Teams, Channels & Governance Policies
MS-700 Exam Alignment
MS-700
Manage teams and channels: create and manage teams and channel types, configure Teams policies to control team creation and membership, implement naming policies and expiry policies, deploy Teams templates, and configure messaging policies.
- Know the three channel types — Standard, Private, Shared — and what each grants in terms of membership and visibility
- Configure a Teams policy to restrict team creation to a security group (not all users)
- Apply a naming policy with prefix/suffix rules and a blocked words list
- Set a team expiry policy and understand what happens when a team expires without renewal
- Distinguish Teams templates from team cloning — what each copies and what each does not
👥 Team Types
Teams in Microsoft Teams can be created in three visibility types. This is set at creation and controls who can find and join the team:
| Team Type | Who Can Join | Discoverable | Typical Use |
|---|---|---|---|
| Public | Any user in the organisation can join without approval | Yes — appears in Teams search, users can join freely | Company-wide announcements, interest groups, open communities |
| Private | Invitation only — owner must add members; join requests require approval | No — does not appear in Teams search for non-members | Project teams, departments, confidential workgroups |
| Org-wide | Automatically includes every licensed user in the tenant | N/A — all users are automatically members | Company-wide communication (limited to tenants with ≤ 10,000 users; max 5 org-wide teams per tenant) |
📢 Channel Types
Channels are the conversation and collaboration spaces within a team. Teams supports three distinct channel types — each with different membership, visibility, and storage behaviour.
| Standard Channel | Private Channel | Shared Channel | |
|---|---|---|---|
| Membership | All team members (inherited) | Specific subset of team members — invited by channel owner | Members of this team + members from other teams or external orgs |
| Visibility | Visible to all team members | Only visible to invited members — hidden from other team members | Visible only to shared channel members |
| SharePoint storage | Subfolder in the team's SharePoint site | Separate SharePoint site collection (own URL, own permissions) | Separate SharePoint site collection (own URL, own permissions) |
| External users | No — team members only | No — must be a team member first | Yes — via Azure B2B Direct Connect (no guest account needed in your tenant) |
| Max per team | 200 standard channels per team | 30 private channels per team | 30 shared channels per team (50 if only internal sharing) |
| Apps & tabs | Full app support | Limited app support | Limited app support |
⚠️ Private Channel — Own SharePoint Site Collection
This is the most important storage fact about private channels: each private channel creates its own separate SharePoint site collection with its own URL (e.g. contoso.sharepoint.com/sites/TeamName-PrivateChannelName). Files shared in a private channel are stored here — NOT in the parent team's SharePoint site. This means private channel files do not appear in the parent team's file tab. Admins must be aware of this when planning SharePoint storage quotas and eDiscovery scope.
💡 Shared Channels — B2B Direct Connect, Not Guest Access
Shared channels use Azure B2B Direct Connect to include external users — this is fundamentally different from guest access. With guest access, an external user gets a guest account created in your Azure AD. With B2B Direct Connect (shared channels), the external user authenticates with their own organisation's credentials — no guest account is created in your tenant. This means standard guest access policies do NOT control shared channel membership. External org sharing for shared channels is configured separately under Org-wide settings → External access.
🏗️ Managing Teams in the TAC
TAC › Teams › Manage teams
+ Add
Connect-MicrosoftTeams # Create a new private team New-Team -DisplayName "Sales Q3 Project" -Description "Q3 2026 Sales campaign team" -Visibility Private # List all teams in the tenant Get-Team | Select-Object DisplayName,Visibility,Archived,GroupId | Sort-Object DisplayName # Get channels for a specific team $team = Get-Team -DisplayName "Sales Q3 Project" Get-TeamChannel -GroupId $team.GroupId | Select-Object DisplayName,MembershipType # Add a standard channel New-TeamChannel -GroupId $team.GroupId -DisplayName "Campaign Assets" -MembershipType Standard # Add a private channel New-TeamChannel -GroupId $team.GroupId -DisplayName "Finance Approvals" -MembershipType Private # Archive a team (read-only, preserves data) Set-TeamArchivedState -GroupId $team.GroupId -Archived $true # Delete a team permanently Remove-Team -GroupId $team.GroupId
📋 Teams Policies
Teams policies (TAC → Teams → Teams policies) control what users can do with teams themselves — whether they can create teams, what channel types they can create, and more. Policies are assigned to users or groups.
| Policy Setting | What It Controls | Default |
|---|---|---|
| Create private channels | Whether users can create private channels in any team they own | On |
| Create shared channels | Whether users can create shared channels | On |
| Invite external users to shared channels | Whether users can share channels with people outside the organisation | On |
| Join external shared channels | Whether users can be invited to shared channels hosted by other organisations | On |
Restricting Team Creation
By default, any licensed user can create a new team. In most organisations this needs to be restricted to avoid sprawl. Team creation restriction is not in Teams policies — it is controlled via Microsoft 365 Groups settings in Azure AD / Entra ID.
⚠️ Team Creation is Controlled by M365 Groups Settings — Not TAC
This catches many candidates off-guard. To restrict who can create teams, you must restrict who can create Microsoft 365 Groups in Entra ID — because every team is backed by an M365 Group. This is done via PowerShell (Set-AzureADDirectorySetting or via Entra admin center), not in the Teams Admin Center. You specify a security group whose members are allowed to create groups/teams; all other users are blocked.
Connect-MicrosoftTeams Connect-MgGraph -Scopes "Directory.ReadWrite.All" # Get the current group unified settings $settings = Get-MgDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" } # If no setting exists yet, create it from the template if (-not $settings) { $template = Get-MgDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" } $params = @{ templateId = $template.Id; values = $template.Values } New-MgDirectorySetting -BodyParameter $params $settings = Get-MgDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" } } # Get the security group that will be allowed to create teams $allowedGroup = Get-MgGroup -Filter "DisplayName eq 'Teams-Creators'" | Select-Object -First 1 # Restrict group/team creation to members of that group $vals = $settings.Values ($vals | Where-Object Name -eq "EnableGroupCreation").Value = "false" ($vals | Where-Object Name -eq "GroupCreationAllowedGroupId").Value = $allowedGroup.Id Update-MgDirectorySetting -DirectorySettingId $settings.Id -Values $vals Write-Host "Team creation now restricted to Teams-Creators group members"
🏷️ Naming Policies
Team naming policies enforce consistent naming conventions across the tenant by adding automatic prefixes/suffixes to team names and blocking reserved words. Configured in Entra admin center → Groups → Naming policy (applies to all M365 Groups including Teams).
| Feature | How It Works | Example |
|---|---|---|
| Prefix | Text automatically prepended to every group/team name. Can be static text or a user attribute (Department, Company, etc.) | [Finance] Q3 Project → enforces department tagging |
| Suffix | Text automatically appended to every group/team name | Sales Team-UK → enforces country suffix |
| Blocked words | A comma-separated list of words users cannot use in team names (e.g. CEO, HR Confidential, Board) | Creating a team named "CEO Updates" fails if CEO is blocked |
💡 Naming Policy Exceptions
Global Administrators and Group Administrators in Entra ID are exempt from naming policies — they can create teams/groups with any name, including blocked words. Standard users and Teams Administrators are subject to the policy. This exemption is important to know for the MS-700 exam.
⏳ Team Expiry Policies
Team expiry policies automatically delete inactive teams after a configurable period. When a team is nearing expiry, the owner receives email notifications to renew it. Configured in Entra admin center → Groups → Expiration.
⚠️ What Happens When a Team Expires Without Renewal
- The Microsoft 365 Group (and its team) is soft-deleted — it enters a 30-day recovery window
- During the 30-day window, a Global Administrator can restore the group and team with all content intact
- After 30 days, the deletion becomes permanent — all chat history, files, channels, and the SharePoint site are deleted
- Teams with at least one channel activity (message posted, file uploaded) in the last 30 days are auto-renewed without prompting the owner
Connect-MicrosoftTeams Connect-MgGraph -Scopes "Group.Read.All","Directory.Read.All" # Find teams with zero channels (likely abandoned) Get-Team | ForEach-Object { $team = $_ $channels = (Get-TeamChannel -GroupId $team.GroupId -ErrorAction SilentlyContinue | Measure-Object).Count [PSCustomObject]@{ TeamName = $team.DisplayName Visibility = $team.Visibility Archived = $team.Archived ChannelCount = $channels } } | Where-Object ChannelCount -eq 0 | Sort-Object TeamName # List all archived teams Get-Team | Where-Object Archived -eq $true | Select-Object DisplayName,Visibility,GroupId # Unarchive a specific team $team = Get-Team -DisplayName "Old Project Team" Set-TeamArchivedState -GroupId $team.GroupId -Archived $false
🏛️ Teams Templates
Teams templates let you create a new team pre-populated with a defined set of channels, tabs, and apps — saving setup time for repeating project or department structures. Templates are managed in TAC → Teams → Templates.
| Teams Template | Team Clone (Copy team) | |
|---|---|---|
| What it creates | New team with predefined channels, tabs, and installed apps from the template definition | New team copying the structure (channels, tabs, apps) from an existing team |
| Content copied | Structure only — no messages, no files, no members | Structure only — no messages, no files; members optionally copied |
| Managed by | Admin in TAC (or end users from custom templates) | End users (from Teams client) or admins |
| Use case | Standardised onboarding (e.g. "New Employee" template creates HR, IT, Benefits channels automatically) | Quickly reuse an existing team's structure for a similar project |
| Tab apps | Included as placeholder tabs (apps installed but may need reconfiguring) | Tabs copied but may need reconfiguring for new context |
💬 Messaging Policies
Messaging policies control what users can do in Teams chats and channel messages. Configured in TAC → Messaging → Messaging policies. The Global (org-wide default) policy applies to all users without an explicit assignment.
| Policy Setting | What It Controls |
|---|---|
| Owners can delete sent messages | Whether team owners can delete messages posted by any team member in their channels |
| Delete sent messages | Whether users can delete their own messages |
| Edit sent messages | Whether users can edit their own sent messages (and for how long) |
| Read receipts | Whether read receipts (ticks) are shown in 1:1 chats — User controlled, Turned on, or Turned off |
| Chat | Whether the user can use chat at all |
| Giphy in messages | Whether users can insert Giphy animations — and if so, the content rating (Strict, Moderate, No restriction) |
| Memes and stickers | Whether meme and sticker editors are available in the compose box |
| URL previews | Whether pasted URLs automatically expand into rich preview cards |
| Translate messages | Whether users see the Translate option on messages in other languages |
| Priority notifications | Whether users can mark messages as Urgent (repeating notifications) — can be limited to avoid notification fatigue |
Connect-MicrosoftTeams # View all messaging policies Get-CsTeamsMessagingPolicy | Select-Object Identity,AllowGiphy,GiphyRatingType,AllowMemes,AllowUserChat,AllowPriorityMessages # Create a policy for frontline workers (minimal distractions) New-CsTeamsMessagingPolicy -Identity "Frontline-Messaging" -AllowGiphy $false -AllowMemes $false -AllowStickers $false -AllowUserDeleteMessage $false -AllowUserEditMessage $true -AllowPriorityMessages $false # Assign to a specific user Grant-CsTeamsMessagingPolicy -Identity user@techcareers.in -PolicyName "Frontline-Messaging" # Batch assign to multiple users New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "Frontline-Messaging" -Identity @("user1@techcareers.in","user2@techcareers.in")
💡 Best Practices
- Restrict team creation to a dedicated security group from day one — unrestricted team creation leads to hundreds of orphaned, unmanaged teams within months
- Set a team expiry policy with a 180-day renewal period — send renewal reminders at 30, 15, and 5 days. This automates cleanup without admin intervention
- Use Teams templates for all repeating team structures (project kickoff, department onboarding, support escalation) — it enforces consistency and reduces setup time to seconds
- Educate users on private vs shared channels before deployment — the most common confusion is expecting a private channel to appear in the parent team's files view (it won't — different SharePoint site)
- Set a naming policy with at least a department prefix — [Finance], [IT], [HR] — this makes Teams search dramatically more useful as the tenant grows
- Use the Global messaging policy as the baseline and create restrictive policies only for specific groups (frontline workers, external-facing roles) — avoid overcomplicating with many policies
🎓 Interview Q&A
EnableGroupCreation to false and set GroupCreationAllowedGroupId to the ObjectId of the IT-Champions security group. After this, only members of IT-Champions can create M365 Groups, which also restricts Teams creation. Global Administrators are exempt from this restriction regardless.A project team needs a channel visible only to the finance manager and two directors within the team, without other team members seeing it. Which channel type should be used?
A legal team needs to collaborate with external counsel at a partner law firm on a channel in Teams. The external lawyers should use their own firm credentials — no guest accounts should be created in your tenant. Which channel type supports this?
Users across the organisation are creating Teams with names like "Project", "Team 1", and "New Team" — making search impossible. You want all teams to automatically include the user's department in the name. What should you configure?
A user in the Finance team shared a file in a private channel called "Budget Planning". A colleague who is a member of the Finance team but NOT the private channel reports they cannot see the file in the team's Files tab. Why?
A team expiry policy is set to 90 days. A team owner ignores all renewal reminder emails and the team expires. An admin tries to restore the team 45 days after expiry. Is restoration possible?