes it difficult for users to scan the list and find a specific group chat quickly.

To add a picture, click on the existing picture to reveal the set of 36 pre-selected illustrations (Figure 2) and select a picture to use.

Alternatively, click the Emojis button to pick from the full set of emojis available in Teams or use the upload button to select a custom picture file (JPEG or PNG format of up to 4 MB in size). Be careful with custom pictures as it’s easy to choose a photo that loses all detail and definition when reduced to the small thumbnail size used for a group chat picture.

Teams Client Display of Updated Group Chat Photos

After selecting the picture, remember to save your selection. This action forces Teams to update the metadata for the group chat and post a message into the chat to tell participants that the group picture changed. Saving the picture sometimes results in the desktop client displaying the chosen picture. Mostly, the new picture doesn’t show up in the desktop client for a while, possibly due to caching. The same behavior doesn’t happen in the mobile and browser clients where picture updates appear the next time the group chat is accessed.

Eventually something happens in the bowels of the desktop client, and the intended picture appears in the chat list. No doubt Microsoft will tweak the desktop client to make sure that things happen as planned.

An Innocuous Feature

Adding the ability to add a custom picture to a group chat falls into the category of innocuous but slightly useful features. Those who don’t update group chats are unlikely to update group chat pictures either. Those who might be interested in updating a group chat picture might struggle to find a suitable picture in the set chosen by Microsoft. I guess the biohazard emoji might come in useful, but I wonder if anyone would notice if I set a group chat to have that picture?

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Blocking Sub-Domains in the Tenant Federation Configuration

The publication of message center notification MC770792 (5 April 2024) describing a new Teams tenant federation setting to block all sub-domains of a blocked domain seems like a very good idea. After all, if you decide to block inbound connections from “malware.com.” it’s likely that you also want to block sub-domains like “marketing.malware.com.”

Microsoft says that the update should be in all tenants by mid-April. From an administrator perspective, the change becomes active with version 6.1 of the Microsoft Teams PowerShell module, which adds support for the BlockAllSubdomains switch for the Set-CsTenantFederationConfiguration cmdlet. For example:

Set-CsTenantFederationConfiguration -BlockAllSubdomains $True -BlockedDomains "malware.com"

The new setting isn’t used by default and won’t affect existing block lists. If you do use it, Microsoft notes that the setting blocks “all new communication to and from subdomains in the Block list… Existing 1:1 chats with users from blocked subdomains will be disabled. In existing group chats with users from blocked subdomains, the users from the blocked subdomains will be removed from the group chat.”

Updating the Allow List

In September 2022, I wrote an article explaining how to update the Teams external federation configuration with PowerShell. The idea was to create an allow list for federated chat based on the home domains for guest accounts known in the tenant directory. The article was a response to the theoretical “GIFShell” attack against Teams by a security researcher. Having an allow list of known domains means that users can only communicate with users belonging to domains in the allow list using one-to-one federated chat. It’s still the most effect way of blocking potential malware arriving in a tenant via Teams chat with an attacker.

I looked over the code to remind myself about how to manipulate the tenant federation configuration and realized that a nice update would be to check the domains for guest accounts to make sure that they are Microsoft 365 tenants before adding them to the tenant federation configuration. For instance, guest accounts might belong to domains like gmail.com, yahoo.com, and outlook.com, but there’s no need to have these large consumer domains in the configuration.

The technique explained in the article about tenant identifiers provided the foundation for the solution. I created a function to check if a domain is a Microsoft 365 tenant and call the function to check a domain before including it in the list to update the tenant federation configuration with. Here’s the function:

function Get-DomainByCheck {
# Check a domain name to make sure that it's active
  param (
      [parameter(Mandatory = $true)]
      $Domain
  )

  $Uri = ("https://graph.microsoft.com/v1.0/tenantRelationships/findTenantInformationByDomainName(domainName='{0}')" -f $Domain) 
  Try {	
    [array]$Global:DomainData = Invoke-MgGraphRequest -Uri $Uri -Method Get -ErrorAction Stop
    If ($DomainData.displayname -in $UnwantedRealms) {
      Return $false
    } Else {
      Return $true
    }
  } Catch {
    Return $false
  }
}

Domains that pass the test are added to the tenant federation configuration, which is also available through the Settings & Policies section of the Teams admin center (Figure 1).

Dealing with Unwanted Domains

You’ll notice that the function checks against an array called $UnwantedRealms. If a domain is found in the array, the function returns false to indicate that the domain shouldn’t be added to the tenant federation configuration. The script defines the array as follows:

$Global:UnwantedRealms = "MSA Realms", "Test_Test_Microsoft"

If the Graph findTenantInformationByDomainName API matches a Microsoft 365 tenant, its display name is returned in the domain information fetched by the request. For instance, if the function checks Microsoft.com, the display name is Microsoft. But if it checks a domain which is federated for identity purposes with Entra ID, like gmail.com, the display name is “MSA Realms.” And the display name returned for the domains used by Teams to deliver email to channels (like amer.teams.ms) is “Test_Test_Microsoft.” Perhaps the engineers never thought that the display name they selected for these domains would ever see the light of day…

Why would guest accounts have email addresses belong to Teams channels? The SMTP addresses generated by Teams for channels can be given to guest accounts to allow the account to be a member of a Microsoft 365 group. Any email sent to the group will automatically end up as a channel conversation and serve as a record of that email interaction. Another method to bring email into Teams is to create mail contacts with Teams channel addresses and include them in distribution lists. In any case, we don’t need to include the Teams email domains in the tenant federation configuration, which is why the script excludes them.

Scripting Makes Processing Multiple Domains Easier

The Teams tenant federation configuration is easy to maintain through the Teams admin center. PowerShell makes it easier when large numbers of domains are involved. If you want to see the code I used, download the script from GitHub.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Phishing Attacks Against Teams

A March 14 article called Wishing: Webhook Phishing in Teams published by Black Hills Information Security discusses the potential malicious use of incoming webhooks for Teams channels. There’s a lot to read in the article and Black Hills say that they disclosed the issue described to Microsoft in January 2024. Apparently, the Microsoft Security Response Center (MSRC) closed the issue without a fix. But as reported below, some changes appear to be in progress to mitigate the problem by making the incoming webhook connector into a Teams app and limiting access to team owners.

The incoming webhook connector is one of many connectors supported by Teams. Incoming webhook connectors import snippets of information from external sources and post them as new conversations in the channel that hosts the connector.

The intent behind posting items is to inform team members about news to either spark a conversation within a team or to encourage users to follow up and discover more information about a topic, possibly by following a link in an adaptive card. Like any team message, the size of what a connector can post to a channel is limited to 28 KB.

When a team owner configures an incoming webhook connector for a channel, Teams generates a target URL for apps to post to. A channel can host multiple instances of the incoming webhook connector, each with its own URL. Webhook connectors do not use authentication, but messages posted through these connectors must follow a specific format.

The article describes how Black Hills built a module in the GraphRunner tool (available from GitHub) to fetch connector information from Teams channels. No public Graph API is available to retrieve connector information, so reverse engineering was necessary to track down the API endpoints and required tokens. The work traversed some artifacts of Teams history, such as the references to Skype Spaces and the outcome is a list of channels with URIs configured for the incoming web connector. The article also covers details about creating new incoming webhook connectors for channels.

Looks Like Microsoft is Changing the Way Inbound Webhook Connectors Work

Playing around with incoming webhooks using code like that described in the article about posting new Microsoft 365 roadmap items to Teams channels, I discovered that although it was possible to configure an incoming webhook for a channel using the new Teams, attempts to post to the URI failed with this error:

Invoke-RestMethod: Microsoft.Substrate.Connectors.Store.Exceptions.ExchangeInvalidGroupIdException: Exception of type 'Microsoft.Substrate.Connectors.Store.Exceptions.ExchangeInvalidGroupIdException' was thrown. ErrorCode:ErrorInvalidGroup

The error text implies that Teams couldn’t find the right group (team) to post to. However, if I configured the incoming webhook connector using the old Teams, the URI generated worked. Curiously, the URI generated by Teams classic for the connector uses one of the fallback domains for my tenant (https://derrigimlagh.webhook.office.com/) rather than the usual. (https://microsoft.webhook.office.com/). This implies that work is ongoing to update how Teams uses the incoming webhook connector and that Microsoft hasn’t implemented the code in Teams classic because the client is due to retire on March 31.

Another difference I noted is that a Teams app is now called the first time an owner configures the incoming webhook connector in a team (Figure 1). Management of the app is like any other Teams app, and it can be restricted to specific users via app permission policies.

It would be normal for a security review to happen during the transition to a new version of a client. It seems like this might be happening as Microsoft prepares to make the Teams 2.1 client the norm.

Spamming Team Channel Email Addresses

Next, the discussion moves to email addresses for team channels. Email sent to these addresses do not go through the regular email environment for tenants and are handled by a special infrastructure created for Teams. However, the traffic still goes through Exchange Online Protection.

Channel email addresses recently created limit acceptance of inbound email to team members. It’s also possible to limit receipt to a specified list of domains. Older channels are likely to have the older default, which allows the channel to receive email from anywhere (Figure 2).

It’s probably a good idea to check channels to make sure that they’re not open for anyone to send to. Here’s an article about how to report channels with email addresses.

The article says that “Microsoft claims that this feature needs to be enabled by the Administrator, however, through testing, we can see this is not the case.” My testing shows that the controls on sending email to channels implemented in the Teams admin center work (Figure 3).

With acceptance of channel email set to a limited number of domains, messages from other domains failed with the error:

The administrator has restricted permissions to send emails to this channel.

The authors of the report advise those who want to try out the phishing techniques to sign up for a free developer tenant. This kind of activity might be the reason why Microsoft has limited access to these tenants to those with a Visual Studio Enterprise license.

Check Your Tenant

The results I report here are accurate as of March 15, 2024. Given that it seems like some changes are happening to secure Teams better, so it’s wise to do your own tests to understand the current state of play in your tenant. As is always the case, attackers persist in seeking holes to exploit and things might change in the future in response. As good practice, tenant administrators should understand how information flows into Teams from external sources. It’s easy to control email to channels but the lack of a Graph API to report connectors makes that aspect harder. Let’s hope that Microsoft provides such an API and continues to tighten security around Teams.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Archive Teams Channels Rather Than Keep Them Around

Microsoft 365 message center notification  MC696576 (last updated 16 Feb 2024, Microsoft 365 roadmap item 123769) announced a new feature to archive teams channels. This is part of a Microsoft effort to emphasize channels and to encourage people to use channels for collaboration instead of rushing to create new teams and avoid the plague of teams sprawl. The lack of a Teams directory becomes more evident as time passes.

Initiatives such as adding shared channels to Teams and increasing the number of channels supported by an individual team to 1,000 (a mixture of regular, private, and shared channels) are pointers to the direction Microsoft is heading in to constrain the growth of teams and to encourage people to make better use of existing teams.

Archive Teams Channel in the Client

Teams reached general availability in early 2017. Since then, it’s obvious that a fair amount of debris has accumulated in the form of unused (and possibly unwanted) channels. Up to now, team owners have been able to archive complete teams using the Manage Teams option in the client (alternative methods to archive groups and teams also exist), but it hasn’t been possible to archive selected channels.

Microsoft is rolling the archive channel option (Figure 1) to targeted release tenants. Standard release tenants will see the option at the end of February 2024 with the intention to complete worldwide deployment by mid-March 2024.

Team (or channel owners for shared channels) can archive channels (except the General channel, but you can hide the General channel). When a channel is archived, it is removed from the channel list and it is no longer possible to post new messages to the channel, react to or edit messages, and so on. Optionally, the owner can make the folder in the SharePoint Online site read-only (Figure 2) to stop team members updating files or uploading new files to the folder. Team owners and administrators continue to have access to archived channels and can upload or amend content as necessary.

Use Case for Archived Channels

The Office 365 for IT Pros team uses Teams to coordinate the updating and production of monthly updates for the eBook. We have channels going back to the fourth edition (2018). This is a good use case for the archive channel option because we are now working on the tenth edition and the channels supporting the production of the six previous editions are not in active use. It makes total sense to archive these channels to preserve their content and put them in an inert but accessible state.

PowerShell Access for Archived Teams Channels

Currently, the PowerShell cmdlets that list teams channels from the Microsoft Teams and Microsoft Graph PowerShell SDK modules do not distinguish archived channels. For instance, here’s how to list the channels in a team:

Get-MgChannel -TeamId $TeamId | Format-table Id, displayName

Id                                                           DisplayName
--                                                           -----------
19:0571b31b8d1b4bd0b31e4069743b9d35@thread.skype             General
19:216807403e6d4875b93769b1e66dfe66@thread.skype             2024 Edition (10th) 
19:3d3703b0a6334fb3b9031d6b5a09b222@thread.skype             Office 365 for IT Pros RSS
19:3f176f2065974b73a61c2f58b4acb2e1@thread.skype             2020 Edition
19:51d90f314eed461a8752696cc481d89e@thread.skype             Stream Videos
19:70f50daaed274ba18ac647fe9cb6cd06@thread.skype             Fifth Edition
19:f15426f0bd2545df87aa70bf233c5615@thread.skype             2022 Edition
19:f2cb1f5540f54e06b7a45e90af446ebb@thread.skype             2023 Edition (9th)
19:fb859e8c24aa484da127ef701cf1cde0@thread.skype             Fourth Edition
19:fc327ce8623247eb9867798af13faff9@thread.skype             2021 Edition
19:mGFq7X0e6cG97Z7kUN0PsIj0ZMRPynjo2wA4AwusxoI1@thread.skype Office 365 for IT Pros 2023 Edition

No trace exists that any of these channels are archived (two are). The ability to distinguish between active and archived channels is likely to come in future releases of the PowerShell modules.

Archive Teams Channels is a Good Idea

All computer systems accumulate some debris over time. Clearing out old stuff to focus on the new, useful, and active material makes good sense. Microsoft is focusing on channel management to keep Teams tidy through features like hiding the General channel and archiving channels. It makes sense to run a tidy and managed environment. Archiving team channels helps in that aim, especially in an era when a team can support up to 1,000 channels.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Microsoft 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Tags for Private and Shared Channels Arriving Soon

One of the joys of producing a book about ever-changing technology is keeping an eye on individual updates announced by Microsoft. In some cases, a change can lead to a rewrite for a section in a chapter; others mean updating a few words; and some changes can be ignored because they’re not relevant to the book content.

Take message center notifications MC707674 and MC707670, both published on 17 January 2024. The first covers the support for tags in private channels (Microsoft 365 roadmap item 373545), the second covers the same support for shared channels (Microsoft 365 roadmap item 373555). A tag is a way of addressing a subset of team members. Some tags are created centrally and published to teams. Others are created for specific teams, and some are special tags that come with the product. The team owners tag is an example of the latter type.

Microsoft plans to roll out tag support for private and shared channels to targeted release tenants in mid-February 2024. Deployment to standard release tenants will follow in late March 2024.

Teams Tags for All Channel Types

Microsoft introduced private channels at the 2019 Ignite conference. Shared channels arrived in 2023. Team owners can create a mixture of up to 1,000 standard, private, and shared channels in a team, but up to now support for tags has only existed for standard channels.

Currently, assigning a tag to someone depends on team membership or roster. When Teams builds a membership roster for a team, it bases it on the membership of the team’s Microsoft 365 group. The roster becomes the set of valid users that can be included in tags and used in standard channels conversations. However, private and shared channels have different memberships to standard channels. Membership of a private channel is a subset of the overall team while membership of a shared channel can include people and teams who aren’t members of the team. Guest accounts can be members of private channels but not shared channels.

To enable tag support in private and shared channels, Microsoft adapted the roster creation process for each channel type to ensure that the right set of members can be tagged. They also updated the channel management GUI to incorporate tags, much like the existing tag management for standard channels (Figure 1).

Figure 2 shows tag management for a private channel (indicated by the lock icon in the top right-hand corner). Everything is as you’d expect and the options available to manage tags are the same, including a new ability to create a chat with people who are members of a tag. When you do this, Teams checks if you have an existing group chat with the members. If not, it creates a new chat. It’s a nice way to communicate with specific members in a team or channel.

You might also notice that the “Lawyers” tag includes an emoji. Tags can have names of up to 40 characters, including as many emojis as you like.

Unfortunately, Microsoft hasn’t yet updated the Graph API to allow access to tags defined in shared and private channels. When it does, I’ll update my Teams tag report script.

No More Suggested Teams Tags

While we’re discussing tags, let me note that Microsoft is in the process of deprecating suggested tags. These are standard tags created in the Teams admin center that teams can use if they wish.

The only announcement to date is in the documentation for tag management, but Microsoft has confirmed the retirement to me. The change is effective in the Teams 2.1 client (which is why you don’t see suggested tags in the screenshots above). While Microsoft didn’t say this, I think Microsoft is now focused on doing more of the kind of automatic tagging introduced for the Shifts app.

As evidence of the potential shift in focus, a new tag control is in Teams settings (Figure 3). When on (the default), Teams “automatically assign tags to people who are on-shift in real time. These tags match a user’s schedule and group name in Shifts. Notifications are only sent to those people who are on-shift at the time the tag is used in a chat or channel post.”

Good and Bad

Change is often a mixture of good and bad. I like the new ability to tag members in private and shared channels. I regret the deprecation of suggested tabs, and I’m curious about how automatic tags work in practice. Such is life!

Learn about using Teams and the rest of the Microosoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Outlook Win32 Copilot Support Coming. Teams Gets a Better Integration

After removing the major barriers blocking adoption of Microsoft 365 Copilot last month, Microsoft has quietly dropped its insistence that Copilot would only support the Outlook Monarch client. The latest version of the Microsoft 365 Copilot requirements documentation (2 February 2024) says that Copilot works with the new Outlook client on Windows and Mac (Outlook mobile is also supported) and then notes that “Microsoft Copilot for Microsoft 365 will be supported on classic Outlook for Windows (Win32 desktop app) in the future.”

A link to the Microsoft 365 roadmap lists three items relating to the introduction of Copilot functionality in the classic Outlook client together with dates when the rollout is supposed to start:

• Coaching by Copilot (190927) –February 2024
• Draft by Copilot (190937) – March 2024. Figure 1 shows the draft created by Copilot in OWA.
• Summarize by Copilot (180900) –November 2023

According to the items, Microsoft added 190927 and 190937 on 6 December 2023, and 180900 on December 10, 2023. Don’t pay too much attention to the purported rollout dates until you see a Microsoft 365 message center announcement describing when the new functionality will be available in the preview and other Office channel. Even then, announced dates are often optimistic and end up being delayed. I’m pretty sure that Outlook Win32 support will only extend to the subscription version of Outlook packaged in Microsoft 365 enterprise apps, but we’ll see when Microsoft shares more details.

No Formal Announcement for Outlook Win32 Copilot Support

Speaking of details, I can’t find a formal Microsoft announcement about the change in direction. Ever since the original Copilot for Microsoft 365 announcement in March 2023, Microsoft held to the line that Monarch was the only supported Outlook desktop client. As I noted in August, this position applied despite the fact that Microsoft’s One Outlook program includes the ability for Outlook desktop to use code developed for Monarch/OWA. The only logical conclusion is that Microsoft hoped to use Copilot to drive customers to embrace Monarch.

The sad fact is that Monarch is still not fit for purpose in the eyes of many Outlook users. The lack of offline access and PST support are just two issues that must be addressed before Monarch has a chance to replace the classic client.

Although they’re rolling Monarch out as a replacement for the standard Windows mail and calendar client, Microsoft knows that the software lacks many features needed for success in commercial environments. All the missing functionality is on a list for development, but the fact remains that it’s very hard to force people to change to a client that doesn’t do what they need, and this became a blocking factor for Copilot adoption.

Given that making it easy for customers to use Copilot is much more important for Microsoft than achieving an earlier switchover to Monarch is, the choice for senior management must have been simple, and that’s probably why the restriction is gone. Customers will applaud the new reality.

New Copilot Experience in Teams

Meanwhile, on February 12, Microsoft announced a new Copilot experience in Teams. Like the rest of Teams, the experience is in the form of an app that administrators can control through setup policies. According to Microsoft, the major changes are better prompts, access to Copilot Lab to see prompts that you might use, and a list of your Copilot chat history.

The app delivers a chat experience, so it should come as no surprise that Teams can store and reveal previous interactions with Copilot. The chat messages are captured for compliance purposes, just like personal and group chats, and can be retrieved by content searches for eDiscovery.

Just to be sure that Copilot support for Outlook Win32 is a reality, I asked Copilot in Teams (Figure 2) about Outlook Win32 Copilot support. After thinking for a bit, Copilot duly responded to confirm support and noted two references, one being the requirements documentation, the other a document stored in a SharePoint Online site. Website content is only available to Copilot if enabled for the tenant and the user chooses to enable it for searches.

More Change Coming

I suspect that the Copilot for Microsoft 365 journey will have other ups and downs as customers identify and Microsoft removes barriers to adoption, problems, bugs, and other issues. Like the initial development of Teams in the 2017-2020 period (albeit accelerated in some part by the Covid pandemic), I expect lots of change. Stay tuned.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Is Hiding the General Channel Important?

I can imagine that many who read message center notification MC711019 (29 January 2024, Microsoft 365 roadmap item 324840) to discover that Microsoft Teams is making it possible to hide the General channel for a team experienced a “so what” moment. The change rolls out to targeted release tenants in early February and reaches standard release in mid-February. By the time you read this, you might be able to indulge in the joy of hiding a general channel.

The General channel is present in all teams. It cannot be removed or renamed. Because it’s omnipresent, the General channel is regarded as the basis of a team. Teams now supports the addition of up to another 999 channels in a mixture of standard, shared, and private channels. I don’t recommend that you create such a monster unless absolutely necessary and justified with good reason, but it is possible.

Limiting General Channel Posts

With so many channels available to segregate conversations, team owners often limit posting to the General channel (Figure 1) and keep interaction there to announcements of general interest. This tactic serves to force members to consider which of the available channels is best suited to their topic and prevents a mishmash of unrelated conversations accruing in the General channel.

If posting is restricted to the General channel, the channel occupies unnecessary space in the teams and channel list. This didn’t matter so much in the past, but the teams and channels list can include many more channels now and if every team in the list has a General channel, it’s obvious that less space is available to display more important channels. This is the logic behind the change.

Hide and Restore the General Channel

Team owners cannot hide the General channel for all members. Instead, individual members (both tenant users and guests) decide if they want to show or hide the channel. To hide the channel, select the […] menu beside the General channel in the list of teams and channels and then choose Hide (Figure 2). Teams then removes the channel from the displayed list.

If the General channel is the only channel in the team, hiding General moves the team into the list of hidden teams and displays an informational message (Figure 3). I guess this is logical. If the General channel is the only channel in a team, hiding it and keeping the team in the visible list of teams doesn’t make sense. It’s better to move the entire team to the hidden list from where users can select and show the team if necessary.

To restore the channel, select See all channels link at the bottom of the channel list, select General, and click Show (Figure 4).

Alternatively, use the Channels tab in the Manage team option to unhide the channel.

The option to hide the General channel is not supported in the classic Teams client. However, if you switch from the new Teams client to the classic client and back, hidden channel settings are respected.

Reasonable and Sensible Change

Allowing users to hide the General channel is a reasonable and sensible change. There’s no doubt that not much activity happens in many General channels and removing these underused containers from the teams and channels list frees up space for more important information. A nice enhancement might be an option to remove the General channel for all teams in the Your teams (exposed) list. Then again, it’s not hard to do a one-time cleanup to hide the General channels for selected teams in that list. I must be getting lazy.

Learn about using and managing Microsoft Teams and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Website Channel Tabs Will Open New Browser Tab

In message center notification MC708500 (20 January 2024), Microsoft announces that from early April 2024 (following the retirement of the classic Teams client), Teams will no longer load websites inside the client when called from a website channel tab. Figure 1 shows an example of a channel tab targeting https://office365itpros.com. When a user accesses the tab, Teams opens the site and displays its content inside the client. The client also highlights the direction it is moving in and offers the option to open the page inside a browser.

Microsoft says that the change “is to better align with emerging best practices in web security and privacy while also improving the reliability of websites opened through this feature.” They also say that the change applies only to commercial and government tenants and not educational tenants. Perhaps because Microsoft’s telemetry shows that accessing websites via Teams channels is most common in Edu tenants, they won’t go ahead with the change in Edu tenants until Microsoft finds a “non-disruptive way to access websites.” One wonders why the same care isn’t paid not to disrupt other tenants.

When the change reaches a tenant, all website channel tabs accessed through the Teams desktop and browser clients will open the target site in a new browser tab. The Teams mobile app is not affected by the change.

Not a Bad Idea

I don’t think the change is bad. Many web sites require authentication and quite a few use a form of multifactor authentication. Attempting to open these sites in the Teams client usually fails. I’ve experienced this issue several times, and opening a site in a browser tab is an effective solution.

The change doesn’t affect pages in SharePoint Online sites. These pages are accessed through the SharePoint app tab rather than the website tab and can therefore use the integrated authentication available for Microsoft 365 apps.

Identifying Affected Website App Links

The altered behavior might come as a surprise to users so it’s a good idea to understand how many channel tabs are affected. We’ve been down this path before when Microsoft deprecated the use of the wiki tab in favor of OneNote. At the time, I created a PowerShell script to report channels with active wikis.

Much the same approach can be used to find websites. The same basic script structure applies:

• Connect to the Microsoft Graph PowerShell SDK with the necessary permissions (scopes). The signed in account should hold the global administrator or Teams administrator role.
• Find the set of teams in the tenant.
• For each team, find its channels.
• For each channel, find if its tabs include a website tab (the app id associated with the tab is “com.microsoft.teamspace.tab.web.” A team can support up to 1,000 channels, so this process can take time!
• Extract the details, including a decoded version of the URL (Teams stores the URL in a fashion that makes it possible to load the page in the client).
• Report what’s found.

When I ran the script in my tenant, I was surprised to discover that many of the website tabs had URLs pointing to SharePoint sites. This is probably because the current SharePoint channel tab was not as functional beforehand – or I made a mistake and used the website tab instead. In either case, this demonstrates the value of reviewing website tabs to figure out if website tabs should be converted to SharePoint tabs.

Interestingly, despite their deprecation, wiki tabs remain registered to channels. If you list the tabs in a channel, you are likely to find a wiki tab in the returned set. The Teams clients ignore the wiki tab and never displays it in the set of tabs shown for a channel. If you write code against Teams, remember to ignore the wiki tab in the same manner.

Figure 2 shows what I found after running the script on my tenant. You can download the script from GitHub.

Not the Last Change to Channel Tabs

Discovering the set of website channel tabs exist in a Microsoft 365 tenant is a good example of the value tools like the Microsoft Graph PowerShell SDK add for tenant administrators. This is unlikely to be the last time that Microsoft makes a change to how channel tabs work. At least we know how to find out what the effect of a change might be.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Better to Adopt a Teams Naming Convention from the Start

I was asked my opinion about the Microsoft article titled “The importance of a Teams naming convention” and whether I thought the points contained in the text are accurate. Nearly seven years into the Teams journey, I think that we’ve learned a lot that’s captured by the article, including that if you don’t pay attention to naming, users will have problems with findability and redundancy.

In this context, findability means that good names help people find the right team. Bad naming leads to irritation and frustration when people can’t find teams. Redundancy then ensues when people create a new team because they can’t find the one or more teams that already cover the topics they wish to discuss. The upshot is teams sprawl.

Problems that a Teams Naming Convention Might Not Solve

Microsoft doesn’t help by not providing tenants with a directory of teams for users to consult. I never understood why this situation pertains because it’s not difficult to create a team directory. The hard part is prompting users to consult the directory to find teams that they might like to join. Inattention to naming can wreak havoc on a directory if teams with names like “Tony’s Great Project” hide discussions about important topics.

A lack of discoverability for private teams doesn’t help either. People can use the join a team option to browse a gallery of teams that they might like to join. The gallery is the closest to a team directory in the product but it only shows public teams. Message center notification MC683664 (23 October 2023) promised a new approach to managing the discoverability of private team, but we’ve seen nothing since. Being able to allow users to find private teams (while hiding selected private teams) would be a good thing. People would still have to request to join a private team and owners could decline their request, but at least the team would be visible.

Suggestions for a Teams Naming Convention

But getting back to the subject of what factors should be considered when drawing up Teams naming convention for an organization, here’s what I think:

• Use shorter rather than longer names. Microsoft 365 groups support display names of up to 256 characters, but the Teams client UI can’t show more than 30-35 characters. Aim for 30 characters and use a few extra if necessary. As related in this article, very long names can cause problems for the Microsoft Graph.
• Use a suitable team photo to emphasize what the team covers. The Teams GUI uses thumbnail picture versions of the team photo when listing sets of teams, so make sure that the thumbnail contains visible detail so that its purpose is clear in team lists.
• Don’t use the groups naming policy to apply a prefix or suffix to team names. Suffixes will probably never be seen because of the limitations of the Teams client GUI. Prefixes are a useful way to gather similar groups together in Exchange address lists. However, most teams are hidden from Exchange and a prefix takes up too much space.
• Don’t include dates in team names unless absolutely imperative. It ages the team. Who wants to discuss something in a team called “Corporate Strategy 2020”? If you want to host date-limited discussions, use a channel and include the date in the channel name. Teams support up to 1,000 channels, so there’s lots of space for discussions. According to MC696576 (updated 11 December 2023), Teams will soon include a method to archive a channel, so you’ll be able to make the channel read-only when the date-limited discussion is over.
• Don’t include hyphens or dashes in a team name. SharePoint will then include the same characters in the site URL and it’s good to avoid unnecessary characters as SharePoint Online has a 400-character limit for file paths (the complete path to a file including the site name, document library, folder, and file).
• Use sensitivity labels to indicate the level of sensitivity of information within a team. There’s no need to include something like “Confidential” or “Internal Only” in a team name. The purpose of a team might change over time and make the name irrelevant.

Changing a Team’s Display Name

The display name is what users see in the Teams clients. Team owners can change the display name of a team through the manage team option (Figure 1). Administrators can change the display name through admin portals or with PowerShell using a variety of cmdlets including Set-UnifiedGroup, Update-MgGroup, and Set-Team.

Other Things to Consider After Renaming a Team

Changing a team name to make its usage more obvious is certainly possible, but this doesn’t update the group’s email address, site name, or site address (URL). You don’t have to take steps to update these elements to bring them into line with the new team name, unless you want to. The caveat is that it doesn’t seem to be possible to rename a site address if a site comes within the scope of a retention policy. When this happens the SharePoint admin center blocks attempts to change the address (Figure 2).

Compliance policies blocking a site address rename is not new behavior. It has existed since the introduction of the SharePoint site rename feature in 2019. However, it’s something to consider if you want to align the SharePoint site address with a new team name. It’s often difficult to persuade the security team to exclude a site from compliance policies just to allow a change to its address.

Keep It Simple Stupid

Overall, it’s best to get team naming right from the start. The essence of a good teams naming convention are simplicity and clarity. Going back and renaming teams is possible, but it creates its own challenges. Make users happy with simple team names and appropriate photos. It’s the right thing to do!

Keep up to date with developments in Teams and other Microsoft 365 apps by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

New Share Someone’s Contact Info Option in Mentions Menu

Announced in message center notification MC704192 (5 January 2024, Microsoft 365 roadmap item 375627), users can share contact information for other people in Teams chat. The feature will roll out to targeted release tenant in mid-January 2024 and to standard release tenants in early February 2024. Everyone should have the feature by the end of February 2024. As always, announced dates can change if unexpected hitches appear.

I’m not sure that the new share someone’s contact feature makes “it easy for others to confidently get to know other collaborators” as proclaimed by Microsoft (maybe this phrase was generated by Microsoft 365 Copilot?), but it is useful, especially in large organizations where it can be a challenge to understand who does what and make contact with them, even with the aid of the organization explorer in Outlook and Teams, especially if user information in the directory are incomplete or inaccurate.

Personal Recommendations

A personal recommendation is always great when you’re looking for someone to help with a problem. That’s the basic concept behind giving Teams the ability to share contact information in a chat. You know someone who can help, so you give a co-worker the information they need to contact that person.

Sharing of contact information is supported for Teams one-to-one and group chats. The implementation is in the mentions menu, so type @ in the compose box. The option to share someone’s contact info is revealed (Figure 1).

You can now select whose contact information to share and insert it into the chat message (Figure 2). Contact information for member accounts belonging to the tenant can be shared. This includes member account synchronized through participation in a multi-tenant organization (MTO). A chat message can include multiple contact entries. Users whose contact details are shared don’t receive notifications.

Guest user accounts are unsupported. This is possibly because the contact information for guest accounts is usually sparse

Viewing Contact Information

Figure 3 shows three mentions of people in a chat. The new share contact information feature created the first two. The last is an @mention for a guest account created with the old Teams client.

The first two mentions have a contact icon prefix to show recipients that these are shared contacts rather than an @mention. You can only @mention someone who’s part of a chat. The mention is intended to let the person know that this message is of special interest to them. In many cases, an @mention is a request for the person to do something. By contrast, any chat participant can share someone else’s contact information without that person being a member of the chat. Clicking on a link to either a contact card or an @mention displays the profile card for the user.

You can’t use the share contact info feature to share your own details. This is logical because the chat participants can find your contact information by clicking on your picture in the participant list. If you want to share your contact information proactively, you can copy and paste it into the chat.

Teams channel conversations don’t support a share contact info feature. This might be because publishing a contact makes it available to everyone in the team, which is more of a public rather than a personal recommendation. Anyone in the team membership now or in the future would be able to see the contact information.

A chat is a more closed space and the chat history can be restricted so that people who join a chat don’t see previous messages. An argument can be made that lots of confidential information is shared in channel conversations. That’s true, and if you want to share contact information, you can do so by copying the information from the person’s profile card and sharing it (or a screen shot of the profile card) in a channel post.

Small But Useful Change

The Share contact info feature is a small but useful change that will probably be most valuable inside large organizations where it’s hard to keep track of what others do. It’s obviously a response to a customer request.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Teams Background Blur Now Comes in Standard and Portrait Modes

Introduced in September 2018, background blur was the first video effect for Teams meetings. At the time, background blur was only available for desktop clients with specific hardware configurations that were needed to support processing of a user’s video stream to blur their background.

Since then, background blur has moved to other platforms and has been joined by a myriad selection of other video effects such as Snapchat lenses, green screen, animated backgrounds, and the Maybelline collection (great for reddening lips). If you have Teams Premium licenses, you can even use a mesh avatar as your on-screen representative in meetings. The world of Teams video effects is very different five years after the first tentative step into background blur.

New Teams Supports the Different Background Blurs

I don’t tend to use background blur because I prefer using a custom background image. That’s my excuse for missing the fact that the new Teams client boasts two types of blurring. You can choose from a new option called portrait blur (aka light blurring) in addition the previous blur option, now called standard blur (heavy blurring). I see the options available in the new Teams desktop client but not the web client, recently released in preview.

Standard blur is well known to Teams meeting participants. With this option selected, Teams applies a strong level of blurriness to the background to help maintain the user’s privacy by obscuring details of their surroundings. Figure 1 shows standard blurring in action. You can tell that some objects are behind me, but it’s very difficult to say exactly what those objects might be.

Teams Background Blur – The Subtle Portrait Style

By comparison, portrait blur applies much more subtle blurring to the background. The effect (Figure 2) creates more depth while keeping the focus firmly on the user. According to Microsoft, portrait blur is “elegant” and delivers “a professional and polished appearance during video calls.”

Well, it’s difficult to make my image more professional or polished, but the differences between portrait and standard blur are certainly very obvious. The images in the background are much more distinct. In Figure 2, you can tell that that the objects are pictures hanging on the wall (some of the covers from my Exchange Server books from the days when printed books were still a thing).

Like all the other background effects available during Teams meetings, you can choose a blurring option from the meeting pre-join screen or from the background effects gallery during a call. Once set, Teams remembers your choice and will continue to use it in future meetings until you select other options.

No Grand Advance, But Still a Useful Update

No one will pretend that the addition of portrait blur to Teams background blur in meetings is the next great advance in computer technology. Instead, this change gives people more control over how their image appears during Teams meetings. I think I’ll continue to use standard blur in calls along with my favorite effects, the brightness and soft-focus filters.

In passing, I should note that control of these filters in the new Teams client is through the Teams settings app. Go to Devices, video settings, and you’ll find the brightness and soft-focus filters under video effects. The green screen settings are in the same place.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Who Bot Was One of the Original Teams Bots

Message center notification MC687849 (7 November 2023) is a terse announcement of the demise of the Teams Who bot, an app in the Teams app store. This is a pity. I rather liked the Who bot and even included it as an example app in an article about Teams setup policies. Oh well.

Microsoft created the Who bot in the early days of Teams development as a sample to demonstrate how to create a Teams bot. The purpose of the app is to help users find information about others in the organization based on the information stored in Entra ID and the Graph. Users could chat with the bot to ask questions like who in the organization might know about a certain topic. Figure 2 shows a query from January 2018 when I asked “who works for me?” It’s the kind of helpful information that befuddled managers like to receive.

As you can see, the Who bot used chats to interact with users. In today’s Microsoft 365, the role of AI-based helpful communication is assigned to Microsoft 365 Copilot or rather, the implementation of Copilot within Teams. Microsoft says that they are working to improve the functionality delivered in the Who bot and will deliver a better user experience within Microsoft 365 Copilot sometime in the future.

Knowing What’s Happening

The deprecation is due in mid-December 2023 but already the Who bot knows about its fate. I fired the bot up on November 9 and was prompted for consent to perform searches (a refinement from the original version). After giving consent, the response was a bunch of messages heralding the depreciation. And although the Who bot reassured me that it was ready to start chatting (Figure 3), no further interaction was possible.

Indeed, some folks in the Microsoft Technical Community noticed that the Who bot was declining in late October. Microsoft might have been trying to deprecate the bot on the quiet, but were forced to come clean when people noticed! I don’t know if this is the case, but perhaps low usage data convinced Microsoft that they could remove the Who bot without causing any problems for users.

No Way Back

In any case, there’s no way back for the Who bot. Microsoft’s attention is fully focused on adding Copilots to every piece of software that it can, no matter if the software benefits from receiving a splash of artificial intelligence.

The bad thing is that the Who bot was a free app available to all 320 million Teams users. The new route that Microsoft has taken will restrict access to whatever replacement functionality they build to people with Copilot licenses. Right now, that’s a large investment (minimum of $108,000 for 300 users for a year) that limits exposure to organizations that can afford to pay for licenses. Losing the Who bot isn’t a big deal because it was really only ever a demo app, but it’s always sad when functionality disappears behind a licensing barrier. Microsoft tends to go down that path too often these days.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

New Option to Forward Teams Chat Messages Arrives in November 2023

Message center notification MC684532 (26 October 2023, Microsoft 365 roadmap item 90585) brings news of the ability to forward Microsoft Teams chat messages. This doesn’t sound like an earthshattering feature, and in the context of most messaging systems, it isn’t. However, Teams has never been able to move messages from one chat to another and that’s exactly what forwarding enables in the new Teams (desktop and browser) client and the mobile clients.

Chat forwarding works in one to one chats, group chats, and message chats. It doesn’t work in channel conversations. A forward option for both chats and channel conversations has existed since late 2019, but only in the Teams mobile clients. Rollout is scheduled for late November 2023, starting with targeted release tenants, followed by standard release in mid-January 2024, and finishing with GCC, GCC-High, and DOD in late January 2024. Deployment worldwide should be complete by mid-February 2024.

How to Forward Teams Chat Messages

To forward a chat message, select the message to forward and click on the “overflow” menu, otherwise known as the ellipsis […] menu. Select forward (Figure 1).

Teams copies the original chat message to create a new message. You now address the message to one or more recipients and add any text to provide context to explain to the recipients why you are forwarding the message (Figure 2).

Chats can be forwarded to:

• Individual recipients. If you’ve never had a one-to-one chat with the recipient, Teams creates one for you. Otherwise, Teams posts the message to the existing chat.
• A named group chat. Teams post the message to the group chat.
• A set of recipients. If an existing group chat with these people does not exist, Teams creates a new group chat and adds the recipients.
• A distribution list. Teams expands the members of the distribution list and adds the users to a new group chat. Oddly, Teams will add a shared mailbox to a chat, but only if it has a license.

When forwarding a message, Teams delivers the message to its destination and pops the target chat to the top of the user’s chat list. No trace of the forwarded message is left in the original chat. Figure 3 shows how a forwarded message appears to readers. In this case, the message started a new group chat. An indicator shows that the message was forwarded rather than being composed directly in the chat.

Compliance Records for Forwarded Chats

From a compliance perspective, the Microsoft 365 substrate treats forwarded messages as if they are brand-new messages and creates compliance records in the mailboxes of the chat participants to capture the complete content of the message, including the original message together with any text added when it was forwarded. Figure 4 shows the result of a content search to find a forwarded message.

Because the message create a new group chat, the substrate created four compliance records (one stored in the mailbox of each participant), which accounts for four of the search results shown here.

A Welcome Improvement

Forwarding chat messages is a small and incremental improvement that will be welcome by Teams users. We’ve survived without the ability to forward messages in Teams chat since 2016, so it’s not like this is something that people have been crying out for. Nevertheless, being able to forward chat messages is a welcome improvement. Now how about channel messages?

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Loop Component eDiscovery is Possible Without Being Easy

Following yesterday’s article about using Loop components in Teams channel conversations, I was asked how I felt about how well Loop supports Microsoft 365 compliance solutions. The point is that Microsoft emphasizes the collaboration capabilities of Loop within an organization (but not outside because of the lack of external access) without delivering full support for basic compliance functionality like eDiscovery.

My view is simple. Loop components have been around for two years. In that time, there hasn’t been much change in how these components support compliance. In November 2021, when I wrote about Loop component support for Teams chat, I noted that the compliance records generated for chat messages contained pointers to the Loop files stored in OneDrive for Business. This is enough to find Loop components, but not in the context of the chat.

Loop Component eDiscovery with Content Search

In May 2022, I followed up by examining the topic of eDiscovery for Loop components in more detail and noted that it’s possible to run a content search for a keyword included in a Loop component but can’t open the file from preview. You can download the file and open it in OneDrive for Business, but only after giving the file a .fluid extension. The same is true for the components used in Teams channel conversations. I don’t remember searches ever finding retained copies of previous versions of chat components (stored in the site preservation hold library). This happens for components used in channel conversations (Figure 1).

In all cases, I could open the downloaded copy of a component. OneDrive for Business calls the web version of the Loop app to open the files (Figure 2).

In yesterday’s article, I used a compound message to illustrate Loop components in channel conversations. A compound message includes text and embedded elements, like a Loop component or a Stream video. You’ll notice that the results shown in Figure 1 only list the Loop components. To find the complete message, you must use keywords that are in the message and Loop components (the same or different keywords). You can then see the message posted to the channel (Figure 3).

Downloading Messages With Pointers to the Loop Component

There’s no trace of the Loop component because content search preview only displays text (including links and emojis). But when you download the compliance record and view the resulting message item, you can see the attachments. The loop component is represented as ‘card.html.’ The channel post was an announcement, so the other attachment is the graphic used in the announcement header.

For those wondering why the downloaded compliance record is displayed as an Outlook message, that’s because Teams compliance records are simplified copies of the actual Teams data stored as message items in Exchange Online mailboxes (a group mailbox in this case). Microsoft Search indexes the message items to make them available for eDiscovery. However, Loop components used in channel conversations are indexed separately in SharePoint Online and that’s why the search has two hits: one for the message, and one for the component.

Loop Component eDiscovery Premium

The situation is a little better in Purview eDiscovery Premium. Instead of a simple content search, eDiscovery Premium uses review sets retrieved from a collection of sources. The presentation of information from a review set is more insightful (Figure 5). In this instance, we can see that the content of the card.html attachment reveals that the Loop component is presented in an adaptive card called FluidEmbedCard.

Work to Do to Improve Loop Component eDiscovery

Microsoft is obviously enthused with Loop components. The technology is interesting and does a good job of making collaboration more accessible for users within a single tenant. However, it’s disappointing that eDiscovery of Loop components is still challenging two years after the first introduction of the technology in a Microsoft 365 application. You can certainly find the components, but investigators have too much work to do to knit everything together to create a seamless picture of how people use Loop components in Teams channel conversations.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Loop Components in Channel Conversations

Message center notification MC681251 (13 October 2023, Microsoft 365 roadmap item 123491) announces support for using Loop components in channel conversations in both the classic and new Teams client. Targeted release is due in November 2023 with standard release tenants getting the new capability toward the end of the year.

About two years ago, Teams chat became the first application to support Loop components, and the components are currently supported in other clients like OWA and Outlook desktop in addition to the full Loop app. We’ve also seen developments such as Microsoft enabling support for the Loop task list component in Planner and the code block component and recently had the surprise that Microsoft will only include access to the Loop app in certain Microsoft 365 product SKUs. You can say that there’s been a lot of activity since November 2021.

Pop-up Announcement for Loop in Channels

Recently, I’ve complained about the number of “helpful” (aka irritating) pop-ups that Teams insists in showing to users. The arrival of Loop components in channels was dutifully announced in a new pop-up (Figure 1).

In this instance, the pop-up was helpful because informed me how to invoke a Loop component in a channel message by using the Actions and apps button to find the Collaborate with Loop option (Figure 2). The same set of Loop components available in Teams chat can be used in channel messages.

If an organization has disabled Loop components for Teams, the option to use them in channel conversations won’t appear.

Including Loop Components in Channel Messages

When composing a channel message, you can incorporate Loop components with text and other elements. Figure 3 shows a message being composed with a Loop table component, some explanatory text, and the compulsory emoji. The image used to highlight the announcement post was created using Microsoft Designer (see this article).

When a user posts a message including a Loop component, Teams stores the Loop component in the channel folder of the SharePoint site belonging to the team. All team members have access to the Loop component. The other message elements are in the Teams message store.

Working with a Loop component in a channel conversation is just like working with these objects in other applications. Anyone with access to the component can change its content and the other users with access see the changes in almost real-time (Figure 5).

Anyone participating in the channel conversation can copy the Loop component into another app and reuse the information there. For instance, they could copy the component into an Outlook email sent to someone for their comment. That recipient can update the component without being a member of the team. This is a really nice way to bring additional wisdom into a discussion.

To allow access non-team members who receive a component through another app, I suspect that Teams generates a sharing link. The link uses the default type of sharing link for the organization, which in my tenant is “only people in your organization” and the default permission, which is edit. I base this on Microsoft’s documentation for known issues with Loop, one of which is what happens when the default sharing link is for specific people only. I could be wrong, but that’s what it seems is happening.

Support for Loop components is available in all channel types (regular, private, and shared). However, guest members of the team cannot access Loop components stored in private and regular channels and external members can’t use them in shared channels.

Mobile Support

The Teams iOS and iPadOS clients support view-only access to Loop components in channel messages. The same support isn’t currently available for the Android client. No mobile client can create a Loop component in a channel message.

Loop for Whiteboard

According to message center notification MC681250 (13 October), Microsoft is also bringing Loop components (task lists, tables, voting tables, progress trackers, and checklists) to Whiteboard for the web, the Whiteboard app in Teams (apart from Teams Room devices), and Whiteboard for Windows. Deployment should be complete by the middle of November 2023.

No Access for External Collaborators

The continuing lack of support for external access to Loop components is a major frustration with the technology. Support for sharing with external people is obvious available because it works for guest access to Office documents stored in the SharePoint Online sites used by Teams. Those documents support co-authoring where the applications synchronize content frequently to update co-authors.

The current restriction might be due to the more frequent synchronization model used by Loop. Extending to people outside the tenant might create synchronization difficulties and detract from the Loop experience. Another obvious issue is that guest accounts don’t have to belong to Microsoft 365 tenants, so the necessary infrastructure might not exist for some guests to interact with Loop. For instance, what does a guest account with a Gmail account do?

Collaborating through Loop components in Teams channels is a powerful tool for working with people within the same organization. Regretfully, its usefulness for some tenants is limited by a lack of support for external team members. I hope that Microsoft lifts that restriction soon, perhaps initially for guests from other Microsoft 365 tenants. That would certainly make Loop components in channel conversions much more interesting to me.

Learn about using Loop and the rest of Microsoft 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Artificial Intelligence with Designer Used to Create Custom Announcement Images

When Microsoft announced the general availability for the new Teams client, they mentioned that the new client is the “foundation for next-generation AI experiences.” The following text covered how Teams will function with Microsoft 365 Copilot when Copilot is available (from November 1, 2023).

However, Copilot isn’t the only way that the new Teams client uses artificial intelligence services. As we discuss here, Teams uses Microsoft Designer to generate custom announcement images for channel announcement posts. Microsoft originally published details of the feature in Microsoft 365 roadmap item 123501 and message center notification MC680348 (10 October). They then followed up with MC687791 (6 November 2023), which contained a significant detail in that a Teams Premium license is needed to use Microsoft Designer to generate custom images.

MC687791 says that deployment to targeted release tenants will commence in early November 2023, standard release and GCC tenants will see the software in late November, and GCC High/DoD in mid-January 2024. The feature is currently disabled in EDU tenants until Microsoft delivers a policy setting to allow administrators to control its use. The initial release is for English (U.S.) only.

The Return of Custom Announcement Images

Teams classic clients (browser and desktop) supported the addition of custom images for channel announcement posts for several years. Earlier in 2023, support for custom images disappeared without warning and users were limited to choosing a color to highlight announcements.

With the new Teams client, announcement posts support custom images again, but the implementation is very different. Instead of simply selecting an image and trimming it to fit, Teams uses Microsoft Designer to customize an image you provide or generate a completely new image based on your input. Here’s what happens.

Creating a Custom Announcement Image

To begin, create a new post and choose announcement as the post type. When Teams displays the post creation screen, click the customized background option in the post header. Teams passes control to Microsoft Designer. You can now input some text about the post topic. Designer uses the DALL-E text to image generator to create the image. You can also choose to add an image or generate a custom image.

Figure 1 shows what happened when I uploaded the cover image for the Office 365 for IT Pros (2024 edition) eBook and input some text for Designer to work with. You can see that Designer generates some initial ideas based on the uploaded image. Sometimes the results are exactly what you want, but mostly you should be prepared to do some work to modify what Designer suggests.

If you’re happy with an image generated at this point, select it and click Done. Otherwise, click the submit button (blue arrow) to send the topic text (and image) to Designer.

To start, Designer generates some ideas based on what you submit. If you’re happy with one of the images, choose Done. Otherwise choose Customize to open Designer.

Working inside Designer, you can change the text that appears in the image, change the colors and typefaces, and make many other alterations to generate exactly the kind of image you want to use. As you make changes, Designer generates more options to choose from (Figure 2).

When you’re made all the changes you want for the image, click Done and Designer inserts the image into the announcement header and returns control to Teams (Figure 3). You can now input the announcement text and post the message when ready.

More Complex But Better Images

Using Designer to create custom announcement images results in much nicer images. However, some people will find the process more complex and too much trouble to bother with. It’s certainly more complicated and takes longer than the previous method of uploading an image, choosing which portion of the image to use in the announcement header, and typing in some text to overlay on the image.

Those who want to use beautiful images for their announcement posts will enjoy the new functionality, especially when they don’t have a suitable image available. Designer is happy to generate ideas over and over again. Whether people have the patience to go through the process remains to be seen, but if you want to explore your artistic side, announcements posted with the new Teams client certainly have the opportunity to include very different custom announcement images.

Learn how to exploit the features available in Microsoft 365 through the Office 365 for IT Pros eBook. We love figuring out how things work.

Create SharePoint List from Data Extracted from Teams

The article discussing a PowerShell script to generate a Teams directory explains how to create output files in different formats that can be used to make the directory available to users. For instance, you could post a HTML format version of the directory in a SharePoint Online site. Discussion about the post generated some nice ideas, amongst which was the suggestion to output the directory as a SharePoint list (aka Microsoft Lists).

I haven’t done much to manage SharePoint lists with PowerShell, so this seemed like a nice opportunity to explore the idea and increase my knowledge.

Choosing the Right Module to Create SharePoint List

The first order of business is to choose a PowerShell module for the task. I started off with the Microsoft Graph PowerShell SDK, which includes cmdlets like New-MgSiteList and Get-MgSiteList. Unhappily, I ran into several problems with SDK cmdlets (V2.8) that I’ve reported to Microsoft. The documentation and examples for these SDK site cmdlets are not as good as other areas covered by the SDK, so the problems could be due to misunderstanding on my part.

This brought me to the Pnp.PowerShell module (aka “Microsoft 365 Patterns and Practices PowerShell Cmdlets”). PnP is a community effort to create resources that help people to build app on the Microsoft 365 platform. The big advantage of PnP is that its cmdlets can interact with SharePoint Online content like list items where the Microsoft SharePoint management module is limited to tenant and site settings.

Basic Steps in the Script to Add Teams Directory Records and Create SharePoint List

The basic steps in the script are:

• Connect to the site that stores the list. I created a communications site for this purpose.
• Look for the list and if found, remove it because it’s easier to create and populate a new list instead of attempting to synchronize changes since the last update for the team directory.
• Create the list and the columns used to store team directory information. Many templates are available for Lists. I used the Links template and removed one of the two default columns.
• Populate the list with new items. To do this, the script reads the information in from the CSV file created by the original script and writes them as new list items.

PnP.PowerShell Cmdlets Used to Create SharePoint List

Translating the above into PnP PowerShell, the script uses the following cmdlets:

• Connect-PnpOnline to connect to the target site. PnP supports different forms of authentication. For the purpose of this demonstration, the script prompts for credentials of a site administrator and uses those to connect.
• Get-PnPList to check if the target list already exists and Remove-PnPList to remove the list if found.
• New-PnPList to create the target list.
• Add-PnPField to define the set of fields used to store directory information.
• Remove-PnPField to remove the standard Notes field inherited from the Links template. Here’s how the script creates the list and the fields used to store Teams directory information:

New-PnpList -Title $ListName -Template Links -EnableVersioning -Connection $Connection | Out-Null
# Add fields
Add-PnpField -List $ListName -DisplayName 'Team Name' -Internalname TeamName -Type Text -AddToDefaultView | Out-Null
Add-PnpField -List $ListName -DisplayName 'Description' -Internalname Description -Type Text -AddToDefaultView | Out-Null
Add-PnpField -List $ListName -DisplayName 'Owner' -Internalname Owner -Type Text -AddToDefaultView | Out-Null
Add-PnpField -List $ListName -DisplayName 'Owner SMTP Address' -Internalname OwnerSMTP -Type Text -AddToDefaultView | Out-Null
Add-PnpField -List $ListName -DisplayName 'Member count' -Internalname MemberCount -Type Number -AddToDefaultView | Out-Null
Add-PnpField -List $ListName -DisplayName 'External count' -Internalname ExternalCount -Type Number -AddToDefaultView | Out-Null
Add-PnpField -List $ListName -DisplayName 'Access' -Internalname AccessMode -Type Text -AddToDefaultView | Out-Null
# Remove the Notes field inherited from the Links template
Remove-PnPField -List $ListName -Identity Notes -Force

• Add-PnPListItem to populate the list with items imported from the CSV file. Here’s how the script populates the list:

[array]$TeamsData = Import-CSV -Path $CSVFile
[int]$i = 0
ForEach ($Team in $TeamsData) {
    $i++
    Write-Host ("Adding record for team {0} {1}/{2}" -f $Team.Team, $i, $TeamsData.count)
    Add-PnPListItem -List $ListName -Values @{
        "URL" = $($Team.Deeplink);
        "TeamName" = $($Team.Team);
        "Description" = $($Team.Description);
        "Owner" = $($Team.Owner);
        "OwnerSMTP" = $($Team.OwnerSMTP);
        "MemberCount" = $($Team.Members);
        "ExternalCount" = $($Team.ExternalGuests);
        "AccessMode" = $($Team.Access);
    } | Out-Null
}

The original version of the Teams Directory script generates a directory record for each team including a clickable deeplink to allow users to open Teams in the selected team. They can then join the team (public teams) or request the team owner to join (private teams). The deeplink generated by the script is formatted to make it clickable when exported to a HTML report. I updated the script to include a simple deeplink because SharePoint list entries don’t need the formatting.

Figure 1 shows the Teams directory records in a SharePoint Online list. I’m sure that the visual appearance of the list could be improved by tweaking the columns, but what’s here is sufficient to demonstrate the principles behind creating and populating a list.

You can download a copy of the full script from GitHub.

Lots to Explore in Lists

The SharePoint community understands and takes full advantage of lists (here’s an example). Others in the Microsoft 365 world might not. Perhaps this example of extracting information from one area of Microsoft to create a SharePoint list and populate the list with Teams directory information might get your creative juices flowing.

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Block Meeting Chats for Non-Trusted Tenants

In July 2023, Microsoft introduced a new meeting policy setting to control the ability of users to participate in meeting chats for meetings hosted in other non-trusted Microsoft 365 tenants. The change addresses a potential issue where people might reveal confidential information in a meeting chat that their home tenant knows nothing about. Of course, users can also reveal confidential information orally and that information can be captured in a meeting transcript that’s under the control of the host tenant, but that’s a more difficult problem to crack.

The update is covered in message center notification MC561186 (26 May 2023) and Microsoft 365 roadmap item 123975 and the setting should now be available in all tenants, including DOD and GCC-High.

Trusted and Non-Trusted Tenants

A trusted Microsoft 365 tenant is one which the external access settings for Teams allow users to connect to for chats and meetings. By default, Teams allows external access to all other Microsoft 365 organizations (Figure 1), meaning that all other tenants are trusted.

Last year, a proof of concept for an attack called GIFshell exposed a downside in the default setting where an attacker could set up a chat with an unsuspecting victim and transmit a modified GIF file containing malware. The easy answer to stopping this kind of attack is to change the external access setting to restrict incoming connections to an allow list of specified tenants.

The need for ongoing maintenance is the downside of using an allow list. In a follow-up article, I discussed how to use PowerShell to populate an allow list based on the home tenants for guest accounts. This helps, but creating an allow list from guest accounts is unlikely to discover every external tenant that users need to communicate with for business purposes. Some other arrangement is therefore necessary to allow users to request the addition of a domain to the allow list. The Teams Approvals app might be one way to handle the issue. Power Automate might be another.

Blocking Access to Meeting Chat in Non-Trusted External Tenants

The new control is in the Meeting engagement section of Meeting policies in the Teams admin center (Figure 2). By default, the setting is enabled, meaning that users can participate in chats in meetings hosted by any external Microsoft 365 tenant.

Updating the setting to Off blocks the Chat app in meetings hosted by untrusted external tenants.

You can also manage the setting through PowerShell. First, to see the value of the AllowExternalNonTrustedMeetingChat setting in the meeting policies defined for the tenant, run the Get-CsTeamsMeetingPolicy cmdlet:

Get-CsTeamsMeetingPolicy | Format-Table identity, AllowExternalNonTrustedMeetingChat

Identity                           AllowExternalNonTrustedMeetingChat
--------                           ----------------------------------
Global                                                           True
Tag:AllOn                                                        True
Tag:RestrictedAnonymousAccess                                    True

To block access to chat in external meetings, run the Set-CsTeamsMeetingPolicy cmdlet to update the value of AllowExternalNonTrustedMeetingChat for a meeting policy.

Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $False

An hour or so after updating the meeting policy, the accounts assigned the policy will lose access to chat in external meetings hosted by non-trusted tenants.

Keep External Access Open or Apply Restrictions

If you’re not worried about what people might chat about in external meetings, leave the setting alone and Teams will behave as before. This control is for organizations that have reason to want to stop people from chatting when participating in meetings hosted by non-trusted tenants. Of course, the question of deciding which tenants to trust comes into play here. That’s a difficult question to answer in a generic sense, and it’s definitely worthwhile for a Microsoft 365 tenant to consider if they want to operate external access on an open or closed basis.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Using Container Management Sensitivity Labels to Force Specific Teams Privacy Mode

Yesterday, I wrote about how to control the creation of Microsoft 365 groups (and teams) using Microsoft Graph PowerShell SDK cmdlets to update the directory object setting used for the tenant groups policy. This led to a question from a reader who referred to a Microsoft Technical Community discussion about how to force those allowed to create new teams to only create private groups. A private team is one where the team owners control the membership. By contrast, anyone can join a public team.

I’m not quite sure why this is any better than allowing people to have a choice between private and public (Figure 1) in terms of preventing group sprawl, but it is an interesting example of using sensitivity labels for container management.

The technique outlined here only affects new groups created through Teams, Outlook, OWA, and SharePoint Online clients. It doesn’t affect existing groups nor will it stop an administrator creating a new public group through an administrative interface like PowerShell or the Graph APIs.

Implementing the Block on Public Teams

The steps to block new public teams starts with creating or selecting a container management sensitivity label (one that exerts control over teams, groups, and SharePoint sites). I have a well-populated set of sensitivity labels in my tenant, so I choose to use one called Confidential Access.

It’s critical that the privacy settings for the label dictate that groups and teams assigned the label can only have private access (Figure 2).

Next, create a label policy to publish the selected label to selected users. For instance, you could decide to publish the policy to the same users who are allowed to create new groups or limit publication to a subset. Unfortunately, you can’t choose a security group for the target set, so you’ll need to include each user separately (Figure 3) or use a Microsoft 365 group or distribution list to establish the scope for the policy.

Make sure that the label policy requires users to apply a default label to sites and groups. Because only one label is covered by the policy, this is the only one that can be assigned by default (Figure 4).

Make sure that the label policy has the highest priority so that it takes precedence over any other label publishing policy. This is the usual state for the most recently-created label policy but it’s wise to check and adjust if necessary.

Wait for Effect

Publication is not immediate. Behind the scenes, Microsoft Purview processes the new label publishing policy and makes the label available to the target set of users. It could take up to 24 hours before the user account and relevant applications learn about the new policy and its settings.

When the label policy is in force, the dialog to create a new team prepopulates the sensitivity label with the default label specified in the policy. Because the label specifies that private access is the only permitted option, this action disables the choice of public access (Figure 5).

Changing Other Teams to Private Access

As mentioned above, implementing a sensitivity label for container management in the manner explained here does nothing to existing teams. If you want to make all teams private, you must search for teams with public access and update them to private access. Here’s some based on the Microsoft Graph PowerShell SDK to do the job.

Connect-MgGraph -Scopes Group.ReadWrite.All
[array]$Teams = Get-MgGroup -Filter "resourceProvisioningOptions/any(x:x eq 'Team')" | Where-Object {$_.Visibility -eq 'Public'} | Sort-Object DisplayName
If ($Teams) {
   Write-Host ("Processing {0} teams with public access..." -f $Teams.count)
}
ForEach ($Team in $Teams) {
   Write-Host ("Updating team {0} to private access..." -f $Team.DisplayName)
   Update-MgGroup -GroupId $Team.Id -Visibility 'Private' 
}

I’m still unconvinced that forcing all teams to be private will address the problems of group sprawl, or unused and obsolete teams. But it’s an interesting approach. Maybe it’ll work for you.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Control Group Creation to Avoid Group Sprawl

Microsoft’s documentation covering the topic of “Manage who can create Microsoft 365 Groups” begins with: “By default, all users can create Microsoft 365 groups. This is the recommended approach because it allows users to start collaborating without requiring assistance from IT.”

I can’t say how strongly I disagree with this perspective. All it does is result in group sprawl, or more likely, teams sprawl. We learned the lesson with Exchange Server public folders in 1996 when users created new folders with abandon. Organizations are still clearing up the mess today, which is one of the reasons for the persistence of public folders in Exchange Online. The same need will arise to clean up unused and unwanted teams if organizations follow Microsoft’s advice to allow group creation by any and all. Microsoft promised to develop functionality to help with group sprawl in 2021. So far, there’s little sign of progress in this space, unless you include the ownerless group policy (2022) and the group expiration policy (available since 2020).

Group Creation Using the Microsoft Graph PowerShell SDK

The Microsoft documentation explains how to restrict group creation by running PowerShell to configure the Entra ID groups policy. Unhappily, the current version of the documentation uses cmdlets from the Azure AD Preview module, which is due for deprecation in March 2024, The same work can be done using cmdlets from the Microsoft Graph PowerShell SDK, which is what I cover here.

The basic approach is:

• Create a security group to control group creation. The members of this group will be allowed to create new Microsoft 365 groups via user applications like Outlook and Teams. Accounts holding roles like Global administrator, Teams service administrator, Groups administrator, SharePoint administrator, User administrator, and Exchange administrator can always use administrative interfaces like PowerShell or the Microsoft 365 admin center to create new groups. The members of this group need Entra ID Premium P1 licenses.
• Update the Entra ID groups policy to block group creation by anyone except the members of the security group.

I have no idea why Microsoft doesn’t make control over Microsoft 365 group creation available through an option in the Microsoft 365 admin center. My cynical side says that this is because they don’t want tenants to control group creation, so they force administrators to use PowerShell.

Create a Security Group to Control Group Creation

A simple security group is sufficient to define the set of accounts allowed to create new Microsoft 365 groups (Figure 1). You can either create a new group or use an existing group. Creating a new group is probably best because you can give the group an appropriate name and description and be sure that the group will only be used to control group creation.

Create a Groups Policy Object

Microsoft 365 uses a directory setting object to hold the settings to control creation and other aspects of Microsoft 365 groups. By default, tenants use default settings. To change these settings, you must create a copy of the template directory settings object and modify it. Here’s how to create a new directory settings object by retrieving the identifier of the default object and creating a new object for the tenant:

Connect-MgGraph -Scopes Directory.ReadWrite.All
$PolicyId = (Get-MgBetaDirectorySettingTemplate | Where-Object {$_.DisplayName -eq "Group.Unified"}).Id 
New-MgBetaDirectorySetting -TemplateId $PolicyId

The New-MgBetaDirectorySetting cmdlet fails if a tenant-specific directory settings object already exists.

Updating the Groups Policy to Limit Creation

With a groups policy object in place, we can update the settings. You can see the default settings by running:

Get-MgBetaDirectorySetting | Where-Object {$_.DisplayName -eq "Group.Unified"} | ForEach Values

To control group creation, two settings are updated:

• EnableGroupCreation: This setting controls if users can create new groups. The default is true. We update it to false.
• GroupCreationAllowedGroupId: This setting holds the identifier for the group whose members are allowed to create new groups.

The setting names are case-sensitive and should be passed exactly as shown.

To update the settings, fetch the identifier for the group (or have it available). Then populate an array with the current settings before updating the two settings described above. Finally, update the directory settings object with the new policy settings. Here’s the code:

$GroupId = (Get-MgGroup -Filter "displayName eq 'GroupCreationEnabled'").Id
$TenantSettings = Get-MgBetaDirectorySetting | Where-Object {$_.DisplayName -eq "Group.Unified"}
[array]$Values = $TenantSettings.Values
($Values | Where-Object Name -eq 'EnableGroupCreation').Value = "false"
($Values | Where-Object Name -eq 'GroupCreationAllowedGroupId').Value = $GroupId
Update-MgBetaDirectorySetting -DirectorySettingId $TenantSettings.Id -Values $Values

Figure 2 shows these commands being run.

Updating the group policy settings (for instance, to switch the group defining who can create new groups) uses the same approach: find values, update values, update the directory setting object.

If you make a mess of the Groups policy, you can start over by removing the directory settings object and creating a new policy. Here’s how to remove the policy:

$PolicyId = (Get-MgBetaDirectorySetting | Where-Object {$_.DisplayName -eq "Group.Unified"}).Id
Remove-MgBetaDirectorySetting -DirectorySettingId $PolicyId

Keeping Groups Under Control

Even if you decide to limit group creation, it’s a good idea to keep a close eye on what groups and teams are in active use and trim (or archive) those that don’t meet usage thresholds. The Teams and Groups activity report script can help with this process. Another point to consider is that Teams doesn’t come with any form of directory to allow users check if a team already exists for a topic. It’s possible to create such a directory, but making people check the list is a different challenge.

Another example of using directory objects to control groups is to block guest access for individual groups and teams. You can do this with sensitivity labels or by updating the directory setting for individual Microsoft 365 groups with PowerShell.

No Way for Users to Eliminate Irritating Teams Pop-ups

It might just be me, but I am very irritated by the number of cutesy, folksy, whatever attempts to be helpful pop-up prompts that the Teams desktop client insists in displaying (Figure 1 shows a selection). I see these pop-ups as a guest in multiple tenants and in my own tenant in both the classic and new Teams clients. The initial delight in being helped (even if I didn’t need or want it) has quite worn off now.

I know that Microsoft is genuinely trying to help users discover aspects of the Teams client UI that they might have overlooked in the past. This is an important thing to do because of the ongoing change in the UI, especially in the last year. However, there’s no way for an administrator to disable helpful pop-ups on a per-user or tenant-wide basis. Even worse, Teams doesn’t have a setting to allow a user to decide when they’ve had enough and can function without seeing any more pop-ups.

I don’t mind developers trying to be helpful. I hate it when they launch something without an Off switch. Teams needs to do better here.

Irritating Teams Pop-ups in the Mobile Client

The Teams mobile client has its own special irritations. Take the pop-up message that the iOS client displays to inform users that their translation settings changed somewhere in Microsoft 365. Teams proclaims that it is smart enough to detect that this event happened and is delighted to be able to respect the change (Figure 2).

The only problem is that this message appears out of the blue. As far as I know, I haven’t gone near a language selection setting in any Microsoft 365 app in the last two or more years. Despite this, the Teams iOS client suspects that I might have selected a new language and is smart enough to tell me so. The irritation of the unnecessary and unhelpful message is compounded when the client sometimes refuses to respect the OK option and sits there doing nothing. The only solution is to stop and restart the client.

Displaying messages that people can make no sense of is a terrible user experience. Requiring users to restart the client to get rid of a message just adds to the overall delight in the experience.

Making the New Teams the Old Teams

On the plus side, some changes in the new Teams address user comments. One being that people don’t like the color scheme chosen by Microsoft, the other is miscontent in the change in the ordering of channel posts. Fortunately, settings exist to allow people to wind the clock back to a time when old colors and post ordering ruled.

First, to use the classic (old) Teams color scheme, go to Settings, Appearance and accessibility, and select the classic theme (Figure 3).

You’ll notice that I’ve kept the old colors and also chosen to use a compact chat density without message previews. This allows the client to display many more chat threads in the available screen estate. Some like it (like me). Others hate the compact layout.

Next, some folks don’t like the new arrangement (introduced for the classic client in June 2023) for channel posts where the latest post appears at the top of the listing and prefer the original Teams layout where new conversations appear at the bottom. A control to switch positions is available for channels (Figure 4).

The nice thing about the setting is that it applies to all channels in all teams in a tenant. If you have guest accounts in other tenants, you’ll have to choose your preferred layout in each tenant.

Always Things to Complain About in Software

Most software is never perfect. All of the Microsoft 365 applications offer plenty of scope to complain about. Building on my theme, the Teams admin center has the infuriating habit of signing me out of all browser sessions when its access token expires. The other Microsoft 365 admin centers handle token refreshes without any problem; it’s just the Teams admin center that signs out without warning. This begs the question why the Teams developers use a different (and inferior) approach to token handling?

I guess the best thing about software imperfections is that I will never lack topics to write about.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Create Dynamic Microsoft 365 Groups and Teams with PowerShell

No sooner had I published the article about creating dynamic administrative units with PowerShell, the first email arrived asking if the same was possible for dynamic Microsoft 365 groups. The answer is “of course,” but with the caveat that it’s not just a matter of some minor updates to the script.

That being said, the outline for the script to create dynamic groups is broadly the same:

• Find the licensed users in the tenant and extract a list of departments. The departments should be accurate and some care should be taken to eliminate inconsistencies. For instance, some people might be listed as belonging to IT while others belong to the Information Technology department. Decide on one value and apply it to all.
• You might not want to create groups for all departments. The script defines an array of excluded departments that are removed from the set to process.
• Find the set of dynamic Microsoft 365 groups. We need this information to check if a dynamic group already exists for a department.
• For each department, check if a group already exists. If not, define some parameters for the new group, including the membership rule that Entra ID uses to calculate the group members, and run the New-MgGroup cmdlet to create the group.
• Following a successful creation, proceed to team-enable the new group by running the New-MgTeam cmdlet. This is an optional step, but seeing that Teams is the heaviest workload for Microsoft 365 groups, it seemed like a good thing to include.

Let’s examine some of the steps.

Scripting the Creation of a Dynamic Microsoft 365 Group

Here’s an example of creating a new dynamic Microsoft 365 group for the department whose name is stored in the $Dept variable:

Write-Host ("Checking groups for department {0}" -f $Dept)
$Description = ("Dynamic Microsoft 365 group created for the {0} department on {1}" -f $Dept, (Get-Date))
$DisplayName = ("{0} Dynamic group" -f $Dept)
$MailNickName = ("Dynamic.{0}.Group" -f ($Dept -replace " ",""))
$MembershipRule = '(User.Department -eq "' + $Dept +'")'

If ($DisplayName -in $Groups.DisplayName) {
   Write-Host ("Group already exists for {0}" -f $Dept) -ForegroundColor Red
} Else {
# Create the new dynamic Microsoft 365 Group
   $NewGroup = New-MgGroup -DisplayName $DisplayName -Description $Description ` 
   -MailEnabled:$True -SecurityEnabled:$False `
   -MailNickname $MailNickName -GroupTypes "DynamicMembership", "Unified" `
   -MembershipRule $MembershipRule -MembershipRuleProcessingState "On"
}

Wait Before Progressing to Teams

Flushed with the successful creation, you might want to rush to team-enable the new group. However, it’s best to wait 10-15 seconds before proceeding to allow Teams to learn about the new group from Entra ID. If you attempt to team-enable a group immediately after creation, you’ll probably see an error like this:

Failed to execute Templates backend request CreateTeamFromGroupWithTemplateRequest. Request Url: https://teams.microsoft.com/fabric/emea/templates/api/groups/bab7a3a8-2e30-4996-9405-48ca395b99c6/team, Request Method: PUT, Response Status Code: NotFound, Response Headers: Strict-Transport-Security: max-age=2592000
x-operationid: a228258204c3466dbd64c4d88373a416
x-telemetryid: 00-a228258204c3466dbd64c4d88373a416-82a9b5015f332574-01
X-MSEdge-Ref: Ref A: FC01DAADBD0D4A1A9ECBB9826707CC17 Ref B: DB3EDGE2518 Ref C: 2023-10-04T15:00:51Z
Date: Wed, 04 Oct 2023 15:00:52 GMT
ErrorMessage : {"errors":[{"message":"Failed to execute GetGroupMembersMezzoCountAsync.","errorCode":"Unknown"}],"operationId":"a228258204c3466dbd64c4d88373a416"}

Team-Enabling a Group

To team-enable a group, run the New-MgTeam cmdlet and provide a hash table containing information to allow Teams to find the new group (the Graph URI for the group) plus the Teams template to use. This code does the trick.

$GroupUri = "https://graph.microsoft.com/v1.0/groups('" + $NewGroup.Id + "')"
$NewTeamParams = @{
   "template@odata.bind"="https://graph.microsoft.com/v1.0/teamsTemplates('standard')"
   "group@odata.bind"="$($GroupUri)"
}
$NewTeam = New-MgTeam -BodyParameter $NewTeamParams
If ($NewTeam) {
   Write-Host ("Successfully team-enabled the {0}" -f $NewGroup.DisplayName)
}

Checking Groups Post-Creation

Figure 1 shows some of the dynamic Microsoft 365 groups created in my tenant. Note the groups for “Information Technology” and the “IT Department.” Obviously my checking of user departments was deficient prior to running the script. The fix is easy though. Decide on which department name to use and update user accounts to have that. Then remove the now-obsolete group. Entra ID will make sure that the accounts with reassigned departments show up in the correct group membership.

In this case, only one account had “IT Department,” so I quickly updated its department property with:

Update-MgUser -UserId Jack.Smith@office365itpros.com -Department "Information Technology"

I then removed the IT Department dynamic group:

$Group = Get-MgGroup -Filter "displayName eq 'IT Department Dynamic Group'"
Remove-MgGroup -GroupId $Group.Id

Soon afterwards, the membership of the Information Department Dynamic group was correct (Figure 2) and all was well.

You can download the complete script from GitHub. It would be easy to adapt the code to run as an Azure Automation runbook to scan for new departments and create groups as necessary.

Simple PowerShell Results in Big Benefits

Scripting the creation of dynamic Microsoft 365 groups for each department in a tenant isn’t too difficult. The membership rule is simple but could be expanded to include different criteria. Once the groups are created, they should be self-maintaining. That is, if you make sure that the department property for user accounts is accurate.

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things like dynamic Microsoft 365 groups work.

Final Transition for Live Events to Teams Town Hall

Several years ago, Office 365 supported live events organized through a common platform shared by Stream, Yammer, and Teams. Stream Classic is on its last legs and its ability to host live events ceased on January 31, 2024. Yammer became Viva Engage and adopted Teams Live Events. On September 28, Microsoft announced the end for Live Events and its replacement by Teams Town Hall as the sole method for organizing large virtual internal events within Microsoft 365 (external events use Teams webinars).

Commercial tenants can start to use Town Hall from October 5, 2023 and Teams Live Events will finally retire on September 30, 2024. Meeting recordings will be available until December 31, 2024. Microsoft hasn’t yet given dates for the introduction of Town Hall or retirement of Live Events in the GCC, GCC-High, DoD, and China clouds.

The evolution is entirely logical. Teams has more than 300 million monthly active users. These folks are very comfortable with the Teams meeting experience (well, if not comfortable, very familiar). Microsoft already extended the Teams meeting platform to create webinars. Now it’s taking a similar approach to create Town Hall to bring all its online events onto a single online events platform.

Following the Webinars Approach for Teams Town Halls

Like Teams webinars, full functionality is not available at launch. Microsoft has plans to bring Town Hall to feature parity ahead of the retirement of Live Events in September 2024 (see the announcement post for details). Also like webinars, Microsoft will differentiate functionality based on licensing. For example, holders of Teams Premium licenses can organize events for up to 20,000 attendees while those with standard licenses are limited to 10,000. Premium features also include support for up to 50 concurrent events (limited to 15 with standard licenses), multi-lingual translation (live captions) and the ability to customize email invitations for events.

Scheduling a town hall meeting is very similar to scheduling a webinar. Anyone who knows how to create a Teams meeting can create a webinar or town hall event. The new meeting drop down menu in the Teams calendar lists both webinar and town hall among the available templates. According to the Microsoft descriptions, a webinar is an interactive event while a town hall is for a large audience. Figure 1 shows the creation of a new town hall event to announce the new Teams 2.1 client.

The organizer creates the new event and provides basic details such as the date and time, location, and description. They add people as presenters (including support for external presenters from the end of October 2023) and co-organizers and decide on attendee permissions (only invited people, anyone in the organization, or public), and set meeting options. The same kind of attendance reports are available as in a webinar. Unlike live events, there is no producer role because this functionality is included in the organizer role.

Publishing a Town Hall Event

When everything is ready, the organizer publishes the event to make it available to invitees and presenters. They can then circulate the link to the town hall event to make it available to potential attendees. This might be as simple as pasting the link into a channel announcement or including the link in an email. An example link for a town hall event looks like this:

https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZDgwNTElNDUtMzllOC00MjYxLWFkMWUtYTQyNzhlMWJkMDFh%40thread.v2/0?context=%7b%22Tid%22%3a%22b662313f-14fc-43a2-9a7a-d2e27f4f3478%22%2c%22Oid%22%3a%22eff4cd58-1bb8-4899-94de-795f656b4a18%22%7d

Twelve Months a-Waiting

The twelve-months of notice given by Microsoft for the retirement of Teams live events is the norm. It will take a little time to phase out live events, possibly delaying until Microsoft fills in some missing functionality as they move towards feature parity. Most live events features are available in Town Hall now, so the best idea is to start using Town Hall events when possible. If you find something that doesn’t work, highlight the gap to Microsoft to make sure that it’s not overlooked in their march to functional parity.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Tracking the Evolution of Custom Background Images for Teams Meetings

I’ve written about using custom background effects in Teams meetings since their introduction in early 2020, including how to fetch and use the Bing daily images as custom background inages for Teams meetings.

Recently, I’ve used the Teams 2.1 client as my daily driver. Microsoft expected that the new Teams client would become the default client in late September. The switchover is very close and the new client is in good shape. It’s as stable as its Electron-based predecessor and performs better, so using Teams 2.1 is a reasonable option for someone like me. The task of deploying the new client across a large enterprise will take some planning and coordination.

No Custom Background Images After Switch to Teams 2.1

As part of my personal move, I noticed that the custom background images I use for Teams meetings are unavailable in Teams 2.1. Some investigation revealed that Teams 2.1 uses a different folder to store custom images. Here are the folders used by the two clients.

• Teams 1: C:\Users\userx\AppData\Roaming\Microsoft\Teams\Backgrounds\Uploads
• Teams 2.1: C:\Users\userx\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Backgrounds\Uploads

Switching to Teams 2.1 doesn’t transfer custom background images to the new location, possibly because Microsoft uses a new naming scheme for the images. Instead of regular names like My favorite beach scene.jpg, Teams 2.1 uses names like 42b9a5ad-460e-46df-8c1b-f4d7c42dffc0.jpg. Each image exists in a high-resolution (at least 1920 x 1080 pixels) version and a lower-resolution thumbnail (220 x 158 pixels). The high-resolution version is the image that Teams loads as a meeting background. The thumbnails are displayed in the gallery of available background images.

Transferring Custom Background Images for Teams 2.1

Because of the naming scheme used by Teams 2.1, it’s not enough to simply copy custom background images from the Teams 1 folder because Teams 2.1 ignores any files that don’t follow its naming convention (with or without a thumbnail).

The obvious fix for the problem is to upload custom background images into the Teams 2.1 client. That’s acceptable when only a couple of files are involved. Things get boring thereafter, which is why I wrote a PowerShell script (downloadable from GitHub). The script:

• Loads a Resize-Image function to resize images to the desired sizes (originally written by Christopher Walker and found in GitHub).
• Defines the folders used by Teams 1 and Teams 2.1.
• Finds JPG files in the Teams 1 folder. The script ignores any thumbnails and only processes high-resolution images.
• Call the Resize-Image function to generate new high-resolution files sized at 1920 x 1080 and thumbnails. The file names follow the Teams 2.1 scheme.
• Copy the generated files to the Teams 2.1 folder and remove them from Teams 1 folder.
• Lists the JPG files now in the Teams 2.1 folder.

It’s not a particularly complex script, but it worked. The acid test is that I can select my custom background images from the gallery when in a meeting with the Teams 2.1 client (Figure 1).

Bumps in the Changeover

The changeover from Teams 1 to Teams 2.1 will reveal some flaws. The architecture and internal functions of the two clients are very different. Using a different folder to store custom background images is a very small indicator of the kind of change involved in the transition. I have no idea why Microsoft decided to switch folders as the Teams 1 folder seemed perfectly acceptable, but they did. Now you know how to transfer custom background images to the new location, the issue goes away.

I don’t see any reason why the same technique could not be used to distribute a set of organization images to workstations. If you can access the folder, you can copy custom background images to it and make those images available for Teams meetings.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Monitor New Teams Members and Remove Undesired Members Automatically

A question in the Office 365 Technical Discussions Facebook group asked about a script to monitor member additions to Teams. If the new member comes from specific departments, they should be removed. The script should then post details of new members that pass the check to a team channel.

On the surface, this seems to be an ideal situation for Information Barriers, a Microsoft Purview solution designed to keep designated groups of users from communicating with each other. However, Information Barriers require Office 365 E5 or above and it’s a solution that’s best suited when hard barriers must be enforced.

Sketching Out a Solution to Monitor New Teams Members

A custom solution isn’t too difficult to design. The essential steps are:

• Periodically search the unified audit log to find events captured when a new member joins a group. The example script searches for events occurring within the last three hours.
• Check if the group is one of the monitored set (defined in an array of group identifiers). If it is, record details of the group and the user. Clearly, you could use whatever criteria you wanted to check new team members.
• For some reason, searching the unified audit log can return multiple instances of add member events. This might be part of the problems the audit log has suffered recently. To remove duplicates, the script sorts the list of detected events.
• Loop through the deduplicated events and check the department for each added member. If the department is on the banned list, remove the user from the group. If not, post a message to a designated channel in the team to announce their arrival.

Teams also posts notices about new users to the information pane (Figure 1). The advantage of doing it this way is the ability to remove members plus do whatever other processing is desired.

Posting Teams Channel Messages

As covered in this article, several methods exist to post messages to Teams channels. Briefly:

• The Submit-PnpTeamsChannelMessage cmdlet. A connection to PnP must be established first and the signed in account must be a member of the target team.
• The New-MgTeamChannelMessage from the Microsoft Graph PowerShell SDK. This cmdlet only supports delegate permissions (Channel.Send.Message), meaning that the signed-in account must be a member of the target team.
• Connect the Incoming Webhook connector to the target channel and post a JSON-format message to the connector. This method works without authentication.

To illustrate the principles behind the solution, I choose to use the SDK method because the script already used the Get-MgUser cmdlet to fetch details of user departments.

Diving Into the Code to Monitor New Teams Members

Here’s the code used to search for audit records and extract information from records of interest:

$StartDate = (Get-Date).AddHours(-3)
$EndDate = (Get-Date).AddHours(1)

Write-Host "Searching for audit records..."
[array]$Records = Search-UnifiedAuditLog -Start $StartDate -End $EndDate -Operations "Add member to group" -Formatted -ResultSize 500
If (!($Records)) { Write-Host "No member additions to groups to check" ; break }

Write-Host "Processing audit records..."
$MembersReport = [System.Collections.Generic.List[Object]]::new() 
ForEach ($Rec in $Records) {
  $AuditData = $Rec.AuditData | ConvertFrom-Json
  $GroupId = $AuditData.ModifiedProperties | Where-Object {$_.Name -eq 'Group.ObjectID'} | Select-Object -ExpandProperty NewValue
  $GroupName = $AuditData.ModifiedProperties | Where-Object {$_.Name -eq 'Group.DisplayName'} | Select-Object -ExpandProperty NewValue
  $UserAdded = $AuditData.ObjectId
  $Actor = $Rec.UserIds
  If ($GroupId -in $GroupsToCheck) {
    $UserData = Get-MgUser -UserId $UserAdded -Property Id, displayName, department
    $ReportLine = [PSCustomObject]@{
      Team       = $GroupName
      User       = $UserAdded
      UserName   = $UserData.displayName
      UserId     = $UserData.Id
      Addedby    = $Actor
      Timestamp  = $Rec.CreationDate
      Department = $UserData.Department
      GroupId    = $GroupId
      Id         = ("{0}_{1}_{2}" -f $GroupName, $UserAdded, $Rec.CreationDate) }
    $MembersReport.Add($Reportline)
  }
}

And here’s how the script processes member removals and posting notifications for approved new members:

ForEach ($R in $MembersReport) {
  If ($R.Department -in $ExcludedDepartments) {
     Write-Host ("User {0} with department {1} will be removed from team" -f $R.User, $R.Department) -ForegroundColor Red
     Remove-MgGroupMemberByRef -DirectoryObjectId $R.UserId -GroupId $R.GroupId 
  } Else {
    Write-Host ("Sending channel message about new team member {0}" -f $R.UserName) -ForegroundColor Yellow
    [string]$UserName = $R.UserName
    $HtmlContent = "<h1>New User Has Joined Our Team</h1>
               <h2>$UserName has joined this team</h2><p></p>
               <p>Please welcome <b>$UserName</b> to the team. They will bring great joy to all of us!</p>"
    $Message = (New-MgTeamChannelMessage -TeamId $TargetTeamId -ChannelId $TargetTeamChannelId -Body @{Content = $HTMLContent; ContentType = "html"} -Subject "New User Join Report" -Importance "High")
  }
}

Figure 2 shows an example of the message posted to Teams. The content of the message is very simple HTML and could easily be enhanced to communicate whatever sentiments are desired.

Improve the Solution to Monitor New Teams Members

I don’t pretend that this script is a complete solution. It would be more effective to run as a scheduled Azure Automation runbook (here’s an example of a runbook that monitors audit events). At a pinch, it could run as a scheduled task on a workstation, but I prefer Azure Automation to Windows Scheduler for several reasons. In any case, the principle is proven and now it’s up to you to take the code forward and make it work the way you want. You can download the sample script from GitHub.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Improving the Speed of reporting Teams SharePoint URLs by Replacing the Get-UnifiedGroup Cmdlet

Last week, following a response to a reader question, I updated an article describing how to create a report of Teams and the URLs for the SharePoint Online sites used to store shared files. The only real improvement I made to the script was to use the Get-ExoRecipient cmdlet to resolve the members of the ManagedBy property to output display names instead of mailbox names. This change is necessary since Exchange Online moved to using the External Directory Object ID (EDOID) as the mailbox name to ensure uniqueness. Not everyone can recognize a mailbox GUID and know what mailbox it refers to.

The script uses the Get-UnifiedGroup cmdlet to find team-enabled groups. After reviewing the code, I wondered if it was possible to speed up processing by replacing the Exchange Online cmdlets with Microsoft Graph PowerShell SDK cmdlets or API requests. It’s always been true that the Get-UnifiedGroup cmdlet is relatively slow. This situation is explainable because the cmdlet fetches a lot of data about a Microsoft 365 group from multiple workloads. Microsoft has improved the performance of Get-UnifiedGroup over the years, but it’s still not the most rapid cmdlet you’ll ever use.

Converting to Graph SDK Cmdlets

Converting the script to use Microsoft Graph PowerShell SDK cmdlets isn’t very difficult. Here’s the code:

# Check that we are connected to Exchange Online
$ModulesLoaded = Get-Module | Select-Object -ExpandProperty Name
If (!($ModulesLoaded -match "ExchangeOnlineManagement")) {Write-Host "Please connect to the Exchange Online Management module and then restart the script"; break}
 
Connect-MgGraph -NoWelcome -Scopes Group.Read.All, Sites.Read.All
Write-Host "Finding Teams..."
[array]$Teams = Get-MgGroup -Filter "resourceProvisioningOptions/any(x:x eq 'Team')" -All
     
If (!($Teams)) {
   Write-Host "Can't find any Teams for some reason..."
} Else {
  Write-Host ("Processing {0} Teams..." -f $Teams.count)
  $TeamsList = [System.Collections.Generic.List[Object]]::new()    
  ForEach ($Team in $Teams) { 
   $SPOSiteURL = (Get-UnifiedGroup -Identity $Team.Id).SharePointSiteURL  [array]$Channels = Get-MgTeamChannel -TeamId $Team.Id
   [array]$Owners = (Get-MgGroupOwner -GroupId $Team.Id).AdditionalProperties.displayName
   $DisplayNames = $Owners -join ", "
   $TeamLine = [PSCustomObject][Ordered]@{
      Team      = $Team.DisplayName
      SPOSite   = $SPOSiteURL
      Owners    = $DisplayNames  }
   $TeamsList.Add($TeamLine)
  }
  $TeamsList | Out-GridView
  $TeamsList | Export-CSV -NoTypeInformation c:\temp\TeamsSPOList.CSV
}

Figure 1 shows the result.

You’ll notice that I still use the Get-UnifiedGroup cmdlet to fetch the Teams SharePoint URL. It’s possible to retrieve this information using the Graph with code like:

   $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}/drive/root/webUrl" -f $Team.Id)
   $SPOData = Invoke-MgGraphRequest -Uri $Uri -Method Get
   [string]$SPODocLib = $SPOData.Value
   $SPOSiteUrl = $SPODocLib.SubString(0, $SPODocLib.LastIndexOf("/"))

Or:

   $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}/sites/root" -f $Team.Id)
   $SPOData = Invoke-MgGraphRequest -URI $Uri -Method Get
   $SPOSiteUrl = $SPOData.WebURL

The Problem with Permissions when Fetching Teams SharePoint URLs

In both cases, the code works. However, the code fails for some teams due to the restriction placed on interactive use of the Graph SDK. When you connect an interactive session to the Graph, you’re restricted to using delegate permissions. The only data that the Graph SDK cmdlets can access is whatever the signed-in user can access. This is very different to the permissions model used by modules like the Exchange Online management module, which allow access to data based on RBAC controls, meaning that a tenant administrator can access everything.

The restriction disappears when running the SDK cmdlets using a registered app or an Azure Automation runbook. Now the cmdlets can use application permissions, so they can access any data permitted by the Graph permissions assigned to the service principal of the app.

Using either version of the code shown above works perfectly and returns the SharePoint site URL, but only for sites accessible to the signed-in user. Attempts to access any other site returns a 403 forbidden error.

I even tried using the Teams Graph cmdlets:

[array]$Channels = Get-MgTeamChannel -TeamId $Team.Id
$Files = (Get-MgTeamChannelFileFolder -TeamId $Team.Id -ChannelId $Channels[0].Id).WebURL
$SPOSiteUrl =  $Files.SubString(0,$Files.IndexOf("sites/")) + "sites/" + $Team.MailNickName

Again, this approach works for teams that the signed-in user is a member of, but not for other teams.

Going Back to Pure Exchange Cmdlets to Report Teams SharePoint URLs

The problem with permissions meant that I had to use a hybrid of Graph SDK cmdlets to get everything except the SharePoint site URL. And while this approach works, it’s slower than the original implementation using only Exchange Online cmdlets. In several runs against 88 teams the hybrid version took an average of 42 seconds to finish. The Exchange version required an average of 31 seconds.

The learning here is that Graph SDK cmdlets aren’t always the best choice for speed, no matter what you read on the internet. It’s always worth testing to find which approach is the most functional and fastest. Sometimes both boxes are ticked, and that’s a result.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Teams Unified Picker Brings All the Fun Content (Emojis, GIFs, and Stickers) Together

I’m not a very graphic person insofar as I don’t usually add emojis, GIFs, or stickers to email or Teams messages. Well, occasionally I break out and use a smiley face or thumbs-up emoji, but that’s about the limit of my graphic communications. This brings me to MC674737 (11 Sept 2023) and the news that Teams will introduce a “unified fun picker” (the title of Microsoft 365 roadmap item 84023) in early October 2023. Rollout to commercial tenants is expected to complete worldwide by late November 2023, while government tenants won’t start to see the new picker until early December 2023.

Figure 1 shows the unified fun picker in the Teams 2.1 client. The smiler icon reveals the picker with tabs for All, Emoji, GIFs, and Stickers. The new picker is an expansion of the version launched when Teams expanded the set of available emojis in 2022.

The GIFs and Stickers tabs displayed by the picker depend on team settings. If these options are blocked, they won’t appear in the picker.

The Teams Classic Approach to GIFs and Stickers

By comparison, Figure 2 shows the options to add GIFs and stickers in the Teams classic client, which has used the same approach since the original Teams client appeared in 2016.

The change removes some clutter from the GUI and I’m sure people won’t miss having specific icons to choose GIFs and stickers. At least, I don’t think so, but not being an expert in user opinions, I’ve been known to be wrong about similar issues in the past.

Teams Real-Time Synchronization with Outlook Calendar

MC674979 (12 Sept 2023) brings less graphically intense but more practically useful news. Targeted release tenants are receiving an update to make calendar updates appear faster in the Outlook and Teams clients. This is Microsoft 365 roadmap item 138248. Deployment to tenants should finish by mid-October.

Both Outlook and the Teams calendar app operate against the same data stored in the calendar folder of the user’s mailbox. Multiple clients can add, update, or remove calendar events, so background synchronization is necessary to make sure that users see the same information no matter what client they use.

In this case, Microsoft says that they are changing the way that the Teams desktop and browser clients work to make sure that calendar updates made by Outlook clients appear in near real-time in the Teams calendar app. One way that they might have done this is for the Teams server (or middle-tier layer) to take out a subscription on the calendar folder. Any update to the calendar folder forces Teams to synchronize and push the data to the clients. The improved synchronization performance seems to work as well for the Teams classic client as it does for the Teams 2.1 client, which implies that synchronization happens in the middle tier.

Mobile Teams Client Gets Better Calendar Synchronization Too

Not mentioning the Teams mobile clients in the text of the announcement is curious. My tests show that Outlook calendar updates reach the calendar in the Teams mobile (iOS) client as fast as they do the desktop client when connected over the same Wi-Fi network.

Perhaps Microsoft isn’t willing to claim the same kind of performance and reliability improvement in calendar synchronization for mobile clients because of the different characteristics between Wi-Fi and cellular networks. Or it’s just an oversight. In either case, the improved synchronization is appreciated.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Teams Channel Meetings Available to all Members

Updated 23-Dec-2023

I wrote about who receives invitations for Teams meetings in March 2020. Looking back, that was at the start of the Covid-19 pandemic and the massive upsurge in online meetings and usage that propelled Teams to its current level of 300-plus million monthly active users. In any case, people were very interested in figuring out who receives invitations to meetings, and the article is very popular.

A recent question noted that “despite scheduling a Channel meeting, all people that belong to the channel still get an invitation email and the block on the calendar to the meeting created.” The question is why did team members receive invitations?

Apart from discussing the mechanics of creating meetings, Microsoft’s documentation isn’t much help about invitations sent for Teams channel meetings, so let’s probe further. As you’ll recall, Teams supports private meetings created by users with a defined participant list and channel meetings that are open to anyone in the team to attend. When you create a meeting and add a channel, you can specify if team members should receive invitations that add the meeting to their calendar (Figure 1).

If you select the option to send personal invites, Teams generates meeting invitations and sends them to all team members. Going back to the original question, it could be that this is what happened and the user simply forgot that they had asked Teams to notify the other team members.

The Group Subscriber List and Teams Channel Meetings

But life isn’t simple and the obvious answer probably doesn’t apply. Every team has an underlying Microsoft 365 group. Each group has a subscriber list composed of members who want to receive details of messages and events sent to the group. This functionality is directed at Outlook groups, which communicate via email, rather than team-enabled groups, which use channel conversations instead.

By default, the group’s AutoSubscribeNewMembers setting is set to False for team-enabled groups. This tells Exchange Online to not add new users to the group’s subscriber list when they join. However, it’s possible that groups which started out as Outlook groups before they became team-enabled have AutoSubscribeNewMembers set to True, meaning that new users join the subscriber list and receive updates for events like invitations to new Teams channel meetings.

Checking Teams that Auto-Subscribe New Members

To discover if auto-subscription of new members happens for the teams in your tenant, run this PowerShell code:

Connect-ExchangeOnline
[array]$Groups = Get-UnifiedGroup -ResultSize Unlimited -Filter {ResourceProvisioningOptions -eq "Team"}
If ($Groups) {
   [int]$i = 0; [array]$GroupNames = $Null
   ForEach ($Group in $Groups) {
     If ($Group.AutoSubscribeNewMembers -eq $True) {
        Write-Host ("Team {0} autosubscribes new users" -f $Group.displayName)
        $i++
        $GroupNames += $Group.displayName
     }
   }
   Write-Host ("{0} teams of {1} autosubscribe new users found ({2})." -f $i, $Groups.count, ($GroupNames -join ", "))
}

Much to my interest, I discovered that 57 teams in my tenant auto-subscribe new members. Many of the underlying groups date back to the earliest days of Office 365 groups and were subsequently team-enabled since.

I suspect that auto-subscription is the root cause for the reported problem. If this is true, the easy fix is to reset the AutoSubscribeNewMembers setting for the affected teams to False and remove users from the existing subscriber list. This code does the job and makes sure that channel meeting invitations only go to team members if explicitly chosen by the meeting organizer:

$Teams = $Groups | Where-Object {$_.AutoSubscribeNewMembers -eq $True}
ForEach ($Group in $Teams) {
  Write-Host ("Resetting autosubscription setting for {0}" -f $Group.displayName)
  Set-UnifiedGroup -Identity $Group.ExternalDirectoryObjectId -AutoSubscribeNewMembers:$False
  [array]$Links = Get-UnifiedGroupLinks -Identity $Group.ExternalDirectoryObjectId -LinkType Subscribers
  Remove-UnifiedGroupLinks -Identity $Group.ExternalDirectoryObjectId -LinkType Subscribers -Links $Links -Confirm:$False
}

Another Approach for Teams Channel Meetings

If you don’t want to remove subscribers from groups, another solution exists. You can create a private meeting in Teams or Outlook (with at least one participant). After Teams creates the online details for the meeting, copy and paste the link to the call along with other details of the meeting into a channel conversation (Figure 2). At the appointed time, any members who want to join the call can click the link to connect.

The advantage of this approach is that it works for any kind of channel – regular, shared, and private (the meetings won’t show up in the calendar app). The technique relies on the fact that you’re posting details of a private meeting into a conversation. People who want to attend have the option of copying the details into their calendar so that they’ll be reminded of the call.

All of this proves that Teams is built on a foundation of other services and that sometimes those services are the reason why something unexpected happens in Teams. It also proves that there’s often another way to accomplish a task. Which is kind of nice.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Deployment Delayed, and Meet App Only Works on Teams 2.1 Client

In a 28 July update to message center notification MC660610. Microsoft moved the rollout schedule for the Teams Meet app from mid-August to mid-October. The Meet app is only available for the new Teams 2.1 client (desktop and browser), which is why it won’t be available early for targeted release tenants. Instead, everyone will see the Meet app when Microsoft releases it for general availability, which is the same timeframe to release the Teams 2.1 client to the General Channel for Office.

From now on, you can expect Microsoft to release features targeted on the Teams 2.1 client and not for the classic client. For example, the new Microsoft 365 multi-tenant organization feature enables a bunch of “seamless collaboration” features in Teams, but those features only surface in Teams 2.1.

The Teams Meet app is preinstalled, meaning that users can find the app in the overflow […] menu in the left app navigation bar. Organizations can use a setup policy to pin the app to the navigation bar or leave this for users to do. If you don’t want people to use the Meet app, you can disable it in the Apps section of the Teams admin center.

Teams Meet App

According to Microsoft, the Meet app is “a centralized hub for all meeting activity and content.” In a nutshell, it’s a place to go to learn about upcoming meetings and retrieve information (chat, agenda, recaps) for meetings from the past (Figure 1).

Essentially, the Meet app gives another view onto calendar information, much like the Teams channel calendar app extracts and displays meeting data for a specific channel from the calendar events stored in the owning team’s group mailbox. The idea is that instead of browsing the calendar to review meetings, the Meet app makes the task easier by highlighting recent and upcoming meetings. Quite how this will play out for people whose habit is to use the calendar in their own particular way remains to be seen.

As you can see from Figure 1, the Meet app divides meetings into two sections: Up next and Recent. It’s important to realize that the app is not a silver bullet to remove any limitations that exist with meetings. For example, meeting artifacts like Loop-based collaborative meeting notes are only available to tenant members. Because of the sharing restrictions imposed by Loop, guest attendees can’t access these notes.

The listing of upcoming meetings is a good way to check out the next ten or so meetings scheduled in your calendar. If necessary, you can quickly change your RSVP response to a meeting, check attendee status, and so on. It’s certainly different to scanning events placed on a traditional calendar grid, and this might take some a little time to become used to.

The Recent section lists previous meetings over the last 30 days. Essentially, this is fast access to recent meetings to allow users to find items related to those meetings like the chat, attached files, and transcripts. If you have Teams Premium licenses, you can use the view recap button to view the intelligent meeting recap (you can get some Teams Premium trial licenses to test this feature out).

A Different Way to Work

Many of my Teams meetings are hosted in other tenants. Much of the potential usefulness of the Recent section in the Meet app disappears in this context. The notes, chat, and other artifacts for meetings I attend as a guest are stored in those tenants and inaccessible through the Meet app. I can use the app to get a quick overview of what’s due to happen today, but it’s no more useful than glancing at my calendar in Outlook or Teams. For this reason, the app quickly lost its attraction for me.

But I can see how people who spend a lot of time attending internal meetings in their home tenant can get value from the Meet app. This cohort is probably the target market for the Meet app. In fact, it seems like an app designed for large enterprises where many employees fall into the target group. Just like Microsoft, in fact.

Users Can Sign Up for Sixty Day Teams Premium Trial License

Is MSCommerce (the “PowerShell Module for accessing Microsoft Commerce APIs”) the worse PowerShell module produced by Microsoft? The thought went through my mind when I loaded version 1.9 of the module (the latest available from the PowerShell gallery, updated a mere 25 days ago) to find that not only did the module not support PowerShell 7, but it barely worked on PowerShell 5.

Well, barely rates the module too highly. Yes, the cmdlets generate output, but it’s odd output that’s not pipeable and is barely usable. So MSCommerce 1.9 is a terrible module, which is why I deleted it and went back to version 1.8 to work with the Teams Premium Trial offer that Microsoft is keen to offer to end users. For the record, I used these commands:

Uninstall-Module Mscommerce
Install-Module Mscommerce -RequiredVersion 1.8 -Scope AllUsers

Teams Premium Trial

According to MC670435 (24 Aug 2023), in late September, end users in commercial tenants “will be able to initiate a self-service trial of Microsoft Teams Premium using their Azure Active Directory (AAD) credentials with no requirement to input payment information.” In other words, users can decide to kick the tires for Teams Premium for sixty days to see if it’s worth the $10 monthly fee (available for $7/month until December 31, 2023). These licenses are different to the 30-day trial licenses available for 25 users within a tenant.

Microsoft hopes that the trial will “generate signals on utilization for IT to identify users that would benefit from a Teams Premium license.”

Tenant administrators can terminate the trial licenses at any time (or remove them from user accounts). At the end of the sixty-day trial period, the organization can decide to drop the trial or move to a paid basis by buying some “real” Teams Premium licenses. More information about administration of self-service purchases is available in Microsoft documentation.

The Worth of Teams Premium

Microsoft announced Teams Premium at the Ignite 2022 conference. Annoyingly, Microsoft followed up the announcement by moving four features from Teams Standard to Teams Premium. In July 2023, Microsoft said that they had sold 600,000 Teams Premium licenses, which sounds a lot until you remember it’s only 0.2% of the 300 million Teams monthly active user base. Microsoft is obviously very keen to increase the $72 million annual run rate for Teams Premium to a much higher number, which is why trials are available.

I quite like some of the Teams Premium features, the best being intelligent recap of meetings. However, deciding if Teams Standard is sufficient for your day-to-day team collaboration or you need the extra boost delivered by Teams Premium is highly subjective.

Managing Self-Service Purchases

Microsoft started selling self-service purchases to end users with Power BI Premium in 2021. Since that time, it has steadily increased the number of available products, such as the Windows 365 plans. A more recent addition is the Python in Excel add-on, announced in MC669648 on August 22, 2023. Many organizations don’t want users do purchase software, and that’s where the MsCommerce module comes into play. If you want to stop users seeing a product, you must disable it in the MsCommerce inventory.

For example, to block purchases of the Teams Premium trial, import the module, connect to the MsCommerce endpoint and run the Get-MsCommerceProductPolicies cmdlet to find the Teams Premium trial. Then set the Enabled state to False. Here’s what I did:

Import-Module MsCommerce
Connect-MsCommerce

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Where-Object {$_.ProductName -eq "Teams Premium" }| ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False }
Update policy product success

ProductName   ProductId    PolicyId                 PolicyValue
-----------   ---------    --------                 -----------
Teams Premium CFQ7TTC0RM8K AllowSelfServicePurchase Disabled
Success

To list the full set of self-service products available to users and their current state, run this command:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Sort-Object ProductName

ProductName                                            ProductId    PolicyId                 PolicyValue
-----------                                            ---------    --------                 -----------
Dynamics 365 Marketing                                 CFQ7TTC0LH3N AllowSelfServicePurchase Enabled
Dynamics 365 Marketing Additional Application          CFQ7TTC0LHVK AllowSelfServicePurchase Enabled
Dynamics 365 Marketing Additional Non-Prod Application CFQ7TTC0LHWM AllowSelfServicePurchase Enabled
Dynamics 365 Marketing Attach                          CFQ7TTC0LHWP AllowSelfServicePurchase Enabled
Microsoft 365 F3                                       CFQ7TTC0LH05 AllowSelfServicePurchase Enabled
Power Apps per user                                    CFQ7TTC0LH2H AllowSelfServicePurchase Disabled
Power Automate per user                                CFQ7TTC0LH3L AllowSelfServicePurchase Disabled
Power Automate Per User with Attended RPA Plan         CFQ7TTC0LSGZ AllowSelfServicePurchase Enabled
Power Automate RPA                                     CFQ7TTC0KXG6 AllowSelfServicePurchase Disabled
Power BI Premium per user                              CFQ7TTC0H6RP AllowSelfServicePurchase Disabled
Power BI Pro                                           CFQ7TTC0H9MP AllowSelfServicePurchase Disabled
Project Plan 1                                         CFQ7TTC0HDB1 AllowSelfServicePurchase Disabled
Project Plan 3                                         CFQ7TTC0HDB0 AllowSelfServicePurchase Disabled
Python On Excel                                        CFQ7TTC0S3X1 AllowSelfServicePurchase Enabled
Teams Exploratory                                      CFQ7TTC0J1FV AllowSelfServicePurchase Enabled
Teams Premium                                          CFQ7TTC0RM8K AllowSelfServicePurchase Disabled
Visio Plan 1                                           CFQ7TTC0HD33 AllowSelfServicePurchase Disabled
Visio Plan 2                                           CFQ7TTC0HD32 AllowSelfServicePurchase Disabled
Viva Goals                                             CFQ7TTC0PW0V AllowSelfServicePurchase Enabled
Viva Learning                                          CFQ7TTC0HVZG AllowSelfServicePurchase Enabled
Windows 365 Business                                   CFQ7TTC0J203 AllowSelfServicePurchase Disabled
Windows 365 Business with Windows Hybrid Benefit       CFQ7TTC0HX99 AllowSelfServicePurchase Disabled
Windows 365 Enterprise                                 CFQ7TTC0HHS9 AllowSelfServicePurchase Disabled

Teams Premium Needs a Comprehensive Trial

If an organization is interested in Teams Premium, I recommend that you run a planned trial by selecting a department to test and assigning trial licenses to 25 people to use over 30 days. I don’t see much value in individual users getting trial licenses to test on their own. Teams is all about collaboration, and collaboration involves multiple people. Taking that logic further, it seems like the right approach is to test as a team and not as an individual.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Surprise Announcement Highlights Inconsistencies Across Microsoft 365 Consoles

Microsoft’s 17 August announcement that they are not proceeding with support for dark mode in the Teams admin center (TAC) came as a surprise. Originally announced in message center notification MC567496 (2 Jun 2023), I covered the news briefly on June 6 and pointed out that dark mode for TAC had some problems with custom tenant colors. This didn’t seem like a big issue at the time. It’s the kind of fit-and-finish bug that tends to be taken care of before final release.

I don’t know why Microsoft decided not to deliver dark mode for TAC. Microsoft’s announcement simply says “We have made the decision not to proceed with this feature at this time,” which could mean anything. What’s for sure is that the toggle to enable dark mode has disappeared and won’t come back until Microsoft decides what to do next.

The news about TAC got me thinking about why Microsoft doesn’t have a common platform for Microsoft 365 administrative consoles. Despite efforts to make the consoles look and feel similar, the interfaces have their own foibles.

Authorization and Tokens

Take authorization as an example. The admin consoles use modern authentication, so the consoles need to acquire OAuth 2.0 access tokens and renew the tokens when they expire. Making token renewal a seamless experience for administrators seems to be a very complex technical challenge for the console developers.

The Microsoft 365 admin center manages things best. Behind the scenes, the console takes care of token renewal without a hitch. I seldom experience issues with this console, even after keeping the admin center open for extended periods. The SharePoint Online admin center is also pretty good. Other consoles struggle to deliver an elegant solution to token refresh.

For example, the new-and-improved Exchange admin center flashes errors up when it discovers the need to renew an expired token. Flash is the operative word because an error message appears and disappears in the blink of an eye. However, it’s there and I know it’s there and I worry that something more problematic than a brief pause in token renewal is the root cause. It seems like an issue that is highly solvable.

The Microsoft Purview compliance portal takes a more pedantic stance and insists that administrators should sign in regularly (Figure 1). At least you know where you are and what to do to proceed, and an arguable case exists that the compliance portal gives access to solutions that protect confidential information. But the inconsistency in behavior is obvious and jarring.

Teams Admin Center

And then we come to the Teams admin center. This console is fond of launching and appearing to work as normal before suddenly deciding that it should sign out the connected user (Figure 2). This action forces the user to reauthenticate before they can connect to TAC. And it can force the user to sign in again to other Microsoft 365 apps.

I’ve complained to Microsoft about TAC’s odd connection procedure several times. Each time I’m told things will improve. And to be fair to Microsoft, the issue occurs much less frequently now than it did in the past. Perhaps recent changes to the TAC contained some new code to address the problem. But I don’t trust TAC because I’ve experienced the sign-out issue within the last few weeks. I’m now keeping a watching brief on TAC to see if the issue reappears and if so, whether I can identify specific circumstances that might provoke the sign-out.

Dark Mode Support Across Admin Consoles

With the decision made not to support dark mode for TAC, the situation is that two of the five main Microsoft 365 admin consoles support dark mode while three do not:

• Support dark mode: Microsoft 365 admin center (Figure 3), Exchange Online admin center.
• Do not support dark mode: Teams admin center, Microsoft Purview compliance portal, SharePoint Online admin center.

The inconsistent implementation of dark mode is only an indication of the lack of consistency which still exists across the Microsoft 365 admin consoles. It demonstrates that Microsoft still has work to do to make Microsoft 365 administration a unified space. And when they’re doing that, making access token renewal work the same way across all consoles would be a great thing to do.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant

Use PowerShell and the Audit Log to Find Targeted Accounts in Teams Memberships

A request came into the Office 365 Technical Discussions Facebook group for a way to monitor member additions to teams. The idea is that if a team owner adds an account with a specific attribute in the display name, something picks up the addition and notifies someone that the action happened.

PowerShell is the normal way to answer questions of this nature. That is, if you can get at the data. In this instance, the unified audit log captures events for team membership additions, so the raw data exists, even if a little manipulation is necessary to extract the information we need (thankfully, the needed manipulation is less than in other scenarios, such as tracking updates for properties of user accounts).

Specifying User Accounts to Monitor in Teams Memberships

The first thing to do is identify the set of users to check for. The original request didn’t specify what kind of attribute to look for in the display name, so the solution outlined here assumes that it’s a string after the combination of first name and last name. For instance, “Tom Smith (Project Management).”

Identifying the accounts to monitor is a key part of the solution. Here’s the code to use the Get-MgUser cmdlet with the Search parameter to find licensed member accounts that include “Project” in the display name.

[array]$Users = Get-MgUser -Search "displayName:Project" -Filter "assignedLicenses/`$count ne 0 and userType eq 'Member'" -ConsistencyLevel Eventual
If (!($Users)) { 
    Throw "No users found"
}

There might be many user accounts that need to be monitored. To speed things up when we check audit records, the script creates a hash table composed of the user principal name and display name.

$UserLookup = @{}
ForEach ($User in $Users) {
   $UserLookup.Add($User.UserPrincipalName, $User.DisplayName)
}

Searching the Audit Log for Additions to Teams Memberships

Next, the script calls the Search-UnifiedAuditLog cmdlet to look for MemberAdded events generated by Teams over the past seven days:

$StartDate = (Get-Date).AddDays(-7)
$EndDate = (Get-Date).AddDays(1)
[array]$Records = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -Formatted -ResultSize 5000 -RecordType MicrosoftTeams -Operations MemberAdded -SessionCommand ReturnLargeSet
$Records = $Records | Sort-Object Identity -Unique

To check the audit events, the script converts the AuditData property for each event from JSON and examines what’s stored in the Members property (an array). For each item in Members, the script looks up the hash table to see if the account is monitored, and if so, captures details of the event in a list:

$Report = [System.Collections.Generic.List[Object]]::new()  
ForEach ($Rec in $Records) {
    $Role = $Null
    $AuditData = $Rec.AuditData | ConvertFrom-Json
    # Check the members noted as added to a group
    ForEach ($Member in $AuditData.Members) {
        If ($UserLookup[$Member.Upn]) {
           Write-Host ("User {0} added to team {1}" -f $Member.DisplayName, $AuditData.TeamName) 
           Switch ($Member.Role) {
            "1"  { $Role = "Member" }
            "2"  { $Role = "Owner"}
            "3"  { $Role = "Guest" }
           }
           $ReportLine = [PSCustomObject]@{
             Date = $AuditData.CreationTime
             User = $Member.Upn   
             Name = $Member.DisplayName
             Team = $AuditData.TeamName
             Role = $Role
             AddedBy = $AuditData.UserId
           }
          $Report.Add($ReportLine)
        }
    }
}

Here’s an example of the output:

Date    : 20/08/2023 12:12:55
User    : Hans.Geering@office365itpros.com
Name    : Hans Geering (Project Management)
Team    : Office 365 Adoption
Role    : Member
AddedBy : Tony.Redmond@office365itpros.com

Sharing the Results

To share the results, we send email from a shared mailbox. This action requires the Mail.Send.Shared Graph permission and uses the Send-MgUsermail cmdlet using a variety of the code explained in this article. Figure 1 shows an example of an email sent to the designated recipient (which should probably be a distribution list in production) to report results.

Posting the information to a Teams channel is another way to share details about new membership additions. Another option is to upload the file to a SharePoint Online document library, a topic explored in this article when Azure Automation runs a script to create content like a report. Monitoring for changes in a Microsoft 365 tenant is the kind of task that is well suited to Azure Automation, and it’s the way that I would go in production.

You can download the sample script from GitHub. Feel free to change (hopefully improve) the code.

Learn about using the Graph SDK, the unified audit log, and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Stream Video Playback Inline in Chats and Channel Conversations

Fresh from the artificial intelligence mysteries of the Maybelline beauty app and the prospect of losing content in teams with a thousand channels, Teams users can take advantage of the change announced in MC649917 (Microsoft 365 roadmap item 127596). The change means that videos stored in Stream for SharePoint play inline within messages posted in a chat or channel conversation.

Enabling better Stream video playback within Teams might not sound very exciting, but it avoids the need for Stream to open a browser window and launch its client to play the content (Figure 1). Most people might even consider the capability to be better than boasting red lips in a meeting.

Microsoft is currently rolling out the update and expects all tenants to have it by late August.

Some Stream Issues with Teams

While checking out the new functionality, I ran into some problems with the links between Teams and Stream. First, the Stream app in Teams still connects to Stream classic. Given that the migration to Stream on SharePoint started last October, I’m surprised that app only accepts URLs for videos on the old platform. It would seem easy to detect if a tenant uses Steam on SharePoint and take appropriate action.

Second, the sharing options available in Stream includes the chance to share a video to a Teams chat or channel. The options works like the Share to Teams feature in Outlook in that it allows the user to select a target in Teams to share with. Unfortunately, Share to Teams in Stream couldn’t find many of the teams and chats that I use, including the test team I created to host 1,000 channels (Figure 2).

When Stream managed to share to a team channel, it created a simple link to the video  (Figure 3) that launches the Stream player when invoked. There’s no sign of enhanced Stream video playback here.

Obviously, the Stream team needs to do some more work to make the connection with Teams as seamless as it should be. I’ve reported both issues to Microsoft.

SharePoint Sorts Out its User Photos

Finally for the week, it’s interesting to read the message center notification MC653734 (July 21) covering “image coherence for SharePoint Online” (a truly horrible title). The update addresses user photo management for accounts that don’t have Exchange Online licenses or use Delve to update their photos to fix the problem where user photos displayed in SharePoint are different to those shown elsewhere in Microsoft 365 (hence “image coherence”).

In August 2023, Microsoft will roll out a fix to force SharePoint Online to display images fetched from the “Microsoft People System (MPS)”, just like all the other Microsoft 365 apps. In practical terms, this means that SharePoint will fetch the thumbnail photos stored in Entra ID accounts via the Graph profilePhoto API.

The impact on  users is that they will have to upload photos via Delve or using the avatar at the top right-hand corner of SharePoint pages (Figure 4). Admins can continue to update user photos via the Entra ID admin center or with PowerShell.

I don’t imagine that this change will affect many people. It removes a lingering piece of functionality that originated in SharePoint server and brings the app in line with the norms of the rest of Microsoft 365, and that’s good.

Make sure that you’re not surprised about changes that appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

New Teams Channel Limit Supports Any Combination of 1,000 Regular and Shared Channels

On July 19, Microsoft announced (MC649926) an increase in the current per-team channel limits. Instead of 200 regular channels, 200 shared channels, and 30 private channels, the new limit is any combination of regular, shared, and private channels up to the 1,000 maximum. A team can have up to 30 private channels. The update is covered in Microsoft 365 Roadmap ID 127496 and deployment to Teams preview tenants (targeted release) starts in late July (now). Standard release tenants and GCC will receive the update in mid-August.

A Thousand Teams Channels Creates Greater Flexibility or a Bigger Mess

According to Microsoft, the new limit allows “teams to have greater flexibility when creating a new channel.” That’s certainly true, if you define flexibility in terms of being able to create large numbers of channels in a team. I’m not convinced that this is the case. I see too many examples of unwanted, unused, and desolate channels in the tenants I work in. Any channel that hasn’t been used in the last two months falls into this category, unless it’s deliberately kept as an archive of some activity.

The simple fact is that once you give people a lot of choice, you create the opportunity for bad choices. In the case of Teams, a team with 20 channels, each with a clear purpose and intent, is more likely to keep conversations together in the most appropriate channel than if team members had 200 channels to choose from. My experience is that it takes huge discipline for team members to take the time to select the best channel for a new conversation. But I’ve been known to be wrong.

Creating a Thousand Channels in a Team

To see what a team looks like with a thousand channels, I wrote some PowerShell using cmdlets from the MicrosoftTeams module to create a team and populate it with 999 extra channels (a new team always has a General channel). Here’s the code:

Connect-MicrosoftTeams

$Team = (New-Team -DisplayName "Test Team with 1000 channels" -MailNickName 'Test.Team.1000' -Description "Team with 1,000 channels" -Visibility Private -Owner James.Ryan@office365itpros.com -RetainCreatedGroup:$True)

For ($i=2; $i -le 1000; $i++) { 
    $ChannelName = ("Channel Number {0}" -f $i)
    Write-Host ("Creating {0}" -f $ChannelName)
    $ChannelDescription = ("Channel {0} created on {1}" -f $i, (Get-Date -format g))
    New-TeamChannel -GroupId $Team.GroupId -DisplayName $ChannelName -Description $ChannelDescription
    Sleep -Seconds 10
}

Figure 1 shows the code in action. My first attempt failed after creating 51 channels, probably due to throttling. Adding the ten seconds delay between the creation of each channel allowed the script to complete.

I used V5.4 of the Teams PowerShell module to test cmdlets against the team with a thousand channels,. Some cmdlets need some tweaking to deal with the extra channels. The Get-TeamChannel cmdlet failed to complete:

[array]$Channels = Get-TeamChannel -GroupId $Team.GroupId -MembershipType Standard

Get-TeamChannel : Error occurred while executing
Code: BadGateway
Message: Failed to execute backend request.

The Get-TeamAllChannel cmdlet also errored out:

Get-TeamAllChannel -GroupId $Team.GroupId -MembershipType Standard

Get-TeamAllChannel : Error occurred while executing
Code: UnknownError

All of which means that my script to report all channels for every team in a tenant won’t work until Microsoft upgrades the Teams cmdlets. The good news is that the Teams cmdlets in the Microsoft Graph PowerShell SDK work (as do the clients)

[array]$Channels = Get-MgTeamChannel -TeamId $Team.GroupId
$Channels.count
1000

The Teams admin center has a problem too (Figure 2).

But remember, this is a preview for now and I expect the issues to be resolved with an update for the Teams admin center and the next monthly update for the Teams PowerShell module.

Teams Channel Client Experience

Listing a thousand channels works in the Teams desktop (including 2.1 beta), browser, and mobile clients. Figure 2 shows the browser client listing a bunch of channels and a new conversation being created in Channel 999.

As you can imagine, navigating through a thousand channels is a painful experience. Users soon learn that they need to be selective and hide all but the channels they use frequently.

Someone Needs a Thousand Channels

I’m sure that some customer demand exists for thousand-channel teams. Right now, I can’t think of any scenario where I’d use so many channels, but Microsoft doesn’t tend to expand features without a reason, especially updates that impact clients. In any case, prepare to have the ability to equip teams with more channels in an update landing soon.

Learn how to exploit the data available to Microsoft 365 tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.

Maybelline Video Filters for Teams Meetings

I don’t quite know what to make of Microsoft’s July 19 post about their collaboration with Mayelline of New York to launch the Maybelline Beauty app for Teams. After all, it wasn’t April 1, so the announcement seemed to be serious and Microsoft says that they are rolling the app out to their enterprise customers worldwide. Could it have been an attempt to distract people from the clouds around the $30/user/month price Microsoft revealed for Microsoft 365 Copilot?

But no, it’s a Teams app that can be loaded into Teams meetings to embellish the appearance of meeting participants, much like the brightness and soft-focus filters or more accurately, the Snapchat lenses added to Teams meetings in April 2023. It’s all about creating a better image of who you really are without going the whole hog and using a mesh avatar.

Believe it or not, I have some history in this area. In 2007, I worked in Palo Alto at the world-famous HP Labs facility on Page Mill Road. A project worked on helping people choose the most appropriate combination of facial cosmetics using a HP iPAQ handheld computer and some software from a well-known cosmetics brand. The idea was that you could use the iPAQ camera to capture your face and then process the image to calculate the exact shade of lipstick, face powder or whatever to apply. Unhappily, the project went nowhere.

Allowing Access to the Maybelline App

In any case, to use the Maybelline video filters in Teams meetings, you’ll need to allow access to the app. My org-wide app settings do not automatically publish new third-party apps to the Team app store, so I needed to unblock the Maybelline app by finding and unblocking the app in the Teams admin center (Figure 1).

Using the Maybelline Video Filters in Teams Meetings

It can take a few hours for the Maybelline app to become available for meetings. When it is available, you’ll see the Maybelline filters in the set of available filters in the meeting pre-join screen (Figure 2) along with the video frames and styles from Microsoft and the set of Snapchat lenses. The same filters are available for selection during a meeting, but having them available beforehand means that a participant’s video feed looks its best from when they join a call.

Like other third-party video filter effects packages delivered to Teams meeting participants, the user must grant consent to the app to allow it to modify their video feed.

Not being an expert in Maybelline technology, I didn’t really know what filter to choose from. According to Microsoft, the app “provides users with 12 unique looks.” Names like “Blur,” “Glowy,” “Iconic,” and “Natural” all seemed promising but didn’t seem to do much when applied. Truthfully, it would take more than a filter to make my appearance any better than the original (the Teams soft-focus filter is the best so far).

Figure 3 shows what happened to my video feed with the Red filter applied. My lips are a rather startling shade of red while a second set of eyebrows seems to be present.

In their post, Microsoft says that the app “uses AI-powered functionality” that “identifies over 70 points of the user’s face to create a “virtual map” that enables the seamless application of the digital filters.” In other words, the app processes the video feed from the camera to create a map of the face and apply the filter, which is how I ended up with nice red lips. Obviously, I am not the target market for this technology and am therefore a poor model.

The Maybelline app only works for the Teams classic client. It isn’t available in the preview of the Teams 2.1 client.

Block the Maybelline Video Filters If You Wish

It’s hard to know what to make of an app like the Maybelline filters. Administrators can block the app. Even if it’s available, you don’t have to use the app and can ignore it if you want to. I guess some would ask if Microsoft should dedicate resources to what seems like an unwanted bauble. Others argue that it’s all part of building out an ecosystem. Microsoft says that they welcome your feedback on this point, even if they included a link to the old UserVoice-based feedback portal (aka.ms/TeamFeedback) instead of the new Teams feedback portal. Someone should go and change that aka.ms shortcut.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Capture and Redirect Shared Channel Membership Requests

I must admit to being a tad bemused when I read MC635987 (July 11, 2023) on the topic of “capturing requests to use shared channels.” According to Microsoft, the feature will “provide a way for organizations to capture and redirect requests for external collaboration when users attempt to add an external member to a shared channel where B2B direct connect cross-tenant trust has not been mutually configured between the two organizations.” That’s quite a mouthful and it’s not easy to understand.

Parsing things out, the new feature breaks down into displaying and defining a web page for channel owners to go to when they run into problems adding a new member because the domain the member belongs to is not covered by the organization’s cross-tenant access policy. In this case, no trust exists between the two organizations. A tenant-wide setting defines the web page for users to visit if the access check fails and they wish to request support. Ideally, the web page should contain full tenant-specific instructions for how to request the organization to create a trust with the other organization.

Microsoft expects to deploy the update to commercial tenants in early August and complete rollout soon afterwards.

Shared Channels and Trusts

Shared channels depend on trusts between the tenant hosting the channel and the tenants where channel members come from. You can use PowerShell to discover which tenants shared channel members come from for shared channels hosted by your tenant or track access using sign-in logs.

The cross-tenant channel policies that enable the trusts are defined in the External Identities section of the Microsoft Entra admin center. Trusts must be two-way. In other words, it’s not enough for your tenant to trust the Contoso domain: Contoso must trust your tenant too before shared channels can work. An organization can have an open cross-tenant channel policy, meaning that it’s open to connections from any other tenant. Given the recent demonstration of how attackers could exploit external access to compromise Teams, this is not a good idea. It’s more work, but also more secure, to define cross-tenant access policies for each organization you want to collaborate with.

When a Cross-Tenant Access Policy Doesn’t Exist, Shared Channels Don’t Work

Which brings us to the problem Microsoft is trying to solve. Channel owners don’t know (much) about cross-tenant trusts and probably don’t know if a policy exists for a given external tenant. When they go to share a channel with a user, that person might not be able to access the channel because of the lack of trust. The new code check detects when the condition occurs and presents the user with a link to use if they need additional support (Figure 1).

The link can be to any URI (even if it points to a non-existent page). The link is defined in the Teams section of the Teams admin center. Go to Teams settings and scroll to the options for Shared channels. Set the “Provide a link to my support request page” to On and input the page link (Figure 2).

The page won’t create a cross-tenant access policy (remember, the policy must exist on both sides). It can gather information from the channel owner about why they want to collaborate with people from the target domain to allow administrators to decide if it’s appropriate to create a cross-tenant access policy. The administrators will also need to contact the administrators of the target domain to arrange for them to trust your domain.

Maybe a Guest Account is a Better Idea?

If the administrators decide that they don’t want to trust the target domain, the option still exists to create a guest account for the person and add them to a private channel (shared channels don’t support guest accounts). That is, if the B2B Collaboration policy allows accounts from that domain to join your tenant as a guest. There’s always something that gets in the way.

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new developments as they happen.

Teams Admin Center Search for Teams Policies, Settings, Users, and Documentation

Announced on June 21, 2023, and now being deployments to tenants with the aim of completing worldwide roll-out in mid-July, message center notification MC600723 describes an update to the Header Search feature in the Teams admin center (TAC). “Header Search” means that the TAC can search through the objects it manages using criteria input to a box in the TAC header. The feature originally launched in preview in March 2022 (Microsoft 365 roadmap item 83671) and became generally available in June 2022.

Searching Across All of Teams

Figure 1 shows the result of a search for “external access,” a term deserving of some administrator interest due to the recent report by security researchers about a weakness in federated chat. The solution is to not operate open external access for Teams because this allows anyone from any other Teams tenant to connect with users in your tenant. Instead, lock things down and define an allow list of tenants for external access, maybe even using a version of my PowerShell script to maintain the allow list.

As you can see, TAC groups search results into different categories like Users. I find the search facility most useful when looking for details about settings or policies.

Disappointing Teams Admin Center Search Results

The problem with the TAC search is that its results are often not very good (maybe they come from Bing?). Take Figure 2 for an example. Here we search for the name of a user and get hits for items like Microsoft eCDN and transcription. It’s hard to reconcile the search term with the results. In general, searches generate far too many indiscriminate results. On the other hand, looking for something that you’d imagine should be readily available, like “Teams Premium” comes up with just 2 results, neither of which are very useful. Disappointing results happen far too often to make the TAC header search a must-use tool.

Go to the Documentation

When in doubt, it’s a good idea to consult the product documentation. TAC search results give you the option to search Microsoft public documentation (I don’t know why they mention public here; few people would expect to search documentation that isn’t public, such as text covering unannounced features).

Although TAC supports searching product documentation, I prefer using a Google search (or your favorite search engine) to find anything to do with Teams. My logic is simple. The Microsoft documentation will show up in the results, so I don’t lose anything there. In addition, I’ll see information from blogs and articles from other sources that often illuminate the darker parts of Teams functionality, such as why things only work if done in a certain way or why they might never work. The problem with Teams is that the product depends on so many other Microsoft 365 and Azure components that looking solely at product documentation might never solve a problem. In a nutshell, it’s convenient to have the Microsoft documentation in the TAC search results, but it’s also very limiting.

I know why Microsoft limits TAC search to its documentation. Microsoft stands over what its writers generate and publish. They can’t curate the internet (neither can ChatGPT or other AI Large Language Models, which is a huge issue when using generative AI), so Microsoft can’t include certain articles that they consider useful or interesting and ignore others. Well, they could, but curation of articles would be a huge ongoing task. All in all, it’s best to search and find answers yourself. That is, if you know what you’re looking for.

Keep up to date with developments like improvements to the Teams admin center by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

New Teams Client Slated to Become Default Client in September 2023

On the last day of the Microsoft FY23 fiscal year, the Teams development group released message center notification MC617066 to inform Microsoft 365 tenants about their plans to deploy the new Teams client (Teams 2.1) into production. This is a big thing given that Teams has over 300 million monthly active users, many of whom have noticed that the Teams classic client can be a bit of a performance pig at times. The great hope is that the Teams 2.1 client will require less memory and consume fewer system resources.

The new Teams client arrived in preview at the end of March 2023. At the time, Teams 2.1 lacked many of the features available in the classic client, including some annoying deficiencies such as the inability to use @ mentions in channel conversations. Since then, Microsoft says that they have added “features such as third-party, line-of-business (LOB) applications, breakout rooms, and new scenarios such as multi-tenant organization (MTO) to the new Teams experience.”

Steady Improvement

There’s no doubt that Teams 2.1 (Figure 1) has progressed steadily since March. It’s hard to quantify performance and compare it against the classic client because a feature gap still exists. Nevertheless, things look positive. Some aspects of the new client, such as its handling of notifications and switching in a multi-tenant work environment, are impressive. Despite the advent of Teams shared channels over a year ago, guest accounts are still extremely useful and are heavily used. I use guest accounts all the time, and appreciate the work Microsoft has done here.

Unlike Outlook, where Microsoft says that only the Outlook Monarch client will work with Microsoft 365 Copilot, both the Teams classic and 2.1 client will support Copilot. This is interesting because it indicates that Microsoft believes that the transition from Teams classic to 2.1 will take some time. Of course, moving people to a new version of Outlook for Windows takes forever, but the insistence on Monarch might be just Microsoft’s way of cajoling people who want to use Copilot to take the leap to embrace Monarch.

Microsoft’s Strategy for Teams 2.1

The Teams update policy assigned to a user account controls when they see the toggle to allow them to switch to the Teams 2.1 client (Figure 2).

Microsoft says that starting in mid to late July 2023, they will display the toggle when the UseNewTeamsClient setting for the update policy assigned to an account is set to “Microsoft controlled.” They’ll start to display the toggle with accounts that have Microsoft 365 Business plans and then move to accounts with enterprise plans like Office 365 E3 or E5 in early August (for more details, see the rollout schedule page).

The switchover starts in earnest in September 2023 when Microsoft makes Teams 2.1 the default client. Once again, this will happen first for accounts with Business plans before progressing to enterprise accounts. Those using Teams preview will see Teams 2.1 become the default in mid-August 2023.

At this point, the Microsoft 365 apps update channel starts to exert an influence and decision about which Teams client is the default is then dictated by a combination of the license type and the update channel. Here’s how the update channel affects deployment:

• Targeted Release Channel: Mid-August 2023
• Current Channel: Early October 2023 (this is the date indicated in Microsoft 365 roadmap item122540 covering the new Teams client)
• Monthly Enterprise Channel: Early November 2023
• Semi-Annual Enterprise Channel (Preview): Early October 2023
• Semi-Annual Enterprise Channel, Semi-annual Extended, LTSC, and remaining channels: Mid-January 2024

Bulk deployment within a tenant will be possible.

If tenants need to keep using the classic Teams client, they can configure their Teams update policy so that UseNewTeamsClient is set to use the classic Teams client as the default.

Teams 2.1 to be Everywhere in 2024

If all goes well, it seems likely that the Teams 2.1 client will be in the majority in early 2024. Of course, the stresses of software development and the capricious nature of bugs can impact the best-laid plans. Perhaps mid-2024 is a more realistic date. Time will tell.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Microsoft 365 Tenants Should Control Teams External Access

In September 2022, I reported on how a proof of concept attack called GIFshell had exploited a weakness in the Teams external access mechanism. At the time, I recommended that organizations blunt any such attacks by restricting external access to specific known domains. When Microsoft introduced federated chat in 2019, they choose to make open access the default, meaning that users in any Microsoft 365 tenant supporting Teams could contact users in any other tenant.

I understand why Microsoft wants to encourage free and easy cross-tenant collaboration, but being totally open is a tad too far. I think organizations should restrict access to a set of known tenants where a proven need exists to allow federated chat (Figure 1). You can maintain the list in the Teams admin center or using PowerShell. In this article, I explain how to use PowerShell to find the set of domains for guest accounts known to the tenant and add those domains to the allowed list.

New Weakness Exposed

In their article, security researchers JumpSec Labs discuss how they exploit Teams external access to introduce malware into a federated chat. My reading of the situation is that the exploit depends on two weaknesses:

1. The Teams client reads security settings from the server and applies them without further checks. This weakness was first reported in October 2020 and still appears to be active. Essentially, the client asks the server for the set of policy controls applicable to the signed in user. When the server responds, an attacker can intercept the conversation and remove some of the restrictions that Teams wants the client to apply.
2. With some security controls removed, a federated chat from an attacker to a target victim can post files containing malware. Normally, federated chats don’t allow participants to post files (Figure 2) because it’s an obvious way for someone outside the tenant to upload files to the recipient’s OneDrive for Business account. By interfering with the set of policy controls transmitted by the server to the client, the attacker is able to send a file, just like participants in an internal Teams chat can.

As the JumpSec researchers point out, being able to inject malware into a Teams chat negates all the warnings that organizations have hammered into user ears to not open attachments from unknown email senders or to click on links in messages. Everything smells much safer in the context of a Teams chat, especially with a rich lashing of social engineering applied on top to make the recipient happy and content to communicate with the attacker.

Simple Solution

The researchers reported the problem to Microsoft, who deemed that that it “did not meet the bar for immediate servicing.” That’s interesting because Microsoft said the same thing about the GIFShel proof of concept.

However, the salient fact is that a simple fix exists. Don’t open your tenant up for federated chat from all and sundry. Establish and maintain a list of acceptable domains based on business necessity. Why anyone would buy into the simplistic and overly optimistic view of the world that leads to tenants opening themselves up for federated chat from any other tenant is beyond me. It’s like painting a large target on Teams users to invite attackers to engage in some social engineering to compromise accounts and potentially the Microsoft 365 tenant.

We live in a dangerous world. Don’t make it easier for attackers to function by leaving doors open. That just doesn’t make sense.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

The Joy of Collaborative Meeting Notes

Announced in preview in a Microsoft Technical Community post on June 14 with a follow up post on June 15, Teams users configured for the preview version can create collaborative notes in meetings. Only the meeting organizer must use Teams preview; other meeting participants don’t need to use the preview.

At this time, collaborative meeting notes are only available for personal meetings. Ad-hoc and channel meetings are unsupported as are 1:1 calls.

Collaboration via Loop Components

Collaborative notes are no more than a Loop component composed of three separate Loop components – an agenda, bulleted list, and task list like those available for use in Teams chat. The Teams desktop and browser clients support collaborative meeting notes, but Teams mobile doesn’t yet,

Like Loop components used in chat, you’ll find the components used for collaborative meeting notes in the meeting organizer’s OneDrive for Business account rather than Syntex Repository Services, as used by the Loop app. To make the component available, Teams shares the file with all meeting participants. Like other Loop components, guest accounts and other external participants can’t access collaborative meeting notes. They can participate in the meeting, but someone will have to share meeting notes in a different format afterward. For instance, by copying content from the component and pasting it into Word.

Basic Flow of Collaboration

The basic idea is that when you create a Teams meeting, you select the “add an agenda others can offer” under the regular message body (Figure 1).

This action causes Teams to create the Loop component and insert it into the meeting. You can edit the content to set things up for the meeting. For instance, use the agenda component to list the topics for discussion. During the meeting, the component is editable by any meeting participant (except guests) through the Notes tab (Figure 2), and it’s a great way to keep track of commitments made and assigned tasks.

One thing I don’t like is that I can’t have the Chat and Notes tabs visible at the same time. It would be nice to be able to copy text created in chat and use it within meeting notes.

After the meeting, any participant can edit the meeting notes to add new items or clarify content (Figure 3).

The task list component supports the ability to open its tasks in Planner (Figure 4). This might be an easier way to manage a complex set of tasks, but be aware that some of the information entered for tasks in Planner doesn’t synchronize back to the task list.

You can also access assigned tasks through the Tasks by Planner and To Do app (Figure 5). When you receive a task in a meeting task list, To Do picks up it and includes the task in the list it surfaces in the app. However, even if you’re the meeting organizer, you can’t see the tasks assigned to other meeting participants. The Tasks by Planner and To Do app doesn’t have the ability to read the full task list for a meeting.

Another way to tidy up collaborative meeting notes is to open the Loop component in the Microsoft 365 app in a browser (Figure 6). To do this, click on the Loop component title in the meeting details or use the copy component option to create a link to the component that you can paste into the browser.

Good Feature for Internal Meetings

Overall, collaborative meeting notes is a good implementation of how nested Loop components combine together to deliver a useful tool. Being based on Loop components, meeting notes inherit the advantages and disadvantages of the technology. Being able to take the component and use it elsewhere (like the Loop app or pasted into Outlook for wider distribution) is very nice. Not being able to collaborate with external users isn’t so thrilling. The bottom line is that this feature should be popular for internal meetings but if you work in an organization that places heavy emphasis on external collaboration, it won’t be valuable until Microsoft enables external sharing for Loop components.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Targeted Release for Office 365

Targeted release is the mechanism used by Microsoft to make new features available to tenants a short time (normally four to six weeks) before general deployment (standard availability begins). Tenants can choose to use targeted release for all users or selected users via Release preferences under Org settings in the Microsoft 365 admin center (Figure 1).

On May 25, Microsoft announced that Teams will support targeted release for Microsoft 365 tenants. This step aligns Teams with the other major Microsoft 365 workloads which support targeted release (SharePoint Online and Exchange Online). The change applies to commercial cloud clients only. Tenants in other clouds, like GCC, will have to wait to see if Microsoft brings the change to their clouds.

Examples of important Teams features currently available to targeted release include the preview of the Teams 2.1 client and the new channels experience. Targeted release applies to the desktop and browser versions of the Teams clients (including Surface Hub). It has no impact on Teams mobile.

Supporting targeted release is a sensible change because the way Microsoft released Teams updates in the past was a tad chaotic in times. It’s reasonably common to see complaints surface in Twitter and the Microsoft Technical Community that an announced feature hasn’t turned up in some tenants several months after Microsoft highlights something in a blog post or a roadmap item says that a feature is rolling out.

The Teams preview program worked for some features and not others. To throw some more uncertainty into the mix, Microsoft changed the “P” (“preview”) indicator to “EA” (for early access) earlier this year, without explaining what was happening.

Early Teams in Many Forms

The kicker is that complexity still exists in the system. Microsoft says that:

Tenants wanting consistency in the availability of Teams features alongside the rest of Office 365 should use targeted release. Unless you’re only interested in new Teams features, in which case you should use the Teams preview program. Targeted release takes precedence over the Teams preview program when it comes to feature availability.

But if you want consistency between Teams and Office (Microsoft 365 apps for enterprise), use the Office Current Channel (preview).

Finally, if organizations want to live on the bleeding edge of technology to see new Teams features as early as possible, they can seek nomination to the Teams Technology Adoption Program (TAP) and experience the joys of chasing early bugs. However, Microsoft says that the Teams TAP is currently at capacity.

Given the size of Microsoft 365, different kinds of tenants, and the number of active users in the Teams installed base, it’s almost inevitable that software will appear immediately in some places and trickle out to others. Let’s hope that supporting targeted release will make Teams feature availability more predictable for all.

Teams Free Takes Over from Teams Chat

Also in the world of Teams, the Microsoft blog to announce the availability of Windows 11 Insider Build 23481 says that Windows 11 has replaced the Teams chat app with the Teams Free (aka Teams for Home) app.

This change makes perfect sense. The original Teams chat app was the first iteration of the Teams 2.1 client, albeit with very reduced functionality compared to the full client. It served its purpose as a replacement chat client, but Microsoft hardly wanted to keep it around for the long term. Every client variant creates more demand for engineering resources, so swapping in the Teams Free client is a reasonable strategy.

I doubt that many Windows users will notice the difference. The sad fact is that although Teams is successful in the corporate environment, it’s barely made a dent in the domination of apps like WhatsApp and Facebook Messenger when it comes to personal usage. Teams Free is a more functional app for Windows 11 users, but it’s hardly likely to move the needle in terms of attracting millions of new users.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Teams Animated Backgrounds Deliver a More Immerse Virtual Environment

Announced in message center notification MC578280 (9 June 2023, Microsoft 365 roadmap item 122513), Teams meeting participants can choose from a set of animated backgrounds alongside the usual set of static backgrounds (Microsoft-provided and custom). According to Microsoft, a dynamic animation delivers “a more immersive virtual environment.”

Animated backgrounds are available for the Teams Windows and Mac clients. Browser clients will have to enhance user “meeting experience with creativity and personalization” through other methods.

The background animation update is due to roll out to targeted release tenants in mid-June 2023 with public preview starting at the same time. Standard release tenants will see the code in early July with full worldwide deployment due by late July. GCC High and DoD tenants must wait until late September. Like all Teams updates, there’s no way to predict when an individual update will arrive in a specific tenant. That’s one of the joys of working with a service spanning 300 million monthly active users.

Limited Set of Teams Animated Backgrounds

Zoom is the most obvious competitor for Teams and animated backgrounds are a popular feature of that platform with many backgrounds available. For now, Teams supports a limited set of Microsoft-provided animated backgrounds, which are identified by a small video icon in the bottom left-hand corner of the thumbnail in the background gallery (Figure 1). I rather like the twinkling lights of the snowy mountain nightscape background, even if I can’t quite see any evidence of being in a more immerse virtual environment promised by Microsoft. Maybe that’s just me on a bad day…

Meeting participants apply animated backgrounds like any other background in the meeting pre-join screen or when a meeting is in progress. That is, if the meeting policy applied to their account allows the use of background images.

If things proceed like they did after the initial introduction of backgrounds for Teams meetings, two things will happen. First, Microsoft makes additional backgrounds available. Second, Microsoft allows customers to create their own custom backgrounds. I can’t say when this will happen, but given that Zoom supports custom animated backgrounds, the likelihood is that Microsoft will enable these changes fairly quickly.

Hardware Requirements for Teams Animated Backgrounds

Interestingly, Microsoft says that animated background are unavailable on “low-end devices.” Workstations need at least 8 GB RAM and a CPU with four logical processors to handle the insertion of the animated background into the outbound video feed, which seems a tad excessive. Microsoft also warns that using other video filters (like the Snapchat filters) might slow animated backgrounds if the workstation is under heavy load.

Filters for Everyone

Over the last year or so, Teams has added a range of filters to expand the possibilities available to Teams meeting participants. I consider some, like the brightness and soft-focus filters and the green-screen filter, more important than the Snapchat filters or custom video effects. You can also throw meta avatars into the video effects mix, but only if you have Teams Premium licenses.

To each their own and what I think “I’ll never use” is the most important feature for someone else. I suspect that I’ll find animated backgrounds more interesting and valuable when I create my own. Until then, we’ll just have to put up with the set of default animated backgrounds delivered by Microsoft.

Keep up to date with developments, including new Teams background filters, by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

Teams Group Policy Assignment Possible for Many More Policy Types, But Only Using PowerShell for Now

Microsoft published two recent message center posts (MC557818 on May 19, and MC557241 on May 18) that seem to cover much the same ground. In a nutshell, tenants that use Teams group policy assignments to set policies based on group membership rather than individual assignments on a per-account basis now have access to a wider set of policies. The caveat is that you must create and manage group assignments for many policies using the Teams PowerShell module (currently at version 5.2).

Support in PowerShell is available now. Given usual practice, it shouldn’t be too long before Microsoft updates the Teams admin center to accommodate the new functionality.

Teams Group Policy Assignments

The Teams admin center supports group assignments for popular policies like the calling policy, call park policy, teams policy, live events policy, meeting policy, and messaging policy. You know when the Teams admin center supports group-based assignment if you see a tab for this purpose when working with a policy. Figure 1 shows that four group assignments are active for messaging policies.

To process group-based assignments, Teams uses a background process to find the members of the target group and make the assignments. During this process, Teams follows rules to ensure that directly-assigned policies take precedence over group assignments and that group assignments with higher priority have precedence over those with lower priority. Assignments are not immediate and can take up to 24 hours to become effective.

Teams Policies Now Supported for Group Assignment

What’s changing is that Microsoft has introduced support for group-based assignments for many policies in areas like Teams Phone, Teams Premium, and Teams support for VDI,:

• Application Access Policy.
• Call Hold Policy.
• Carrier Emergency Call Routing Policy.
• Cortana Policy.
• Dial Out Policy.
• Education Assignments App Policy.
• Emergency Calling Policy.
• Enhanced Encryption Policy.
• Events Policy.
• External Access Policy.
• Feedback Policy.
• Files Policy.
• IPPhone Policy.
• Media Logging Policy.
• Meeting Branding Policy.
• Meeting Template Permission Policy.
• Mobility Policy.
• Notification And Feeds Policy.
• Room Video Tele Conferencing Policy.
• Synthetic Automated Call Policy.
• Teams Branch Survivability Policy.
• Template Permission Policy.
• VDI Policy.
• Video Interop Service Policy.
• Voice Routing Policy.
• Voicemail Policy.

You can only assign these policies to groups using PowerShell. For example, this command uses the Get-MgGroup cmdlet to retrieve the group identifier for a Microsoft 365 group and uses the identifier as the target to perform a group assignment for a Teams events policy. Giving the assignment a rank of 1 means that Teams will treat this as the most important assignment and will use it unless a direct policy assignment exists for a user:

$GroupId = (Get-MgGroup -Filter "displayName eq 'All tenant member user accounts'").Id
New-CsGroupPolicyAssignment -GroupId $GroupId -PolicyType TeamsEventsPolicy -PolicyName "Webinar Organizers" -Rank 1

Policy assignments based on group membership (Microsoft 365 groups, dynamic Azure AD groups, security groups, and distribution lists) is a good idea for large tenants where clearly defined sets of user accounts share the same policy needs. It rapidly becomes boring to edit multiple accounts to make policies assignments, so if you can use a group for assignments, it’s a good idea.

Introducing Dark Mode in Teams Admin Center

When I refreshed my knowledge of how the Teams admin center deals with group-based assignments, I noted the appearance of dark mode support for the console (announced in MC567496, 2 Jun 2023). I’m not a great fan of dark mode except on mobile devices but recognize that many appreciate having the option.

If you choose to go with dark mode, make sure that any customizations applied to the tenant Microsoft 365 theme show up nicely. In my case, they didn’t, as obvious from Figure 2.

Microsoft can’t account for the color choices made by tenants when they customize their themes, so they can’t be blamed. This time!

Stay updated with developments across the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. We do the research to make sure that our readers understand the technology.

When Users Define Their Work Locations, It Helps Others to Schedule Meetings

On May 10 2023, Microsoft published a post titled “Coordination is the key to spontaneity with these features in Outlook on the web and Teams.” That’s quite a mouthful, but essentially it’s about some features Microsoft is introducing in OWA and Teams to help people know where their colleagues are working. The update for OWA to allow users to define their location during work hours started to appear in tenants on May 9. You’ll know if your tenant has the update if you see a Work hours and locations setting in the Calendar section of OWA settings (Figure 1).

I have not yet seen the updates to the OWA calendar to display locations in the scheduling assistant or to adjust the set location when reviewing a calendar event. No doubt the bytes are on their way.

Teams Update to Change or Clear Work Locations

On May 26, Microsoft followed up with message center notification MC561188 to say that the changes in Teams to allow users to set the work location for a day (Microsoft 365 roadmap item 125375) has started to roll out to targeted release tenants and Teams preview. Standard release tenants can expect to see the functionality starting in early June with full worldwide deployment complete by early August.

Once again, not all the code has shown up yet. The bits to allow users to change their work location for the current day (Figure 2) are present but work locations don’t yet appear on user profile cards alongside the other information to help schedule meetings like someone’s office and local time.

Updating your work location in Teams has no effect on the settings defined in OWA. There is no link between acting to update the work location for the current day and the set of work locations defined for a (default) week.

It’s not unusual for Microsoft 365 code updates to arrive in pieces. Being able to set a work location doesn’t depend on the user profile card and vice versa, so Microsoft can deploy the code at different times. Unless you’re expecting something to be present, you won’t notice that anything’s awry.

Restricted Work Locations

Nice as the idea of helping colleagues know where someone is when arranging meetings, the implementation is limited by the choice between two locations. You can’t add a third location, and you can’t rename the locations (for example, from “Remote” to “Home Office”). It would be nice if OWA settings supported more flexibility in managing work locations. In addition, there’s no word if Outlook desktop or Outlook mobile will support work locations.

There’s also no way for an administrator to block the work locations feature or to set it for users. Public availability of a way to set a new feature in a user’s calendar through a cmdlet like Set-MailboxCalendarConfiguration normally appears a few months after it is introduced.

Which brings me to the point that the most important way to inform co-workers about your working arrangements is to make intelligent use of the Teams status message. Update your status message daily to let people know important details about how to contact you and where you’re located and you’ll find that the work location feature is a lot less important (and useful) than it first seems. You could even exploit the pronoun support in Teams to insert a 30-character message to make people aware of your current status and use the more expansive text available in the status message for precise details of how and when you can be contacted.

Synchronization is Important

It’s good that OWA and Teams are synchronizing the introduction of new features. The unfortunate thing is that the current implementation of the work locations feature is really not all that useful. Perhaps this will change in time. Let’s hope that this happens.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

A Teams Calendar Event Without an Online Presence

In message center notification MC535261 (30 March, Microsoft 365 roadmap item 122483) Microsoft promised that Teams offline meetings would appear in late May 2023. And true to their word, the new feature has turned up on time. GCC, GCC-High and DoD tenants will see the software in early July. Offline meetings are only supported for Teams private (or personal) meetings (not channel meetings).

New feature is an overstatement. The Outlook calendar, and before that, Schedule+, have scheduled offline meetings without a hitch for nearly 30 years. An offline Teams meeting is exactly like a non-online meeting or appointment scheduled in Outlook. It’s a calendar event without any properties pointing to an associated online meeting space and all the other items used with meetings, like the chat, attendance report, and recaps. These items make an online Teams meeting what it is. You don’t need an online space to create space in your calendar for personal commitments, lunch catch-ups, or most importantly, in-person meetings, which is why Teams can now create non-online events.

Creating an Offline Teams Meeting

The default for Teams meeting continues to be online events. To create an offline Teams meeting, go ahead and create a meeting as normal and set the online meeting toggle to off (Figure 1).

This action signals to Teams that it doesn’t need to set up the online meeting space or any of the other objects associated with a meeting. In effect, the event is exactly like appointments created through Outlook. This impression is confirmed when examining the properties of a Teams offline meeting through Outlook or by using a utility program like MFCMAPI.

For in-person meetings, add the required attendees and choose a location. You can protect the meeting with a sensitivity label, which works just like it does for Outlook meetings.

To turn an offline meeting into an online meeting, switch the online meeting toggle to on and save the meeting. Teams recognizes that the event has moved online, creates the online meeting space, and updates the meeting with details of how to join the event.

Why Introduce Teams Offline Meetings Now?

Some might ask why Microsoft is adding non-online meetings to Teams nearly seven years after the product introduction. One reason might be that it’s logical to want to set aside time in calendars for events that cannot run online. The assumption that everything can be done in an online meeting is patently false and building this assumption into Teams was incorrect.

But I think that user feedback is behind the change (even if the proposal in the Teams feedback portal didn’t attract many votes). People don’t work with Outlook as heavily as they once did. They spend more time in Teams and having to switch focus to go to Outlook to schedule a personal appointment (which then shows up quite happily in the Teams calendar) is a nonsense. It just makes sense to allow the Teams calendar to schedule events that don’t happen online.

Sometimes the simplest changes have the greatest impact. This change is a simple change because it doesn’t introduce any new concepts and builds on software that’s already well-known. Even so, this is a welcome change that reduces the friction of moving between Teams and Outlook to perform a relatively simple task. And there’s goodness in that, which is something you can’t say about every update Microsoft introduces into Microsoft 365.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

New Teams Channels Experience Rolls Out in Mid-June

Announced in a Teams blog post in October 2022 and confirmed in MC550081 (May 3, 2023, Microsoft 365 roadmap item 91683), Microsoft plans to roll out a “new channels experience” for Teams in early June (commercial and GCC tenants). The UI refresh is available for both the classic and V2.1 client in desktop, browser, and mobile clients. The V2.1 implementation has some extra tweaks that aren’t in the classic client. The old channels experience will disappear from the classic client once the roll-out is complete in late June. GCC-H and DoD tenants get the refresh about a month later.

According to Microsoft, the new experience has “an intuitive design that allows teams to focus and stay on tasks, bring everyone up to speed, and actively engage in real time.” The description begs the question of if it is so intuitive, why has Microsoft taken seven years to figure out that the old UI needed improvement? That’s a rhetorical question…

What’s in the New Teams Channels Experience

To be fair, I have used the new channels UI for several months. My view is that the new UI is better than the old because it’s cleaner and easier to use. Here’s my commentary on the features listed by Microsoft in MC550081.

The compose box (“Start a new post”) relocates from the bottom to the top of the page with the most recent conversations immediately beneath (Figure 1). The original Teams UI featured a nondescript compose box that Microsoft improved in 2020 with the introduction of the New conversation button. Now they’ve decided that putting the option to create a new conversation at the top of the page is better. No doubt testing proves their assertion that “it’ll now be much easter to start a new post.”

Like a chat, users can pop out conversations to a separate window (Figure 2). In many respects, working in a channel conversation is like working in a Teams chat because the new layout to read posts in a conversation looks very much like a chat. After reading through a conversation, a Go to channel button in the top right-hand corner reveals other channel conversations. User muscle memory needs some retraining to understand the nuances of moving from reading items in an individual conversation to browsing the channel.

Microsoft mentions pinning posts, something that’s been available for conversations since 2021. I don’t know why they highlight this capability for the new channels UI except that pinned posts appear in “a streamlined information pane” along with other information like the membership of the team.

“Simplified badging” make it easier for people to understand when new unread items are present. I don’t really know what Microsoft means by simplified badging, but this might be due to ongoing exposure to the new UI. A small New badge highlights new unread messages. Teams also bolds the names of authors of unread messages in the channel list. Maybe that’s what’s meant.

Features Not Mentioned

The October 2022 blog post covers some items not mentioned in MC550081. Conversations support Viva Topics (a feature already available in chats), but I see no trace of customizable channel headers or posting video clips in conversations. Video messages are also already in chat, so it’s only a matter of time before they appear in channel conversations (hopefully, Microsoft will address the compliance issue with video messages first). While you’re waiting for video clips, you can always create a video in Stream and post it to a conversation.

The Importance of a Subject

I would have liked it if Microsoft did something to require users to provide a subject for a new conversation. I think making a subject mandatory for new conversations should be optional, perhaps through a channel setting. Highlighting the start of a new discussion with a well-chosen subject just seems like common sense to me as it makes it easier to browse a channel to find conversations of interest. Many people ignore the wisdom of including a subject for new conversations, including some who should know better, and it’s infuriating.

New Teams Channels Experience Delivers Incremental Change

The new channels experience is an improvement. Like many UI advances, it’s more of an incremental tweak than earthshattering advance. But even so, it’s still good to see the improvements arrive. If only Microsoft allowed channels to be configured with mandatory subjects…

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Payment App Targets Small Businesses

Announced in preview on May 1 2023, the Teams Payment app is now available for testing in tenants with the caveat that payments are only possible for organizations located in the United States and Canada using partner payment services provided by Stripe and PayPal (available now), and GoDaddy (coming soon).

The value proposition is simple. Teams has 300 million monthly active users with the potential to grow further as the Office 365 installed base swells past its current 382 million paid seats. Many Microsoft 365 tenants are used by small businesses. People have become accustomed to doing business via audio and video chats and meetings and Microsoft has added virtual appointments and a booking app to allow individuals to schedule online meetings with external people. Now you can add the very attractive notion of being able to request and receive payment for online consultations. Target professionals include doctors, lawyers, technical consultants, real estate professionals, and so on. Anyone who provides a paid-for service that can be delivered via a Teams appointment can use this app.

Configuring the Teams Payment App

The Teams Payments app is available in the Teams app store (Figure 1). To make it available to users in chats and meetings, make sure that the app isn’t blocked (it was in my tenant) and include it in the app setup policies that govern app availability for users. It will take a couple of hours before the updated setup policy takes effect and the app becomes available to users.

Before anyone can request or receive payments, the app must connect to a payment service. Until GoDaddy becomes available, you need either a Stripe or PayPal account for this purpose (the PayPal account must be a business rather than a personal account). We have a Stripe account to process subscriber payments for the Office 365 for IT Pros eBook bought through Gumroad.com, so Stripe was the easy option.

Connecting to a payment service involves signing into the service to validate access and establishing a link between Teams and the payment provider. Given that the three payment partners chosen by Microsoft have robust APIs and have been in the payment business for years, the connection to Stripe worked without a hitch.

Requesting Payments

To request a payment, you must add the Teams Payment app to a chat or meeting. You can then identify the person you’re asking to pay and give the reason for payment and the amount (Figure 3).

Making Payment

After sending, the payment request turns up in the target user’s activity feed (Figure 4). Like any other online payment, the payer enters details of their credit or debit card and Teams transmits the data to the service provider for processing. Assuming that the card details are approved by the service provider, the payment goes through and turns up in the payee’s account, just like it would had the payment been made via a web site.

Easy Payments

Many of the features deployed by Teams are driven by the need to deliver features requested by large enterprises. At times, it seems like Teams is becoming like Word and Excel: feature-rich but with functionality that many don’t know about or never use. In this case, the Teams Payment app is targeted at small businesses (it’s unlikely that Accenture or any of the very large Teams organizations will demand payment using the app) and that’s a good thing.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Teams Expiration Policy Removes Inactive Teams

The Groups expiration policy allows organizations to set an expiration period for Microsoft 365 groups and teams. If the groups remain in active use (based on certain Graph signals), Azure AD automatically extends their expiration date. In 2020, Microsoft reported that 79% of groups subject to the expiration policy met the bar for auto-renewal. The other 21% were either deleted by Azure AD or retained because a group owner responded to a prompt to renew. Many Microsoft 365 Groups in use today are teams-enabled and the likelihood is that most of the groups subject to the expiration policy are used with teams.

Unless administrators keep a close eye, it’s possible that Azure AD will remove an important group because the group owner failed to request renewal. For example, when a team comes within 30 days of its expiration date, owners receive notifications in their activity feed that they can use to renew the team (Figure 1).

It’s worth noting that team owners also receive notifications via email to warn about impending expiration. The messages come from msgroupsteam@microsoft.com (the bring your own domain feature for service messages doesn’t cover these emails) and arrive 30 days, 15 days, and one day before Azure AD removes the group. It’s possible for team owners to overlook these messages if they don’t use email.

A New Insight for Teams Administrators

All of which brings me to Microsoft 365 message center notification MC542836, posted on April 17. The announcement covers changes to the Teams admin center (TAC) to give administrators more visibility into the set of teams approaching expiration and the teams already deleted.

To see teams approaching expiration, apply a filter to the set of teams to look for teams expiring in the next 7, 14, or 30 days (Figure 2).

After TAC applies the filter to the set of teams, you can renew selected teams (Figure 3). The expiration date for a renewed teams is set at today plus the expiration period set in the policy. My tenant uses a two-year (730 day) expiration period, which I think is a good compromise between keeping inactive groups forever and expiring groups too soon.

Restoring Deleted Teams

It’s not a disaster when Azure AD removes an expired group because it’s easy to list and restore deleted groups using the Microsoft Entra admin center or PowerShell. However, if an administrator doesn’t restore a deleted group before the 30-day deletion period lapses, Azure AD permanently removes the group and all its connected resources. Monitoring the set of soon-to-be deleted groups is therefore sensible, perhaps using a PowerShell script to report groups and their expiration status.

To make management of deleted teams easier, the second extension to TAC is the addition of an option to View deleted teams to the Actions menu. The Deleted groups option in the Entra admin center lists all kinds of deleted groups while TAC restricts the set of deleted groups it displays to team-enabled groups. A shown in Figure 4, you can select and restore a deleted team at any time during its 30-day deletion retention period.

No Magic in New Options

There’s no magic behind the two new TAC options. Microsoft has taken options available elsewhere and adapted them to work solely with teams. There’s nothing wrong with that approach as it makes sense to provide the functionality to renew and restore teams in the tools people use. And anyway, if you don’t like performing these actions in a GUI, there’s always PowerShell.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Use Inbound and Outbound Shared User Profiles to Reveal the Ins and Outs of Membership in Teams Shared Channels

In August 2022, I discussed how to use the Get-AssociatedTeam cmdlet to report the membership of channels in teams for users within a tenant. It’s a useful cmdlet that includes the ability to report membership of shared channels in other tenants. In most cases, the reports that can be generated from the data returned by the Get-AssociatedTeam cmdlet meet the needs of administrators to know what channels users access.

Microsoft 365 often offers multiple ways to report data. In this instance, Azure AD supports shared user profile resources created for use with Azure AD B2B Direct Connect, the underlying cross-tenant access mechanism for shared channels.

• An inbound shared user profile represents an Azure AD user from an external Azure AD tenant whose profile data is shared with your tenant. The profile data is used by applications like Teams to display information about the inbound user in shared channels.
• Conversely, an outbound shared user profile represents Azure AD users from your tenant who share their profile information when they access resources in other Azure AD tenants.

Essentially, when a shared channel owner invites an external user to become a member of the channel and that user confirms their acceptance, Azure AD creates an inbound shared user profile to note this fact. Azure AD creates an outbound shared user profile when a user from your tenant becomes a member of a shared channel hosted by another tenant. For example, Figure 1 shows the membership of a Teams shared channel. The users marked with (External) have inbound shared user profiles.

Using PowerShell to Report Shared User Profiles

The Microsoft Graph PowerShell SDK contains cmdlets to fetch information about unbound and outbound user profiles. With consent for the CrossTenantUserProfileSharing.Read.All permission, you can connect to the Graph and run these commands:

Connect-MgGraph -Scopes CrossTenantUserProfileSharing.Read.All
Select-MgProfile beta
Get-MgDirectoryOutboundSharedUserProfile

UserId
------
08dda855-5dc3-4fdc-8458-cbc494a5a774
5b52fba5-349e-4624-88cd-d790883fe4c4
a221d10f-e0cf-4a1d-b6a2-4e844670f118
cad05ccf-a359-4ac7-89e0-1e33bf37579e
eff4cd58-1bb8-4899-94de-795f656b4a18

The output is a list of identifiers for Azure AD user accounts, so it’s not very exciting. IApart from not listing account names, the output doesn’t tell us what outbound tenants are accessed. To get that information, we must run the Get-MgDirectoryOutboundSharedUserProfileTenant cmdlet for each account. The output of that cmdlet is a list of tenant identifiers, which we can resolve to discover the tenant name. Here’s the code:

[array]$Users =  Get-MgDirectoryOutboundSharedUserProfile | Select-Object -ExpandProperty UserId
ForEach ($User in $Users) {
   $UserData = Get-MgUser -UserId $User
   [array]$TenantNames = $Null; $TenantDisplayNames = $Null
   [array]$TenantIds = Get-MgDirectoryOutboundSharedUserProfileTenant -OutboundSharedUserProfileUserId $User | Select-Object -ExpandProperty TenantId
   If ($TenantIds) {
       ForEach ($TenantId in $TenantIds) {
         $Uri = ("https://graph.microsoft.com/beta/tenantRelationships/findTenantInformationByTenantId(tenantId='{0}')" -f $TenantId.ToString())
         $ExternalTenantData = Invoke-MgGraphRequest -Uri $Uri -Method Get  
         $TenantNames += $ExternalTenantData.DisplayName
       }
       $TenantDisplayNames = $TenantNames -join ", "    
   }
   Write-Host ("User {0} has outbound shared profiles in these tenants {1}" -f $UserData.DisplayName, $TenantDisplayNames)
}

User Sean Landy has outbound shared profiles in these tenants o365maestro
User Ken Bowers has outbound shared profiles in these tenants o365maestro
User Tony Redmond has outbound shared profiles in these tenants o365maestro, Microsoft Community & Event Tenant

Getting Inbound Shared User Profiles

The Get-MgDirectoryinboundSharedUserProfile cmdlet lists information stored about inbound shared user profiles. We can’t read Azure AD to find information about these users because they come from other tenants. This is what the cmdlet returns:

Get-MgDirectoryinboundSharedUserProfile | Format-List

DisplayName          : Alex Wilber
HomeTenantId         : 22e90715-3da6-4a78-9ec6-b3282389492b
UserId               : a6453657-2058-4c15-a38a-b0a94f0ed737
UserPrincipalName    : AlexW@o365maestro.onmicrosoft.com
AdditionalProperties : {}

Once again, we can resolve the tenant identifier to make the information more understandable:

[array]$Guests = Get-MgDirectoryinboundSharedUserProfile
ForEach ($Guest in $Guests) {
    $Uri = ("https://graph.microsoft.com/beta/tenantRelationships/findTenantInformationByTenantId(tenantId='{0}')" -f $Guest.HomeTenantId.ToString())
    $ExternalTenantData = Invoke-MgGraphRequest -Uri $Uri -Method Get  
    Write-Host ("User {0} comes from tenant {1}" -f $Guest.DisplayName,  $ExternalTenantData.DisplayName)
}

User Christina Smith comes from tenant CM Portal Solutions
User Nicolas Blood comes from tenant NBConsult
User Alex Wilber comes from tenant o365maestro
User Tom Jones comes from tenant o365maestro
User Vlad Bitton comes from tenant vNext Solutions

The interesting thing here is that I didn’t recognize some of the user names and tenants that Azure AD stored inbound shared user profiles for. However, given that the names were all MVPs and my tenant supported many beta versions of Teams shared channels in the past, it’s entirely possible that the profiles originated in a test. Azure AD doesn’t register a date to tell you when it created a profile, so there’s no clue from that source.

Tracking External Access to Teams Shared Channels

My previous article describes how to create a report about the users accessing shared channels in your tenant. The added piece of information covered here is finding the set of Azure AD accounts from your tenant who use Azure AD B2B Connect to access resources in other tenants. That’s a valuable nugget if you want to track who’s interacting with Teams shared channels externally.

Auto-generation of Captions for Teams Video Messages

In September 2022, Microsoft announced the ability to send video messages in Teams chat. Released in November 2022, the feature allows users to send video clips up to one minute long to participants in Teams private or group chats, if the Teams messaging policy assigned to their accounts allows video messages.

Sometimes it’s hard to listen to video messages and understand fully what the sender says. Microsoft addresses that problem in an update to add support for auto-generated captions that can be read by message recipients with the sound turned on or off. The availability of captions makes it possible to read a video message in a crowded space where you don’t want to turn the device volume up to hear the audio.

According to message center notification MC534735 (last updated March 31, 2023), users in targeted release tenants have started to receive the feature while deployment to standard release tenants will start in mid-April and complete by the end of the month.

Microsoft doesn’t say what languages are available for video message transcripts. Given that meeting transcription is available in 34 languages, I imagine that the same applies.

Caption Auto-Generation

It’s likely that the same process that generates live captions for Teams meetings is employed to generate the captions for video clips. Generation occurs when the sender sends the video message. At that point, Teams uploads the video file to an online repository where the captions are generated.

Figure 1 shows a video messages with captions displayed (enabled with the CC or closed captioning button). Recipients can play video messages in line within the chat or can expand to full screen, which uses what appears to be a version of the Stream video player with minimal playback options (quality, speed, forward/back 10 seconds, turn audio off, etc.).

Caption Transcript File

Captions form the basis for transcript generation in Teams meetings and for other videos stored in Stream. Each caption is text generated for a timecoded part of a video or audio file. Only the sender of the video message can download the transcript (Figure 2).

The result is a file called MicrosoftTeams-transcript.vtt. VTT or WebVTT is a Video Text Tracks file and is a common format used for video subtitling. You can use a text editor like Notepad to open and view the contents of a VTT file like the one shown below.

WEBVTT

00:00:00.340 --> 00:00:03.539

The review for the Office 365 for IT

00:00:03.540 --> 00:00:07.359

Pros 2024 Edition

00:00:07.360 --> 00:00:10.799

will take place on the 27th of April

00:00:10.800 --> 00:00:12.210

and I hope you can be there

Downloading a Video Message

Speaking of downloads, Teams doesn’t offer users the option to download a video clip. It’s possible to do this, but only by using developer tools. In summary:

• Press F12 to open developer tools in the browser.
• Select the Network tab.
• Open the chat where the video message is and play it.
• In the Name section of developer tools, look for 0 (zero) and then look at the Headers tab. You should find a Request URL there that points to the location where Teams fetches the video from (Figure 3). Copy this value to Notepad or your favorite text editor.
• In the editor, select the /dash_video_orginal/videoSegment/0 part of the URL and replace it with /video
• The result should be a URL like https://eu-prod.asyncgw.teams.microsoft.com/v1/objects/0-neu-d1-c4457fef4c67a75fe3c0732e0aceb538/views/video.
• Paste this into a browser tab to download the video message (MP4 file).

Video Messages and Compliance

When I wrote about Teams video messages in September 2022, I pointed out that it’s difficult for compliance investigators to find information in video messages. I had hoped that the advent of transcripts for video messages would close the compliance gap and make it easier to find video messages based on the information captured in the transcript. Alas, this is not so. All my attempts to find video messages by inputting transcript contents into content searches failed. That’s a real pity.

Good Upgrade but Compliance is a Real Miss

Adding transcripts to video messages in Teams chat is a nice upgrade. It would be even nicer if Microsoft addressed the compliance issue as the inability to search for video content (now available in the transcripts) is more than enough to stop some organizations using this facility.

Make sure that you’re not surprised about changes that appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Make Yourself Silly with Snapchat Lenses in Teams Meetings

Yesterday, I wrote about the profanity filter for Teams meetings, which is something that most business could see value in. Today, we have the arrival of Snapchat Lenses for Teams meetings, which is something that I think might spark a different reaction. Microsoft’s announcement calls for people to “let their silly side shine” and notes that “Snapchat Lenses are a witty and lighthearted addition to the world’s leading communication platform.” I think I prefer mesh avatars. According to Microsoft, Snapchat Lenses for Teams is rolling out and should be deployed to all commercial tenants by the end of April 2023.

Snapchat Lenses are available in the Teams desktop client for Windows and Mac. They are unavailable in the browser (including PWA) or mobile clients.

The Teams Snapchat Lenses App

Using Snapchat filters in Teams meetings is not new. The technique was first explored in early 2020 when people used the Snap camera in meetings (Snap camera is now discontinued). What’s different now is that Microsoft includes a third-party Teams app called Snapchat Lenses (Figure 1) in the set of apps published to tenants.

By default, the app is allowed (enabled). If an organization doesn’t want people using Snapchat Lenses in Teams meetings, all they need to do is disable the app by moving the toggle to the Blocked position. Further control over the app (for instance, to make it available to a limited set of people) with app permission policies. Oddly, Microsoft chose to make the app available to commercial clients only and hasn’t included it in Teams for Education. There’s no indication whether the feature will be available in the GCC, GCC-High, or DoD tenants.

Consent Required

Using a Snapchat lens follows the same process as adding other effects to a meeting participant’s video feed. You can choose the lens before joining a meeting or during a meeting and enjoy the effect in preview before sharing it with others. The Snapchat Lenses are listed under a tab in the video effects section of video settings.

Like the video effects introduced by Microsoft in January 2023, a user must grant explicit consent to allow the Snapchat Lenses app to amend their video feed (Figure 2). This is an example of Teams resource specific consent (RSC) in action where an app receives consent to amend some but not all of the resources available to a user.

Once the app receives consent, the meeting participant can download and use any of the available lenses (24 at present). Lenses can combine with other effects, such as a background image or one of the styles or frames provided by Microsoft.

During a boring meeting, participants can wile away the minutes by experimenting with different lenses before settling on just the right one to make the best possible impression on their colleagues (Figure 3).

The Snapchat Lenses app is not available in the preview version of the Teams 2.1 client. It’s a good example of the kind of feature that isn’t needed to test new software that will be added before the client becomes generally available. The lack of the silly lenses might just be a reason to prefer the Teams 2.1 client, but I shall leave it to you to make your mind up on that subject.

Some in the Teams Community Will Relish Snapchat Lenses

In an example of the strange but backed up by a report statistics beloved by Microsoft, they assert that “video calls make up 78% of positive memories in meetings.” Whether having a giant mushroom perched on my head will enable me to create more positive memories in meetings is a research topic that remains to be explored. I have my doubts.

With over 280 million monthly active users, there’s enough room in the Teams user community for features like Snapshot Lenses. It’s not my style and I doubt that I shall ever use these effects after this brief experiment, but then again, I doubt that I am in the target group Microsoft is going after in the ongoing battle to match features already available in Zoom.

Make sure that you’re not surprised about changes that appear inside Office 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.

Teams Profanity Filter Looks for Obscene or Profane Words

When I read message center notification MC537415 (5 Apr 2023, Microsoft 365 roadmap item 113412) about the “newly introduced toggle to turn on/off profanity filtering in live captions” in Teams settings (Figure 1), I wondered about how much usage this feature will get. I can imagine that it will be popular and useful in education settings (hopefully, those running the meetings will take control if profanities abound), but the corporate world is slightly more robust.

Deployment of the profanity toggle started to targeted release tenants in early April. After completing this phase, standard release tenants will see the feature in early May. Full deployment to commercial and GCC tenants should be complete by mid-May. GCC High and DoD tenants should see it in mid-July.

Filter Inserts Masks for Bad Words

The profanity toggle controls whether Teams inserts ***** masks when the transcription of a meeting to generate live captions detects that a spoken word is profane (Figure 2). In this respect, I believe that Teams looks for words deemed to be vulgar or obscene rather than irrelevant or unsanctified.

Some corporate executives I have direct experience of, including some at Microsoft, were prone to dropping a few f-bombs during meetings to emphasize a point or stress just how they felt about a discussion. This is the kind of behavior that I think Teams will seek to filter out.

If you don’t turn the toggle on, you see every word Teams generates for a caption. This is the default, so you need to turn the toggle on if you think that you’re in danger of being offended by seeing a profane caption. Of course, if you’re listening to the meeting, you’ll hear the objectionable term in its full glory because Teams doesn’t filter the audio feed.

Factors Affecting Detection

Another thing to consider is that the generation of live captions depends on the transcription engine being able to recognize words. When seeking to identify profanities, the engine must first recognize the word and then determine it to be profane. Quite how this process will deal with local accents, argots, and slang remains to be seen. My experience when testing the Teams profanity filter was that it detected some words and ignored others. Your mileage might vary depending on the clarity of enunciation by meeting participants and quality of microphones. A whispered expletive is unlikely to be picked up by live captions.

A further challenge exists for live translated captions (one of the four features moved to Teams premium in January 2023). I do not know how effective the profanity filter will be in a meeting where participant contributions are in multiple languages or if the filter will be able to handle concurrent translation of profanities from multiple languages. That would be an interesting test to run.

Improvements for Live Captions

MC538737 (April 8) notes that users will be able to choose colors, height, position (left or bottom) and font size for live captions. There’s no facility to highlight profanities in a different color. This update will roll out in mid-May 2023.

Personal Choice

Opting to use the Teams profanity filter is very much a personal choice. Some won’t care at all if someone’s contribution is on the edge while others will be very offended at terms that some consider unremarkable. There’s no way to set the control programmatically with PowerShell or the Graph that I can see to allow administrators to enable the filter for users. Maybe it’s best to leave this option for individuals to make up their own mind.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Anyone Enabled for Teams Preview Can Test New Teams Client

March 27 marked a big day for Teams with the release into public preview of the Teams 2.1 client (code name Emblem) and mesh avatars for Teams (MC533652). The new client doesn’t support avatars at this point. You’ll have to run the Teams “classic” client to test out avatars in Teams meetings.

Teams 2.1 is a major advance because it is the first major end-to-end overhaul of the original client architecture introduced in 2016. Compared to the Teams of today, the original version supported very few features. Over the last six years, the Teams client swelled to accommodate major swathes of new functionality such as guest user access, shared channels, the Teams Phone system, radical improvements to Teams meetings like breakout rooms and webinars, thousands of first- and third-party apps, and expansions to the basic apps that constitute the Teams client like the Files channel tab (the window into SharePoint Online) and most recently, the Files app.

For now, you must use an Azure AD account with the Teams 2.1 client (including connecting as a guest to another tenant). Support for Microsoft Services Accounts (MSA), like outlook.com accounts, won’t be available until at an indeterminate time later this year.

Moving on from Electron

The Teams development group dedicates lots of effort to keeping Teams performance at an acceptable level and restricting the amount of memory demanded by the client. At best, tweaking kept pace with the demands made for additional resources by new features. At worst, the Teams client was a fat pig with poor performance, questionable reliability, and an insatiable demand for battery life. Even though Microsoft reports 280 million monthly active users for Teams, the Teams desktop wasn’t a client that anyone looked forward to running.

Changing software used by so many people is quite a task. Doing so while demand steadily grows and engineers continually add new features is doubly difficult. The first glimmer of what was going on came in the Teams chat client in Windows 11 (the 2.0 client) where the Edge WebView2 component and React gave a way forward from the original Electron-based foundation.

The Performance and Resources Question

Microsoft has been preparing for the debut of the new Teams clients for several months with limited availability to customers and MVPs through the Technology Adoption Program. I’ve been lucky enough to use the new client for quite a while and can attest to the claims of better all-round performance, especially when starting up and switching between tenants. Speaking of which, as someone who “lives” in multiple tenants, I really like the ability to be signed into multiple organizations and receive notifications for whatever happens in those tenants. The days of firing up multiple private browser sessions to run Teams in different tenants are finally gone.

In fact, switching between anything in Teams 2.1 (like chat to chat or channel to channel) is faster. Microsoft says that the average user (who’s that?) switches (presumably between different Teams components) 10,000 times monthly. In that context, creating a fast and seamless transition from one component to another is very important. Attention has also been paid to improved scrolling, something that you might not consider important until the need arises to scroll back several months in a chat to find a relevant message.

Microsoft says that the new app launches “up to” 2x faster (and joins meetings faster too) and uses up to 50% less memory. Your mileage will vary depending on what features you use in Teams, if you switch tenants, use of video in meetings, the apps you use, and so on. Figure 2 captures an example of the demand created by the Teams 2.1 client on a PC. Note the influence of WebView2!

My totally unscientific impression is that Teams 2.1 uses less memory on a consistent basis over a day’s work, but there are times when it peaks with a higher demand than the original client does. In practical terms, I suspect that the snappiness of the new client will make many forgive some minor sins of excessive demand – and remember, the new client is preview software that Microsoft is continually tuning to make it work better.

Using the New Teams

The preview is only available to commercial tenants. Switching over to the new Teams is via a toggle displayed in the top left-hand corner of the classic client. To expose the toggle, create and publish (or edit) an update policy to whatever accounts you want to access the new clients to allow them to use public preview and choose to use the new client (Figure 3). Classic clients must run version 1.6.00.4472 or later of the Windows desktop for the toggle to appear. Microsoft hasn’t released a macOS version of the preview client yet.

More about using the Teams update policy are in this article. Users can reset the toggle to switch back to the old client as they wish. The same data is available in both. To compare features and functionality on the same PC, you can run the new client alongside the classic app (in either a browser session or as a PWA).

Microsoft says that users “will likely encounter some gaps” as they use the preview. For instance, the work to implement breakout rooms for meetings is incomplete and developers of third-party apps will need to test their apps against the new client. Some minor glitches are also likely. For instance, the name I gave to the Yammer (now Viva Engage) communities app when I customized the app properties doesn’t display nicely in the app bar (visible in Figure 1). Overall, the preview is in good shape and very usable, especially for core Teams activities.

Microsoft isn’t saying when Teams 2.1 might reach general availability. A lot of work still needs to be done to fill in the gaps where functionality available in the classic client doesn’t work in 2.1 or is buggy. Microsoft is also not saying when end of life might happen for the Teams classic client. Given that Microsoft updates Teams clients automatically about once a month that time might occur a couple of months after the 2.1 client becomes generally available.

Nicer Looking and Better Performing

The size of the Teams user base makes the new Teams client an important event. However, even though it’s taken a long time for the new client to appear, this isn’t a strategic advance like the announcement of Microsoft 365 Copilot or the arrival of the Loop app in preview.

The new Teams app is a large but incremental step forward. The snappiness of the client and the visual overhaul that makes it feel more like a well-rounded Windows app instead of something that might have been built with Visual Basic makes Teams 2.1 a nicer place to work. I’ve enjoyed using the new client. I suspect that you will too.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

New Teams Files App Part of Overall Refresh of Teams Client UI

By now, just about everyone in the Microsoft 365 technical community knows that a new version of the Teams desktop and browser client is on its way. What’s not so obvious is that Microsoft is making parts of the new UI available for the original client. At the Ignite 2022 conference, Microsoft made a host of commitments about upgrades for Teams, one of which was a new “reimagined” channels experience. Another change is a refreshed Files app. According to the Microsoft 365 roadmap, both changes should come in April 2023.

New Teams Channel Experience

Microsoft says that the new channels experience includes:

• Moving the message compose box to the top of the page. Microsoft has tweaked the message compose box since launching Teams in 2016 but always left it at the bottom of the list of posts.
• Listing recent posts in descending date order under the message compose box. This highlights the newest conversations in the channel.
• Instead of always using a list of conversations, users can switch to a conversation view where only the messages in the thread are visible. They can also pop out a conversation to a separate window (or pop several conversations out into individual windows if they want).
• Inclusion of new types of post to join regular conversations and announcements. Microsoft specifically called out a video clip kind of post, which might be similar to the way Storyline video clips work.

Five months later, the new channels experience is still unavailable. However, Microsoft 365 roadmap item 91683 says that roll-out should begin next month.

New Teams Files App

Message center notification MC528955 (March 16, Microsoft 365 roadmap item 97677) announces that the preview roll-out of the new Files app will complete by the end of the month with availability for standard release tenants in April. GCC and DoD tenants receive the new app in May and June respectively.

I’ve never been a fan of the Teams Files app (Figure 1). It always seemed to be a half-finished add-on to enable access to files stored in Teams (like those stored in SharePoint sites connected to teams), the Downloads folder, and other cloud storage systems like Box and ShareFile. My personal working preference centered around Windows Explorer and the browser interfaces for SharePoint Online and OneDrive for Business, so I never saw the need to use the Files app.

The most notable change to the Files app is the Home option to access recent files (Figure 2). This replaces the Recent option in the earlier version and is consistent with the usage in the OneDrive for Business interface, as is the My Files and Shared options (show all files shared by you or with you across Microsoft 365). The Downloads folder is listed as locating files downloaded from Teams to your computer. The folder this points to is the regular Downloads folder but when you view its contents, the files shown are those explicitly downloaded from Teams.

The location for each file is shown underneath and is clickable. It’s a nice way to move directly to the location holding the file to work with it there. In addition, the quick access option lists recent teams that you’ve used together with the opportunity to pin selected teams to the list so that they’re not removed when you use another team.

Coming Soon to Teams Near You

There’s nothing you need to do to enable the new Teams Files app. Microsoft will deploy the software automatically during client refreshes.

The argument for including something like the Files app in Teams is that having access to your files through Teams avoids the context-switch necessary to move to Windows Explorer or a browser. Personally, I’ve never had any issue in switching between interfaces, but I can see that some might find it easier to have everything together.

Overall, the new Files app is a nice overhaul that probably won’t make a huge difference. I think that the new channels UI is a more important improvement. We’ll just have to be a little more patient and wait for it to arrive.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Teams Green Screen Effect Uses Fewer System Resources for Crisper Images

Microsoft Teams has steadily added to the set of background effects available in Teams meetings since the introduction of the original blur filter in 2018. Video filters and effects is an area where Microsoft dedicates engineering effort to remain competitive with Zoom and other offerings. In my own case, although the brightness filter lifts my weary face, mostly, I use standard background images (sometimes grabbed from the Bing daily image). The next big step change comes in May 2023 when Microsoft is scheduled to release mesh avatars for Teams meetings. Between avatars and regular video feeds (enhanced with images and filters or not), Teams users have many ways to customize and enhance their virtual presence

All of which means that some might wonder why Microsoft is bringing a green screen effect to Teams meetings. Announced in MC529415 (March 17, 2023) and Microsoft 365 roadmap item 117941, Microsoft says that the green screen filter will provide “an enhanced virtual background effect.” Preview will begin in late March with deployment to commercial and GCC tenants slated for the latter part of April.

The green screen effect works on Windows and macOS clients with Intel CPUs and doesn’t support the Mac M1 and M2 chips. This is because the green screen effect uses Advanced Vector Extension (AVX) extensions like the background blur effect does. The fact that when using the green screen, Teams automatically disables background blue (and together mode) supports this assertion. The green screen works with background images and meeting presenter modes like Reporter and Side-by-Side.

About Green Screens

Adobe has a useful explanation about the purpose of a green screen. The screen doesn’t have to be green, but green doesn’t “match any natural skin tone or hair colour, so it’s easy to remove without grabbing parts of the person in the foreground. But if you’re trying to match a lower-light background or you need to have a green prop in your project, a blue screen works best.”

Microsoft says that using the green screen in Teams meetings “improves the sharpness and definition of the virtual background effect around your face, head, ears, and hair. It also allows you to show a prop or other object in your hand to be more visible to other participants in a call.”

Setting a Backdrop Color

The requirement to use the green screen effect is that the meeting participant has a solid color screen or a “clean” background wall behind them. Clean means that it’s a one-color wall without too many imperfections or objects on the wall.

To apply the green screen effect, the user enables the effect in the Devices section of Teams settings. I have a plain wall behind my desk, so I opted to try it there (Figure 1). Notice how Teams asks the user to select the “backdrop” color of the screen by clicking the dropper on a representative part of the wall.

Two problems are immediately apparent. First, there’s shadow on the left-hand side of the wall behind me. Second, two objects are hanging on the wall. Removing the objects and making sure that the selected wall is free from shade and other influences that cause its color to be non-uniform is the best way to get good results from the green screen.

Proper backdrops for use with green screens are not expensive (here’s an example sold by Amazon). Using a backdrop instead of a wall creates much better video output and avoids the imperfections I reveal below. The lesson is clear: if you want to look good when using the Teams green screen, invest in a proper backdrop.

Using the Green Screen

Using the green screen in a meeting is like choosing any of the other video effects. Select more from the toolbar, then Video effects, and then toggle the Green screen button. Figure 2 shows how the green screen works with the background image and backdrop I selected. You can see that the resulting video feed is imperfect because the wall is not uniform (the effect of the shade on the wall is very apparent). You can also see that the two objects hanging on the wall show through because they don’t match the color chosen for the backdrop. I guess that the top of my hair might match the chosen color!

These remarks are not to denigrate how the Teams green screen works. Instead, they undermine the necessity of choosing a uniform wall to be the backdrop. For comparison, Figure 3 shows the effect of using a regular background image where the video feed removes everything but the presenter’s image.

Fewer System Resources Consumed

According to Microsoft 365 roadmap item 117941, “green screen provides the best virtual background effect, consuming fewer system resources, allowing your Teams to run smoother.” The assertion that the green screen effect is less demanding on the system might seem surprising, but it makes sense when you think about it. When you apply a background image, the processor must scan everything captured by the camera to isolate the person’s image and superimpose it on top of the background image. Using a green screen means that the processor knows to drop everything of a certain color and display what’s left on top of the background image, so the processing is simpler. At least, it seems that way to me.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Spatial Audio and Howling Detection Sound Interesting

Updated 13 April 2023

I’m no audiophile but I am interested in the changes in Microsoft Teams meetings to make the sound better for participants. Take the splendidly-named “ultrasound howling detection” feature (MC514081, February 10, Microsoft 365 roadmap item 92391) available for Windows and Mac desktop clients. In a nutshell, if multiple people (each with their own workstation) are in a physical room join a meeting, Teams allows the first person to join as normal and then advises the others that someone using a Teams device is nearby and is already in the meeting with an audio feed. To avoid a feedback loop (echo), Teams mutes the microphones and speakers of those users. If the muted participants want to, they can unmute their microphones and speakers (maybe after connecting headsets) or listen to the existing audio.

It’s a neat feature that is rolling out to commercial and GCC tenants. GCC-High and DoD tenants will see it in May.

Spatial Audio

Another interesting idea is spatial audio in Teams meetings (Microsoft 365 roadmap item 107783). According to Sonos, spatial audio “is an immersive, three-dimensional listening experience. Using multiple channels projecting outwards from each speaker, it can place individual sounds (or “objects”) with greater precision and variety than traditional stereo sound.” Sounds good.

Although the feature is still a while away (according to MC540153, targeted release clients should see it at the end of April 2023 with roll-out to standard release tenants due to finish by mid-June), Microsoft has published some documentation to put the feature into context. When users enable spatial audio for a Teams meeting, users will “hear their [other meeting participants] voices coming from their relative positions on the meeting screen.”

Conferencing provider Bluejeans figure that spatial audio helps participants minimize meeting fatigue, an assertion backed up by Forbes. The problem with claims like this is that they are highly subjective. I suspect that individuals will find different levels of benefits depending on the type, length, and content of meetings you attend. Plus the ability of people in the meeting to keep it interesting and worthwhile. If things get too boring, it might be possible to turn on an avatar (due to be available in May 2023) and tune out for a while.

To make the magic happen, you enable spatial audio before a meeting through the Devices section of Teams settings (Figure 1). Alternatively, you can enable it for a suitable device during a meeting.

You can opt for spatial audio only if the selected device meets the requirements of being USB-wired stereo headphones or speakers or the workstation’s built-in stereo speakers. Stereo (to highlight audio from individual speakers) and not Bluetooth are the key words here. It’s kind of disappointing that I can’t use my Microsoft Surface 2 headphones.

Meetings must run in gallery view rather than together mode. The reason here is that the feature attempts to figure out the relative position of the speaker from you and that isn’t possible when participants are framed in a special view. Another thing to pay attention to is that spatial audio consumes system resources. Teams will throttle back on spatial audio if it detects that the system comes under strain. Throttling is automatic and you can’t control it. The same is true for other features (like noise suppression) that process video or audio feeds for Teams meetings.

Making Better Meetings

There’s no guarantee that either feature will create better Teams meetings. Even spatial audio won’t improve what people say, but they will sound clearer and more distinct which can’t be a bad thing. That is, unless you do want to drift off to sleep..

Keep up to date with developments like Teams meeting enhancements by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

People Insights from LinkedIn and Viva Insights Appear

Following up last week’s news about the ability to add pronouns to the user profile card, the change announced in message center notification MC521886 (1 March) to bring insights about people to profile cards displayed in Teams is rolling out. This is Microsoft 365 roadmap item 116006. Microsoft expects to finish the deployment worldwide by the end of March.

Teams has been able to display information about LinkedIn contacts in user profile cards for a year or so. What’s changing is that instead of the basic information about someone such as their current job, experience, skills, and education, you now see “insights” about a person such as a notice when their birthday arrives (Figure 1).

Reaching Out to Your Contact

As this is the Teams version of the profile card, it should come as no surprise that you can send a chat message to your contact to congratulate them about their advanced age. Alternatively, the Say happy birthday button is a drop-down menu with options to start a chat, have an audio or video call, or send email. The latter option launches the OWA compose message screen with an oddly uppercased recipient address (Figure 2). Given the widespread use of machine learning and artificial intelligence within Microsoft 365, you’d expect that Teams would compose the congratulatory message too! Alas, you’ll have to come up with some suitable text.

Once you respond to the prompt for your contact’s happy birthday, the insight disappears.

Other People Insights for the User Profile Card

Apart from birthdays, the insights you see include posts a contact makes to their LinkedIn account (shown in the LinkedIn tab), career changes, and pending meeting invitations. Microsoft emphasizes that the same insights are available in other Microsoft 365 apps, like OWA and Outlook.

I have never seen a birthday notification in Outlook for Windows, OWA, or the latest build of the Monarch client, but maybe I use the wrong versions. Microsoft’s documentation describes how Microsoft 365 generates people insights from LinkedIn and Viva Insights and how apps display the insights. Some delay occurs before Viva Insights generates information to show like “RSVP nudges” for outstanding invitations. The page shows OWA highlighting a contact’s birthday. Perhaps it’s a case where if you deal with an insight in one app, Microsoft 365 hides the insight for the other apps.

More Integration Everywhere

I’m beginning to think that Microsoft rewards engineers for finding ways to stitch different Microsoft 365 components together. Adding people insights to the user profile card is an example. Some of the information added recently, like someone’s local time zone, is very useful. I’m not sure about the latest batch.

Another example of stitching components together is the appearance of the Storyline post option in the new item menu for the latest OWA and Monarch clients (Figure 3). This action posts a text message to Viva Engage (aka Yammer) to appear on a user’s storyline.

I don’t think any great demand exists in the ranks of Outlook users to do such a thing but obviously the powers-that-be inside Microsoft consider this to be a very good thing. Hopefully, Microsoft’s famed telemetry will reveal the truth and persuade Microsoft to quietly drop the notion.

A common complaint I hear from Microsoft 365 administrators is that they wish Microsoft paid more attention to making the apps bulletproof instead of delivering new functionality that no one wants. But it’s important to keep engineers and product managers busy, and that’s why we see some of the changes that appear in message center notifications. I like some of the people insights I see, but know that other won’t. Beauty lies in the eye of the beholder.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

New Policy to Control the Need for Explicit Consent for Teams Recordings

I see that some of the sites that I refer to as the “ChatGPT of the Microsoft 365 world” (capable only of repeating what has been written beforehand by someone else) are very excited about message center notification MC523053 (3 March 2023). The notification covers the introduction of explicit recording consent for Teams meetings (Microsoft 365 roadmap item 107781), due to roll out in general availability later this month for commercial and GCC tenants. GCC-High and DOD tenants will see the feature by June.

I’m surprised that the recording of Teams meetings has got this far without explicit recording consent. In the absence of a feature to capture user consent, many organizations where I have joined Teams calls resort to someone reading out prepared text at the start of the call. The text normally goes something like this: “welcome to this call hosted by the XYZ corporation. If you don’t consent to the recording of the call, please disconnect now.” Essentially, the new feature is a computer-enforced version with some added smarts.

Update 6 August 2024: More explicit consent policies are now in force.

Updating Teams Meeting Policies

Explicit recording consent is disabled by default, meaning that Teams works like it always has unless an administrator enables the feature. This can’t be done through the Teams admin center today (support is coming), so you’ll need to update Teams meeting policies with PowerShell. The policy setting is per-user and applies to the meeting organizer. After the setting is enabled in a meeting policy, any meeting organized by accounts assigned the policy will use explicit consent for recorded meetings. The setting is retrospective and applies to meetings organized by users within the scope of the policy.

If you update some but not all meeting policies, users will have different experiences in meetings where consent is required in some but not all calls. For this reason, it’s generally best to be consistent across all meeting policies and have consent enabled or disabled everywhere.

Exceptions to the general rule will occur. For instance, local regulations might mandate that consent is necessary to join a recorded call. In that case, you could assign a Teams meeting policy with consent enabled to users where those regulation apply.

To enable explicit recording consent for a meeting policy, run the Set-CsTeamsMeetingPolicy from the MicrosoftTeams PowerShell module. For example, this command updates the default (global) policy:

Set-CsTeamsMeetingPolicy -Identity "Global" -ExplicitRecordingConsent Enabled

Like any change to a Teams policy, expect to wait several hours before the new setting is effective.

What Explicit Recording Consent Does

When people join a meeting organized by someone that an explicit consent for recordings applies to and a recording starts, each participant gets the chance to give their consent for recording. In terms of a Teams meeting, this covers:

• Audio (spoken comments).
• Video (their video feed from a workstation camera or mesh avatar).
• Screen share and content share (for example, working on a shared Excel workbook).

Basically, Teams blocks any contribution that could come from a participant until they consent to recording. While the block is in place, the user can see and hear contributions from other meeting participants.

When the meeting organizer (or a presenter) starts a meeting with explicit consent, Teams highlights the need to gain consent before it allows recording to start (Figure 1).

When recording starts, users see that Teams disabled their microphone and video in the join screen. After joining the call, Teams informs them that they must give consent to be recorded. To start the consent process, they unmute their audio or turn on their camera (Figure 2).

The final step is for the user to give consent (Figure 3). When this happens, Teams enables their microphone, camera, and sharing.

Client UI Needed to Give Consent

Microsoft points out that the enable recording consent feature depends on the meeting attendance report to track when users give consent. If your organization blocks the generation of attendance reports (by setting AllowEngagementReport to Disabled in Teams meeting policies)., tracking consent can’t work. Microsoft says that these customers should wait “for a future release.”

Older clients don’t include the UI necessary to give consent, so to make sure that people can give consent for recording, they’ll need to use a Teams client released after March 1, 2023. Microsoft makes an exception for Teams meeting rooms and PSTN participants as these interfaces cannot give explicit consent. For now, Teams notes their consent data in the attendance report as “not applicable” or “auto consent.” Current CarPlay clients don’t have the necessary UI either, so you won’t be able to participate fully in calls either. The audio component is obviously the most important loss for CarPlay users. Using Teams on a mobile device connected to the car via Bluetooth is an available workaround.

Welcome Change for Many Organizations

I’m sure that many organizations will welcome the introduction of explicit consent for meeting recording. Any organization that grapples with privacy issues and employee concerns in this area will see the value of explicit consent for recording. It’s the kind of feature that you never knew was so valuable until it’s needed.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Multiple Ways to Make Teams Bulk Policy Assignments

It’s amazing what slips by in the torrent of changes that occur within Microsoft 365. Message center notification MC397476 (last updated 27 July 2022, Microsoft 365 roadmap item 90705) is an example. This is the unassign policies from users in bulk feature that completed roll-out in August 2022.

Revert User Accounts to the Global Policy (Bulk Unassignment)

The idea is simple. Over time, it’s possible that the Teams policies assigned to users become less appropriate. It’s a pain to select user accounts individually to update policy assignments, so this is a method to reset accounts back to the global tenant policy for the following policy types:

• Messaging policy.
• Meeting policy.
• Calling policy.
• Live events policy.
• App setup policy.
• App permission policy.
• Teams policy.

To use the bulk unassign policy feature, go to the Users section of the Teams admin center. The Unassign policies in bulk option is in the top right-hand corner in the Actions drop-down menu. Select the policy type to work with and the Teams admin center displays the set of policies of that type (Figure 1). The greyed-out policies are default policies that don’t currently have any assigned users.

When you select a policy, Teams loads information about the assigned accounts. Click the Unassign button and confirm the action. Teams doesn’t tell you which accounts it processes, just the number of accounts that it successfully reverts to the default (Global) policy for the policy type. Bulk policy unassignments are supported for up to 500 accounts at a time.

Using View Users to Perform Teams Bulk Policy Assignments

Nice as it is to be able to remove (unassign) a non-default policy from a bunch of accounts, the Teams admin center includes what might be a better way to reassign policies (including to revert to the Global policy). MC445744 (13 October 2022, Microsoft 365 roadmap item 97253) covers the change made to allow administrators to view the users and groups covered by a policy.

Many of the major policies managed through the Teams admin center include the Assigned to users and Assigned to groups columns when they list policies (Figure 2).

The links in the columns reveal the set of users assigned the selected policy (Figure 3).

Select the Edit settings option and you can edit the policies assigned to the set of selected users, just like you’d update policies for an individual user or a set of selected users. Direct policy assignments to accounts like this take precedence over group policy assignments.

Other Ways to Process Teams Bulk Policy Assignments

Apart from the options available in the Teams admin center, the other ways to perform Teams bulk policy assignments include:

• Using batch jobs to process policy assignments for up to 5,000 accounts.
• Using Azure Automation runbooks to process policy assignments. The advantage of this method is that you could have a scheduled job to find and process policy assignments for new accounts.

Of course, you can also use PowerShell to find a set of accounts based on some criteria and perform policy assignments on that basis. Here’s an example of assigning a Teams feedback policy (PowerShell is the only way to manage feedback policies) to a set of user accounts based on their department:

Connect-MgGraph -Scopes User.Read.All
[array]$Users = Get-MgUser -Filter "department eq 'IT' and UserType eq 'Member'" | Select-Object UserPrincipalName, DisplayName
ForEach ($User in $Users) {
  Write-Host ("Assigning the feedback policy to {0}" -f $User.DisplayName)
  Grant-CsTeamsFeedbackPolicy -Identity $User.UserPrincipalName -Policy "Tenant Bar Feedback Policy" }

Keep Tracking Change

So much ongoing change happens within the Microsoft 365 ecosystem that it’s impossible to keep up to date with everything. Reviewing older message center notifications (we synchronize message center notifications to a Planner plan) is a good way to catch changes that you missed first time round. After all, no one is perfect.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Users Can Decide What Pronoun to Display in Profile Card

Updated March 30, 2023

Announced in message center notification MC515531 (last updated 21 February 2023), the ability to enable pronouns in Microsoft 365 profile cards is available in the Microsoft 365 admin center. Once enabled, users can set their preferred Microsoft 365 pronouns using the preview version of Teams. The pronoun feature is covered by Microsoft 365 roadmap item 86352 (Teams) and 115511 (OWA).

I have been able to update pronouns in Teams, OWA, and the latest build of the Monarch (“One Outlook”) client.

Employee Engagement

Microsoft’s documentation for the pronoun feature says that “the simple act of using the right pronouns for one another can help build trust and improve communication among colleagues.” Microsoft goes on to highlight that “Whether or not to share or publicly display pronouns is always up to an individual. Pronouns should never be assigned to one person by another person. It should be up to the person using them to decide when, where, and which pronouns are used – including whether to use this feature.”

In other words, organizations should do some thinking and employee engagement before they implement pronouns for profile cards.

Implementing Pronouns on the Microsoft 365 Profile Card

The first step is to enable pronouns for the organization. Go to Org settings in the Microsoft 365 admin center and select the Security & privacy tab. Pronouns is one of the listed options (Figure 1).

Microsoft says that it can take up to 7 hours before users can change their pronouns. In practice, expect the change to take a day before it is effective. If you disable pronouns, it will take the same length of time before pronouns disappear from view for all users. Microsoft 365 removes pronoun data if an organization disables the feature. Like most deletions in Microsoft 365, deletion is not immediate and if you reenable pronouns, previously set values will reappear.

After the software change is effective, users will see the option to update pronouns on their profile card. For instance, I clicked on my photo for a message posted to a Teams channel to reveal my profile card and see the option to add pronouns (Figure 2).

Remember Microsoft’s point that pronouns are a personal decision for users? To enable freedom of choice, you can add whatever text you like for a pronoun. The profile card suggests the commonly-used values such as “She/Her,” but you can ignore these values and use whatever text you prefer (up to 30 characters).

The important thing to remember is that pronouns are visible to all members of the organization. There’s no way to restrict pronoun display to a certain segment, such as members of a group. Guest members and external members of shared channels can’t see pronoun information on profile cards.

Building the Profile Card

Microsoft 365 stores user pronouns in a hidden folder in user Exchange Online mailboxes. Apps that support the profile card retrieve the information from the mailbox along with other properties (including custom attributes) to display the profile card (Figure 4).

A Change to Plan

Microsoft’s FAQ for pronouns contains some other useful information to consult before implementation. Displaying pronouns in the profile card is obviously something that an organization should think through before implementation. For example, some organizations also add pronouns to account display names, meaning that the information shows up in address books and other places where people see display names, like email headers, listings of documents in SharePoint Online and OneDrive for Business, and so on. Don’t rush to deploy just because someone (maybe a vocal proponent) thinks that pronouns are a good idea. Pause, consider, and then decide.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Even pronouns deserve analysis…

Get Ready to Deploy the New Teams Client to End Users

Updated March 27, 2023: The preview of the new Teams client is available.

With all the speculation that Microsoft will release a public preview of the new Teams (V2.1) client in late March 2023, it’s time to review how users can access the preview code once Microsoft makes it available.

Teams uses update policies to dictate which users have access to preview features. Teams also allows tenants to align with Office preview channels if they wish. The first job is therefore to define the user group to test the new Teams client and make sure to assign a Teams update policy that allows them to access preview features to their accounts. Once the policy is effective, users can switch between preview and production versions as they like.

A New Option in the Teams Update Policy

A hint that Microsoft will provide controls to allow customers to roll out the new Teams client at their own rate is in the PowerShell Get-CsTeamsUpdateManagementPolicy cmdlet. This reveals a UseNewTeamsClient setting. Microsoft added the setting in version 4.9.1 of the MicrosoftTeams PowerShell module in November 2022. The values accepted by the Set-CsTeamsUpdateManagementPolicy cmdlet are:

• MicrosoftChoice: Microsoft controls the use of the new client. This is likely how Microsoft will force customers to eventually move from the old to the new client.
• UserChoice: Individual users can choose to use the new client.
• AdminDisabled: The organization disables the new client for users assigned the policy.

The interpretations of the options are mine and are not formally confirmed by Microsoft. The point is that it will be possible for organizations to control when users get the new client and which users get the new client.

Building a New Teams Architecture

Microsoft has been working on the new Teams client architecture for a long time. Some hints came in my May 2021 discussion with Rish Tandon (the then VP for Teams Engineering). At the time, Rish acknowledged that client performance wasn’t where Microsoft wanted it to be. A further hint came when Microsoft revealed the Teams consumer client for Windows 11. The consumer client uses the new Teams client architecture based on ReactJS and the WebView2 Edge component.

Of course, the Teams consumer client is a pale shadow of its enterprise counterpart when it comes to features and functionality, as people will discover when they move from Teams Free (classic) to the new Teams (free) version. There are no channels to deal with (regular, private, or shared), the number of users is limited, there’s no Phone system or Teams room devices, and so on. Acknowledging these limitations, the Teams consumer client (2.0 in the architecture) proved a useful step to proving the concepts and components used in the next generation of the Teams enterprise client (2.1).

Microsoft’s recent press briefings have emphasized benchmarks like a 50% reduction in memory, less demand for CPU, and a consequent extended battery life for laptops. Cynics might say that all of this comes from removing the overhead imposed by Electron. Certainly there’s some truth in that assertion but the overall engineering effort required to move the Teams desktop and browser clients to the new architecture spans more than simply swapping code libraries.

When Production Software Arrives

After running the public preview for the new version of the Teams client for several months, Microsoft will make the client generally available (GA). At that point, a recent change will affect when organizations see the GA software.

Microsoft 365 message center notification MC510331 (February 2, Microsoft 365 roadmap item 117577) announced that Teams will support targeted release for commercial cloud customers. In other words, if your tenant opts in to use targeted release for some or all users, you’ll be amongst the first to get the new Teams client. Release preferences are in the Org settings section of the Microsoft 365 admin center (Figure 1).

Those who choose to remain with the standard release will receive the software later. Given the size of the Microsoft 365 infrastructure, the difference between first and last tenants receiving the new client could be several months.

A Big Moment Approaches for Teams

People have complained about the performance and memory consumption of the Teams client for years. Despite much tweaking and filling in performance gaps since 2016, it’s obvious that the road has run out for the original Teams client. Launching a new Teams client is an important point for Microsoft. They only have 280 million monthly active users to please. No pressure then!

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Major Update for the Get-CsOnlineUser Cmdlet

I don’t normally write about a new version of the Microsoft Teams PowerShell module and confine myself to updating the post covering recent module updates. However, the release of a major version is worth comment, which is the case with V5.0 of the Teams module, now available from the PowerShell Gallery (Figure 1).

Over the past few releases, Microsoft concentrated on “modernizing” the policy management cmdlets that Teams inherited from the Skype for Business connector. Modernization is a term to describe updating the cmdlets to recent standards to make them more reliable and robust. The Get-CsOnlineUser cmdlet is the focus for the V5.0 release.

The Use of Get-CsOnlineUser

Get-CsOnlineUser fetches details of user accounts enabled for Teams. I only use this cmdlet when I need to view details of the Teams policies assigned to accounts as I prefer using the Get-MgUser cmdlet to retrieve information about user accounts. The Get-CsOnlineUser cmdlet can return details of the Teams service plans assigned to an account (like the MCO_VIRTUAL_APPT and TEAMS_WEBINAR service plans assigned to accounts with the Teams Premium license), but these are also retrievable with Get-MgUser.

In the past, Get-CsOnlineUser hasn’t been very performant or flexible when retrieving accounts. Microsoft says that they’ve improved performance, especially when using filters to find accounts. In addition, a set of new filterable properties are available (Alias, City, CompanyName, CompanyName, HostingProvider, UserValidationErrors, OnPremEnterpriseVoiceEnabled, OnPremHostingProvider, OnPremLineURI, OnPremSIPEnabled, SipAddress, SoftDeletionTimestamp, State, Street, TeamsOwnersPolicy, WhenChanged, WhenCreated, FeatureTypes, PreferredDataLocation, andLastName).

Changes to Filtering

Another improvement is in the support of filtering operators to bring the cmdlet in line with other cmdlets that fetch user information like Get-ExoMailbox. This is server-side filtering, meaning that the server only returns items that match the filter. It’s faster to retrieve data with a server-side filter than it is to fetch items and then apply a filter on the workstation (client-side filtering).

For instance, this use of the like operator now works:

Get-CsOnlineUser -Filter {City -like "*York*"} | Format-Table DisplayName, City

DisplayName   City
-----------   ----
Terry Hegarty New York

Previous versions of the module generate the error: Get-CsOnlineUser : The filter attribute ‘city’ is not supported.

Get-CsOnlineUser now supports use of the gt (greater than), lt (less than), and le (less than or equal to) operators to filter against string properties. For instance, this works:

Get-CsOnlineUser -Filter {DisplayName -gt "James"} | Sort-Object DisplayName | Format-Table DisplayName, City

DisplayName                             City
-----------                             ----
James Abrahams                          Foxrock
James Ryan                              Foxrock
Jane Sixsmith                           Dublin

The contains operator now supports properties that contain arrays. For instance, this command returns the set of accounts enabled for Teams:

Get-CsOnlineUser -Filter {FeatureTypes -contains "Teams"} | Format-Table DisplayName

The ge operator supports filters against Teams policies (previous versions only support the eq and ne operators):

Get-CsOnlineUser -Filter {TeamsFilesPolicy -ge "*NoSP*"} | Format-Table DisplayName, TeamsFilesPolicy

My attempts to use the cmdlet to filter against the Teams Channel policy failed. I also saw inconsistent results when filtering against other policies. For instance, this returns no accounts:

Get-CsOnlineUser -Filter {TeamsMessagingPolicy -ge "B"}

Adding wildcards generates some results, but it’s hard to accept that a policy called “Advanced” has a name greater or equal to “B”:

Get-CsOnlineUser -Filter {TeamsMessagingPolicy -ge "*B*"} | Format-Table DisplayName, TeamsMessagingPolicy

DisplayName                 TeamsMessagingPolicy
-----------                 --------------------
Jane Sixsmith               Advanced
Marc Vigneau                Advanced

Interestingly, a client-side filter has problems too:

$Users = Get-CsOnlineUser | Where-Object {$_.TeamsMessagingPolicy -ge "B"} | Format-Table DisplayName
Where-Object : Cannot compare "Advanced" because it is not IComparable.
At line:1 char:29

I might be doing things in a way unanticipated by the Teams PowerShell developers, but I have been around PowerShell long enough to know when things don’t work quite the way they should. Some tweaks might still be necessary to make sure that filters work against all Teams policies in the same way.

Soft Deleted Users

Apart from the filtering changes, Get-CsOnlineUser now returns details of unlicensed users for 30 days after license removal and indicates soft-deleted users (accounts in the Azure AD recycle bin awaiting permanent removal) by showing the date and time of deletion in the SoftDeletionTimestamp property. You can find the soft-deleted users with:

Get-CsOnlineUser -Filter {SoftDeletionTimestamp -ne $Null} | Format-Table DisplayName, SoftDeletionTimestamp

DisplayName SoftDeletionTimestamp
----------- ---------------------
Ben James   04/03/2023 23:11:41

Work Still to Do

Get-CsOnlineUser is an important cmdlet used in many scripts to automate administrative processes. It’s good that Microsoft invested effort to make the Get-CsOnlineUser cmdlet work better, even if some issues still exist. Crack out the update procedure you use to refresh Microsoft 365 modules (or use my script, which handles Exchange Online, SharePoint Online, and the Microsoft Graph PowerShell SDK too) and upgrade to V5.0 of the Microsoft Teams module.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Classic Version of Teams Free Retires in April

On April 12, 2023, Microsoft will retire the Teams Free (classic) version that they launched in 2018 (Figure 1). I still have the Azure AD tenant created to support Teams Free and the software continues to work quite happily. The question is what to do when Microsoft brings the curtain down.

There’s been some ill-informed commentary about the retirement and what it means for users. Let’s discuss what’s happening.

Migration Options

The options presented by Microsoft are:

• Switch to the new free version of Teams, confusingly named Microsoft Teams (free). The big downside is that none of the information currently in Team Free (classic) will transfer.
• Upgrade to a paid version of Teams, such as Teams Essentials ($4/month) or the entry-level Microsoft 365 Business Basic subscription ($6/month). The big advantage of going for the Microsoft 365 subscription is access to the web and online versions of the Office apps.

When Microsoft retires Teams Free (classic), administrators will have until July 12, 2023, or 90 days the tenant was last used (whichever is earlier) to recover data. After the drop-dead date, Microsoft will remove the tenant and permanently remove the data.

No Migration for Free Versions

Unless you choose to upgrade to a paid-for version of Teams, it’s up to you to recover data created in Teams Free (classic). Essentially, if you want to continue using a free version of Teams, you’ll have to manually download the files shared in chats and channel conversations to a workstation and upload them to the new version. Given that Teams stores its files in OneDrive for Business and SharePoint Online, you can use the OneDrive sync client to synchronize the files to a workstation and download them that way. The Teams Wiki still features in Teams Free (classic). You’ll need to cut and paste information from wikis to OneNote or another document because Microsoft’s wiki migration tool might not run for the free version.

There’s no way to save the messages in channel conversations unless you use a third-party ISV product designed for tenant-to-tenant migrations (or write your own code with the Teams export API). However, if you’re using a free version of Teams, you’re unlikely to want to cough up for a migration product or start to write code using an API that you’ve got to pay for. At the most basic level, you can rescue important conversations by copying them to a Word or OneNote document.

Why No Migration Tools are Available for Teams Free

You might wonder why Microsoft is not offering migration tools to move from Teams Free (classic) to Teams (Free). Both a financial imperative and a technical limitation exist:

• There’s no revenue opportunity for Microsoft. The upside is to encourage people who’ve used Teams Free (classic) since 2018 to move to a paid-for version. Why encourage them to stay on a free platform? Making it easy for people to pay nothing does nothing to increase the average revenue per user from Microsoft 365.
• The new Teams (free) is based on Teams for Home. Microsoft is closing the infrastructure that serviced Teams Free (classic). This isn’t surprising because Teams Free (classic) came along quite soon after the launch of Teams and shared the same platform accessed through the teams.microsoft.com endpoint. Teams for Home uses a different infrastructure, accessed through teams.live.com. Teams (free) doesn’t have teams. Instead, it uses group chats to host conversations for the up to 300 people that a Teams (free) organization can host. Teams (free) doesn’t use SharePoint Online either. There’s no teams to organize discussions. Instead, Teams (free) offers communities, announced in January 2023 and currently available only for mobile clients. In a nutshell, the dramatic difference in the implementations of Teams Free (classic) and Teams (free) is the basic reason why Microsoft doesn’t support migration.

On the other hand, if you choose to upgrade to a paid-for version of Teams, your existing Azure AD tenant will remain in place and you’ll get licenses to allow you to continue to use Teams. No migration is necessary.

Less Functionality for Teams Free

It’s not surprising that Microsoft should want to move the free version of Teams off their production paid-for infrastructure to join their existing free Teams for Home offering. The change won’t affect those who simply want to use Teams for chat and calls. However, the new Teams Free represents a substantial downgrade in functionality that might affect how some organizations use Teams. If that’s your situation, maybe it’s time to think about using the paid-for version.

Learn about using Microsoft Teams (the paid-for version) and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

A Representation of the Real You as Your Visual Presence in Teams Meetings

Updated 27 March 2023

In October 2022, Microsoft introduced Mesh Avatars for Teams to a private preview. According to Microsoft, mesh (3D) avatars are “one of our first steps to enabling metaverse experiences for customers” before going on to say “With Mesh avatars, employees will be able to connect with presence in Microsoft Teams meetings without turning their camera on. They can represent themselves the way they want to show up by choosing the avatar fits their specific meeting— from casual, professional, or day-to-day.”

Since the announcement, I’ve heard a variety of reactions ranging from unbridled enthusiasm from people like MVP Vesa Nopanen to “nah, why bother.” I’m in the middle. I see value in allowing people to represent themselves in online meetings with an avatar in many circumstances. For instance, people with a facial injury might prefer to use an avatar instead of exposing themselves to comments about their injury. On the other end of the spectrum, if I’ve just crawled out of bed and am not in the most visually appealing shape to participate in a call, using an avatar might be better than turning on video and showing the disheveled reality . Another good use of avatars is when you’re the first person in a meeting and you want to establish a “holding pattern” so that people who join know that you’re there but aren’t quite ready to communicate.

MC533652 (March 27) announced that avatars are available to Teams preview users. According to Microsoft 365 roadmap item 107969, Microsoft Teams avatars will roll-out in May 2023. Microsoft hasn’t said if using avatars will require a premium license.

What Avatars Can Do in Teams Meetings

Some must-known things about using avatars in Teams meetings include:

• Avatars are optional. Ignore them if you want to. If you use an avatar, it replaces the video stream from the workstation camera, so the camera is off during the meeting. You can switch between the camera and avatars during a call. Avatars appear in meetings in all Teams clients, but you can only create avatars and select avatars for meetings with the desktop and browser clients.
• A user can have up to three avatars that they can select from before or during a meeting. For instance, they could have a very professional avatar for formal customer meetings and a more informal version for internal gatherings.
• You can combine avatars with other visual effects, like a background image. However, avatars have their own set of background images and don’t support custom background images. Given the popularity of custom background images for Teams meetings, Microsoft might well close this gap soon.
• Avatars are not static. They react to audio and “twitch” from time to time to provide some visual interest. In addition, avatar “reactions” are available during meetings to allow the avatar to express emotion or react to what’s going on in the call.
• Avatars are only available in your home tenant. You can join a meeting in a host tenant (without switching) and use an avatar, but if you switch and sign in as a guest to another tenant, your avatars are unavailable.

With those points in mind, let’s take a quick look at how to create avatars and use them during Teams meetings.

The Mesh Avatars App

Users build and maintain their set of up to three avatars with the Mesh Avatars app. Like other Teams apps, administrators can disable the app in the Teams admin center if they don’t want people to use it (Figure 1) and control access through an app permissions policy. Blocking the app stops people accessing the app and prevents them using avatars they’ve already created in Teams meetings.

Assuming that the app is available, we can load it through the Apps menu and start to build an avatar. You can also create an avatar from the Avatars and Effects option in a Teams meeting. However, I think most people will create their avatar well before attempting to use it in a call.

The avatar creation experience (Figure 2) will delight some and terrify others. The range of customization options is deliberately huge to accommodate as many different people as possible from all ethnic backgrounds and appearances.

After occupying many hours deciding on just the right body shape, clothes, hair, skin tone, and shade of lipstick, save the result to create your avatar. I am rubbish at creating anything artistic, so the avatars I generated are poor representations of the real me.

In some respects, it doesn’t matter how accurate an avatar is because an avatar isn’t supposed to be a 100% representation of a human. Although you might feel that an avatar should look like the person it represents, does it matter if that person decides to do something different? After all, people can use custom background image to represent them during Teams meetings and no one thinks this strange. It’s the same if they decide to create an avatar that projects their chosen image.

In later iterations, Microsoft might make it possible for people to upload a headshot photo and use that as the basis to create an avatar. Being able to use a photo would make avatar creation faster and more accessible, not to mention more accurate (even after a few tweaks). Of course, that assumes that the auto-avatar creation process results in something that doesn’t look like a cross between you and Frankenstein.

Using an Avatar in a Teams Meeting

After creating an avatar, it becomes available for use in Teams meetings. The meeting pre-join screen allows a user to select between video effects (like background blur, custom background images, and video filters).

After joining the meeting, the avatar takes the place of the normal video stream generated from the camera or user photo (if video is off). It’s as simple as that. If you use a live reaction (not an emoji) during a call, the avatar mimics the action. Similarly, if you use the raise your hand feature to attract the speaker’s attention, the avatar raises their hand (Figure 4).

Avatar Reactions

In addition to the basic meeting reactions, avatars have a set of purpose-built reactions to help express feelings (Figure 5).

Although you can pin your favorite reactions for faster access, pinning doesn’t add those reactions to the set displayed by the React button. Instead, you navigate to the Effects and Avatars option from the More […] menu and select the reaction from there. This is fine when you have the time to think about what reaction to use, but avatar reactions are not as engaging or useful as they could be if users could pin their favorite reactions to a more prominent position in the main meeting window.

Avatar Settings

Avatar settings (Figure 6) allow users to tweak the appearance of their avatar by:

• Moving the avatar to the left or right rather than looking straight ahead.
• Zooming the avatar in or out to appear larger or smaller on screen.
• Expressing a mood in a range from unhappy to happy. Mood changes by updating the appearance of the eyes and mouth. An avatar with twinkling eyes and a grinning mouth is happy. One with blank expressionless eyes and a straight mouth gives a different impression.

Who’s for Mesh Avatars in Teams?

I can see why some will like using avatars. They can be fun (hours of endless editing to create the perfect virtual you) and can help to avoid some element of meeting fatigue. Using an avatar won’t make an intolerable, boring meeting any more palatable. You’ll still have to suffer through the droning inanity that is the hallmark of so many corporate gatherings, but I guess you could liven things up a tad by dropping an avatar reaction into the mix every so often, if only to see if anyone responds.  It might just wake up some of the folks who sleep through boring meetings.

On the administrative front, I don’t see any way to track the use of avatars or who’s created avatars. No records are in the audit log to record use of the Mesh Avatars app or the use of avatars in meetings.

Avatars are very personal. Use them if you like. Ignore them if you don’t see the value. Microsoft hasn’t said how they will license Mesh Avatars for Teams. It’s possible that avatars will be a Teams Premium feature. If so, the decision to use avatars might be taken away from users based on the cost of the extra licenses. 

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Remove Teams Premium Licenses from Azure AD User Accounts After 30-Day Trial Finishes

Microsoft makes a Teams Premium trial license to allow customers test whether the functionality available in Teams Premium is worth the $10/user/month cost. Some of the features, like meeting templates, might be less obviously worth the money. Others, like the advanced webinar functionality (like having a waitlist for webinar participants) might just be what you need. The trial allows you to try before you buy by testing all the features with up to 25 users for 30 days.

Once the 30-day period finishes, Microsoft automatically terminates the license validity and users lose access to the premium features. Even if you decide to go ahead with Teams Premium, it’s a good idea to clean up by removing the licenses from the user accounts that participated in the trial. This is easily done in the Microsoft 365 admin center by selecting the license, selecting all accounts holding the license and choosing Unassign licenses (Figure 1).

Remove Teams Premium Licenses with PowerShell

Given that we’re all learning how to manage licenses with the Microsoft Graph because of the imminent retirement of the Azure AD and MSOL modules, it’s good to know how to remove licenses. Let’s examine what’s needed to remove the Teams Premium trial licenses.

First, we must know the SKU identifier for the license. To do this, run the Get-MgSubscribedSku cmdlet and look through the set of licenses known to the tenant to find Teams Premium:

Get-MgSubscribedSku | Format-List SkuId, SkuPartNumber, ServicePlans

SkuId         : 36a0f3b3-adb5-49ea-bf66-762134cf063a

SkuPartNumber : Microsoft_Teams_Premium

ServicePlans  : {MCO_VIRTUAL_APPT, MICROSOFT_ECDN, TEAMSPRO_VIRTUALAPPT, TEAMSPRO_CUST...}

According to the Azure AD list of licenses and identifiers, the SKU identifier for Teams Premium is 989a1621-93bc-4be0-835c-fe30171d6463 rather than the 36a0f3b3-adb5-49ea-bf66-762134cf063a shown here. This is because the first value is for the paid license. The second is for the trial license. Both SKUs have the same part number and display name (which is why the license shown in Figure 1 is called Microsoft Teams Premium). It would be nice if Microsoft added a trial suffix for its trial licenses.

In any case, both SKUs include seven separate service plans. A service plan is a license for a piece of functionality that cannot be bought. Instead, it’s bundled into a product (SKU) like Teams Premium. Service plans allow administrators to selectively disable functionality enabled by a license. For instance, you could disable advanced virtual appointments without affecting the other elements in Teams Premium. Table 1 lists the service plans covered by Teams Premium.

PowerShell Code to Remove Teams Premium Licenses from Azure AD Accounts

Now that we know the SKU identifier, we can run some PowerShell to:

• Find user accounts with the Teams Premium license. This is done using a lambda filter against the assignedLicenses property of each account.
• Remove the license from those accounts.

Connect-MgGraph -Scope User.ReadWrite.All
Select-MgProfile Beta
# Populate identifier for target product (SKU)
$TeamsPremiumSku = "36a0f3b3-adb5-49ea-bf66-762134cf063a"
[array]$Users = Get-MgUser -filter "assignedLicenses/any(s:s/skuId eq $TeamsPremiumSku)" -All
If (!($Users)) { Write-Host "No Teams Premium Trial licenses found - exiting" ; break }
Write-Host ("Removing {0} Teams trial licenses from {1}..." -f $Users.count, ($Users.displayName -join ", "))

ForEach($User in $Users) {
  Try {
    $Status = Set-MgUserLicense -UserId $User.Id -RemoveLicenses $TeamsPremiumSku -AddLicenses @{}  }
  Catch {
    Write-Host "Error removing Teams Premium Trial license from {0}" -f $User.displayName }
}

Updated with an appropriate SKU identifier, the code will remove licenses for other Microsoft 365 products.

Remove Teams Premium Licenses to Avoid Confusion

It doesn’t matter if you leave expired licenses in place. They won’t affect how people use Microsoft 365. However, given that the paid-for and trial versions of the Teams Premium licenses have the same display name, it’s best to remove trial licenses to avoid potential future confusion.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.

Teams Meeting Templates are part of Teams Premium

Now that Microsoft considers Teams Premium to be generally available, it’s appropriate to investigate some of the functionality enabled by the new product to see if it’s worth the $10/month/user fee. In The 30-day trial license for Teams Premium remains available.

Microsoft has introductory pricing for Teams Premium of $7/month/user until June 30, 2023, possibly because some of the features aren’t yet available. For example, branded meetings won’t be available until mid-February and the much-hyped intelligent meeting recap powered by GPT 3.5 is scheduled for sometime in the second quarter of 2023. Given the delay, you might want to wait before testing.

Managing Teams Meeting Templates

Meeting templates are available now. These are essentially policies to apply to meetings to control settings that are otherwise set by the meeting organizer. The idea is to speed up meeting creation by using templates. A new meeting inherits options from the template used.

Management of meeting templates is through the Meetings section of the Teams admin center. Figure 1 shows that the organization has four custom templates and one default (for virtual appointments).

The process of creating and editing templates proceeds in the same way as managing other Teams objects. The only odd thing I encountered is the ability to create meeting templates with duplicate names. Although each template has a unique identifier, having multiple templates with the same display name is likely to confuse users.

Meeting Templates and Sensitivity Labels

When you create a new meeting template, you can set values for a range of meeting options, including using a sensitivity label. You don’t have to choose a sensitivity label, but if you do, the template inherits settings from the label and locks them against change (Figure 2), meaning that meeting organizers cannot change these settings for individual meetings. You can also lock settings in templates that don’t use a sensitivity label.

The control a sensitivity label exerts over a meeting template is similar to the way sensitivity labels manage containers (sites, teams, and groups). Using a sensitivity label in a meeting template does not mean that Microsoft Information Protection will encrypt the meeting and its associated artifacts (attached files, attendance report, and so on).

Configuring Sensitivity Labels for Teams Meeting Templates

Before a sensitivity label can be used with a meeting template, administrators must configure it with Teams settings (Figure 3). These are the settings inherited by a meeting template from the sensitivity label.

Sensitivity labels with Teams settings are tagged with “meetings” when listed in the Information Protection section of the Microsoft Purview Compliance portal. If you want, you can find the set of labels available for Teams by running this PowerShell snippet:

Connect-IPPSSession
[array]$Labels = Get-Label
$TeamsLabels = [System.Collections.Generic.List[Object]]::new() 
ForEach ($Label in $Labels) { 
    If ($Label.ContentType -Like "*Teamwork*") { # It's a label for Teams
      $DataLine = [PSCustomObject] @{
        LabelId     = $Label.ImmutableId
        DisplayName = $Label.DisplayName
        Priority    = $Label.Priority } 
      $TeamsLabels.Add($DataLine) } 
}
$Output = $ContainerLabels.DisplayName -Join ", "
Write-Output ("These labels support Teams Meetings {0}:" -f $Output)

Meeting Template Policy

Users gain access to meeting templates through the meeting template policy assigned to their accounts. The default meeting template policy for the organization allows access to all templates, but you can create policies to restrict access to specific templates. For example, you could have a policy allowing access to a set of templates that’s assigned to members of a certain department.

When planning meeting templates and the policies used to publish templates to users, it’s a good idea to focus on a scheme that gives users an appropriate amount of choice. If you use a single policy to publish 10 templates to users, people might find it difficult to select the right template for a meeting. Three or four templates is a practical number to aim for.

Creating Meetings from a Template

To create a meeting from a template, select the template from the list revealed by the down arrow beside the New meeting button (Figure 4). Teams creates a new meeting and populates its options from the template settings.

Apart from the number of templates shown here, the importance of good template names becomes apparent. For instance, what’s the difference between a confidence meeting and a secure meeting or a private meeting? Differences may well exist in terms of the settings meetings inherit from each template, but it’s hard for users to differentiate between the templates.

Meetings created using templates have their options set. The options that the organizer cannot change have a lock icon to indicate their status (Figure 5). Other options can be amended as usual.

Apart from having predetermined options, meetings created from templates work in the same way as do regular meetings.

The Promise of Templates

Microsoft says that meeting templates reduce “the time and thought process it takes to create and get the meeting right.” And “With templates, leaders can ensure that their meetings adhere to company best practices and policies.” I never expended too many brain cells when creating Teams meetings in the past, but I see value in applying standards to specific types of meetings. Whether that’s worth the extra license fees is a different matter. But I suspect that meeting templates will not be the key functionality that justifies an organization buying Teams Premium.

Keep up to date with developments like Teams meeting templates by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers understand the most important changes happening across Office 365.

Teams User Numbers Slow as Office 365 Grows 12%

One thing that’s obvious from the Microsoft FY23 Q2 results released on January 24 is that the woes of the wider economy is affecting the growth of the Microsoft Cloud. This is despite headline growth to achieve $27.1 billion in quarterly revenue ($108.4 billion annualized run rate), up 22% year over year (or 29% in constant currency, reflecting the recent strength of the dollar). However, Microsoft had “slower than expected growth in new business” in Office 365 and EMS.

Revenue for Office 365 commercial increased 11% YoY (18% in constant currency). Microsoft said that this reflected “healthy renewal execution” and growth in annual revenue per user (ARPU) because “E5 momentum remains strong.” A cynic might say that Microsoft is now sweating its massive installed base. Customers have no real choice but to renew as the costs and technical difficulties involved in getting off Office 365 are massive. Microsoft drives ARPU by making sure that new features appear in the high-end SKUs. For example, if you want any automation for compliance or security functionality, you need an E5 SKU.

Driving users to buy E5 to get better security functionality is one reason why Microsoft was able to announce that its security business surpassed $20 billion (annually) in revenue. The security business includes products commonly used with Office 365 like Microsoft Purview, Microsoft Entra (think Azure AD), Microsoft Sentinel, Microsoft Intune, and Microsoft Defender. Some of these capabilities are bundled with Office 365 E3, but high-end Purview security and compliance functionality like adaptive scopes or automatic label policies or Defender Plan 2 require Office 365 E5. And Azure AD Premium P1 and P2 licenses are needed for features like conditional access policies and privileged identity management.

Office 365 User Base Approaches 400 Million

Probably deliberately to obfuscate comparisons, Microsoft hasn’t given a firm number for Office 365 active users since October 2019 when they reported 200 million monthly active users. Since then, they’ve focused on reporting growth percentages and paid seats, like the 345 million paid seats highlighted in April 2022. This time round, they said that Office 365 commercial seats grew 12% YoY and observed that small-to-medium business and frontline worker offerings drove the growth. Microsoft also said that they “saw some impact from the slowdown in growth of new business” and that they expect revenue growth to be lower in the coming quarter by about one percentage point.

During the analyst Q&A, Brad Reback from Stifel put forward a 400 million seat number for Office 365 and asked if Microsoft would concentrate on growth in seats or ARPU. In his response, CEO Satya Nadella acknowledged “moderating seat growth” balanced by increased ARPU due to more customers taking up E5 licenses. Nadella also points to Teams Premium (referred to as Team Pro in the transcript) as an opportunity for increased ARPU.

I think the number of paid Office 365 seats is a tad below 400 million (maybe around 385 million) but it’s hard to know. The number of actual real-live human beings who use Office 365 daily is lower at maybe 360 million. Either way, it’s a big number of users that is still growing albeit slower than before.

Teams User Number Reaches 280 Million

Speaking of Teams Premium, Microsoft gave an updated number for the user base that they can sell the new product to when Teams Premium becomes generally available in February 2023. A year ago, Microsoft said that Teams had 270 million monthly active users. Now the Teams user number is 280 million (Figure 1).

Microsoft claimed that the 3.57% growth in the Teams user number represented “durable momentum since the pandemic.” It’s curious that Teams grew at about a third of the rate of increase in Office 365 seats (12% YoY). Perhaps this is because those who want to use Teams are using it and relatively few in the small-to-medium and frontline segments where Microsoft says the Office 365 growth came from need Teams.

Microsoft usually throws out some gee-whiz statistics about Teams to help people in games of Office 365 trivial pursuit. This time round, we learned that there are more than 500,000 active Teams Rooms devices (up 70% YoY) and the number of customers with more than 1,000 Teams rooms doubled YoY. This might mean that two customers now have more than 1,000 Teams rooms instead of one last year. Microsoft didn’t clarify the point. However, they did assert that Teams Phone continues to grow its share and is now the market leader for cloud calling. Over 5 million Teams users with licenses for PSTN calling joined the Teams user mix over the last 12 months.

Balance Between New Seats and More Money Per Seat

It’s hard to grow big numbers. Microsoft continues to add seats to Office 365, but it seems like the new seats have low-end licenses, which is why they need to sell more high-end add-ons or more expensive licenses to the installed base to offset the relative lack of revenue fgenrom the new seats. Growth in Teams users is slowing, but the same aspects are visible in selling add-ons (like PSTN) and hoping that customers like what they see in Teams Premium enough to cough up the extra $10/user/month for licenses. You’ve got to keep that quarterly revenue number growing…

If you’re a tenant administrator who looks after some of the 400 million Office 365 users, make sure that you’re not surprised about changes that appear inside Office 365 by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.