But Advanced Collaboration Analytics Remains a Teams Premium Feature

According to message center notification MC862237 (14 August 2024), Microsoft plans to update the External domain activity report that’s available through the Reports section and the Collaboration activity dashboard in the Teams admin center. This report is designed to allow tenant administrators to know which domains users communicate with and which users are communicating externally. It’s good knowledge to have because it allows an organization to more accurately configure external access for Teams.

Default Open Access for Collaboration

The default state of external access for Teams allows federated communications with any other Microsoft 365 tenant that runs Teams. According to the last Microsoft numbers, Teams has 320 million monthly active users out of 400 million Office 365 “paid seats,” so allowing open external access essentially means that a tenant allows users to communicate with any other Microsoft 365 tenant.

Given the current state of cyberthreat, maintaining open communications of this nature is an unreachable state of utopia. The GIFShell exploit in 2012 proved the basics of how an attacker might compromise a target account using federated Teams chat. Tenants should configure an external access allow list composed of other domains that they’re willing to communicate with. It’s just too easy for attackers to spin up a tenant, add a Teams license, and start to probe (Teams began to block federated collaboration with trial tenants from July 29, 2024).

The New External Domain Activity Report has More Detail

Microsoft plans to roll out the updated report in September 2024. The update can’t come soon enough because the current report is devoid of detail. Only users with Teams Premium licenses appear, which accounts for the rather sparse content from my tenant (Figure 1).

Microsoft says that the new report will include:

• Total chat messages exchanged between each external domain and your tenant.
• Number of chat messages sent by each external domain to your tenant.
• The list of users from your tenant that communicate with each external domain.
• For each user, the number of chat messages sent between each external domain and the user, and the number of messages sent by that user to the external domain.

Nice as the new report will be, it’s regrettable that this kind of information is restricted to Teams Premium. According to the latest Microsoft results, Teams Premium represents about 3 million users, or less than 1 percent of the installed base. At $10 per user per month (a $7 introductory price is available until December 31, 2024), Microsoft obviously wants to drive that percentage higher. However, this kind of fundamental information is important for tenant security and should be available to all.

Including the report in Advanced Collaboration Analytics grants the report a status it simply doesn’t have. Other items shown in the collaboration activity dashboard (Figure 2), like noting the domains in the external access allow list that haven’t been used in the last 60 days, are much more worthy of the designation.

Like other reports generated from Graph usage data, the cards in the collaboration activity dashboard that include user or team names respect the privacy control setting. Unlike the Microsoft 365 admin center, which obfuscates private data if the privacy control is set, the Teams admin center simply doesn’t display data.

DIY Analytics

If you don’t want to pay for Teams Premium but would like to generate some of the same analyses that Microsoft include in Advanced Collaboration Analytics, it’s possible to do so with PowerShell or Graph API requests. As an example, this article describes how to create an external access allow list by analyzing federated chat messages using the Microsoft Graph PowerShell SDK. Once the basic data is generated, it can be sliced and diced in different ways.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

New Report Helps Admins Understand Apps Usage

Without any notification in the Office 365 Message Center, the Teams developers have introduced a new App usage report in the Reports section of the Teams admin center.

App management has been steadily improved in Teams over the last year or so, with app permissions policies and app setup policies added in 2019 and a new app management model earlier this year. However, there’s never been great visibility about what usage the hundreds of available apps actually get, which means that admins have to figure out what’s happening. You can create a report using PowerShell and the Graph to discover what apps are installed as channel tabs, but that doesn’t tell you if any of the tab-connected apps are used.

Teams Usage Reports

Microsoft added the Analytics and Reports section to the Teams admin center in 2019 and has since grown the set of available reports to:

• Apps usage
• PSTN blocked users
• PSTN and SMS minute pools (preview)
• PSTN and SMS usage (preview)
• Teams device usage
• Teams live event usage
• Teams usage
• Teams user activity

Most of the reports are available for the last 7, 30, or 90 days, while the PSTN and SMS usage report is available for the last 7 or 28 days or a custom range (within the last 28 days). The Teams device and user activity information is available in the Reports section of the Microsoft 365 admin center, albeit in a different format. The data all comes from the same place: the Microsoft Graph.

Teams App Usage Report

The data available for app usage (Figure 1) is useful for understanding the level of use apps get across the tenant. If you spend time creating app setup policies to place apps in the navigation bar, you’d like to know that people are using the selected apps, and you can find this information out here. Likewise, if you see an app in heavy use that isn’t shown in the navigation pane, perhaps it’s time to include it there.

Unfortunately, you might have to do more digging than you should to get to the information. This is because the grid of apps under the graph can only be sorted by app name, which means that you can’t do something like sort the apps by heaviest usage.

Analyzing App Usage Data

To perform further analysis, you can export the data to Excel (a CSV file). In Figure 2 we can see that the heaviest used app is one called Teams (channel conversations) followed by Activity (the feed), Planner, and Files (SharePoint). What you might be surprised by here is that mainline Teams components show up as apps, but that’s the way Teams works.

Learn more about Teams in the Office 365 for IT Pros eBook. Over 200 pages of hard information about the way Teams works, just what you need to manage Teams effectively for your Office 365 tenant.