Module 2: Teams, Channels & Governance Policies

🎯 Teams Administration Course · Module 2 of 6

Teams, Channels & Governance Policies

MS-700
MS-700 Exam Alignment
MS-700

Manage teams and channels: create and manage teams and channel types, configure Teams policies to control team creation and membership, implement naming policies and expiry policies, deploy Teams templates, and configure messaging policies.

  • Know the three channel types — Standard, Private, Shared — and what each grants in terms of membership and visibility
  • Configure a Teams policy to restrict team creation to a security group (not all users)
  • Apply a naming policy with prefix/suffix rules and a blocked words list
  • Set a team expiry policy and understand what happens when a team expires without renewal
  • Distinguish Teams templates from team cloning — what each copies and what each does not
Exam Tip: MS-700 tests channel type access rules precisely. Know: Standard channels — all team members. Private channels — invited subset only, own SharePoint site collection. Shared channels — members of multiple different teams or external users (no guest account required). Shared channels use Azure B2B Direct Connect, not guest access.
The Teams and channels structure is the foundation of how your organisation collaborates. As an administrator, you control who can create teams, how channels work, what teams are named, how long they live, and what policies govern messaging. Getting these right before users flood the tenant with unmanaged teams is the difference between a well-governed collaboration environment and a chaotic sprawl of hundreds of forgotten teams.

👥 Team Types

Teams in Microsoft Teams can be created in three visibility types. This is set at creation and controls who can find and join the team:

Team Type Who Can Join Discoverable Typical Use
Public Any user in the organisation can join without approval Yes — appears in Teams search, users can join freely Company-wide announcements, interest groups, open communities
Private Invitation only — owner must add members; join requests require approval No — does not appear in Teams search for non-members Project teams, departments, confidential workgroups
Org-wide Automatically includes every licensed user in the tenant N/A — all users are automatically members Company-wide communication (limited to tenants with ≤ 10,000 users; max 5 org-wide teams per tenant)

📢 Channel Types

Channels are the conversation and collaboration spaces within a team. Teams supports three distinct channel types — each with different membership, visibility, and storage behaviour.

Standard Channel Private Channel Shared Channel
Membership All team members (inherited) Specific subset of team members — invited by channel owner Members of this team + members from other teams or external orgs
Visibility Visible to all team members Only visible to invited members — hidden from other team members Visible only to shared channel members
SharePoint storage Subfolder in the team's SharePoint site Separate SharePoint site collection (own URL, own permissions) Separate SharePoint site collection (own URL, own permissions)
External users No — team members only No — must be a team member first Yes — via Azure B2B Direct Connect (no guest account needed in your tenant)
Max per team 200 standard channels per team 30 private channels per team 30 shared channels per team (50 if only internal sharing)
Apps & tabs Full app support Limited app support Limited app support

⚠️ Private Channel — Own SharePoint Site Collection

This is the most important storage fact about private channels: each private channel creates its own separate SharePoint site collection with its own URL (e.g. contoso.sharepoint.com/sites/TeamName-PrivateChannelName). Files shared in a private channel are stored here — NOT in the parent team's SharePoint site. This means private channel files do not appear in the parent team's file tab. Admins must be aware of this when planning SharePoint storage quotas and eDiscovery scope.

💡 Shared Channels — B2B Direct Connect, Not Guest Access

Shared channels use Azure B2B Direct Connect to include external users — this is fundamentally different from guest access. With guest access, an external user gets a guest account created in your Azure AD. With B2B Direct Connect (shared channels), the external user authenticates with their own organisation's credentials — no guest account is created in your tenant. This means standard guest access policies do NOT control shared channel membership. External org sharing for shared channels is configured separately under Org-wide settings → External access.

🏗️ Managing Teams in the TAC


TAC Teams Manage teams
TAC
Microsoft Teams admin center
|
Teams › Manage teams
🏠 Dashboard
👥 Teams
Manage teams
Teams policies
Templates
Update policies
👤 Users
📅 Meetings

Manage teams
+ Add
NameTypeMembersChannels
All CompanyOrg-wide1,2473
Sales Q3 ProjectPrivate125
IT Help DeskPublic898

PowerShell — Create & Manage Teams

Connect-MicrosoftTeams

# Create a new private team
New-Team -DisplayName "Sales Q3 Project" -Description "Q3 2026 Sales campaign team" -Visibility Private

# List all teams in the tenant
Get-Team | Select-Object DisplayName,Visibility,Archived,GroupId | Sort-Object DisplayName

# Get channels for a specific team
$team = Get-Team -DisplayName "Sales Q3 Project"
Get-TeamChannel -GroupId $team.GroupId | Select-Object DisplayName,MembershipType

# Add a standard channel
New-TeamChannel -GroupId $team.GroupId -DisplayName "Campaign Assets" -MembershipType Standard

# Add a private channel
New-TeamChannel -GroupId $team.GroupId -DisplayName "Finance Approvals" -MembershipType Private

# Archive a team (read-only, preserves data)
Set-TeamArchivedState -GroupId $team.GroupId -Archived $true

# Delete a team permanently
Remove-Team -GroupId $team.GroupId

📋 Teams Policies

Teams policies (TAC → Teams → Teams policies) control what users can do with teams themselves — whether they can create teams, what channel types they can create, and more. Policies are assigned to users or groups.

Policy Setting What It Controls Default
Create private channels Whether users can create private channels in any team they own On
Create shared channels Whether users can create shared channels On
Invite external users to shared channels Whether users can share channels with people outside the organisation On
Join external shared channels Whether users can be invited to shared channels hosted by other organisations On

Restricting Team Creation

By default, any licensed user can create a new team. In most organisations this needs to be restricted to avoid sprawl. Team creation restriction is not in Teams policies — it is controlled via Microsoft 365 Groups settings in Azure AD / Entra ID.

⚠️ Team Creation is Controlled by M365 Groups Settings — Not TAC

This catches many candidates off-guard. To restrict who can create teams, you must restrict who can create Microsoft 365 Groups in Entra ID — because every team is backed by an M365 Group. This is done via PowerShell (Set-AzureADDirectorySetting or via Entra admin center), not in the Teams Admin Center. You specify a security group whose members are allowed to create groups/teams; all other users are blocked.

PowerShell — Restrict Team/Group Creation to a Security Group

Connect-MicrosoftTeams
Connect-MgGraph -Scopes "Directory.ReadWrite.All"

# Get the current group unified settings
$settings = Get-MgDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }

# If no setting exists yet, create it from the template
if (-not $settings) {
  $template = Get-MgDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }
  $params = @{ templateId = $template.Id; values = $template.Values }
  New-MgDirectorySetting -BodyParameter $params
  $settings = Get-MgDirectorySetting | Where-Object { $_.DisplayName -eq "Group.Unified" }
}

# Get the security group that will be allowed to create teams
$allowedGroup = Get-MgGroup -Filter "DisplayName eq 'Teams-Creators'" | Select-Object -First 1

# Restrict group/team creation to members of that group
$vals = $settings.Values
($vals | Where-Object Name -eq "EnableGroupCreation").Value = "false"
($vals | Where-Object Name -eq "GroupCreationAllowedGroupId").Value = $allowedGroup.Id
Update-MgDirectorySetting -DirectorySettingId $settings.Id -Values $vals

Write-Host "Team creation now restricted to Teams-Creators group members"

🏷️ Naming Policies

Team naming policies enforce consistent naming conventions across the tenant by adding automatic prefixes/suffixes to team names and blocking reserved words. Configured in Entra admin center → Groups → Naming policy (applies to all M365 Groups including Teams).

Feature How It Works Example
Prefix Text automatically prepended to every group/team name. Can be static text or a user attribute (Department, Company, etc.) [Finance] Q3 Project → enforces department tagging
Suffix Text automatically appended to every group/team name Sales Team-UK → enforces country suffix
Blocked words A comma-separated list of words users cannot use in team names (e.g. CEO, HR Confidential, Board) Creating a team named "CEO Updates" fails if CEO is blocked

💡 Naming Policy Exceptions

Global Administrators and Group Administrators in Entra ID are exempt from naming policies — they can create teams/groups with any name, including blocked words. Standard users and Teams Administrators are subject to the policy. This exemption is important to know for the MS-700 exam.

⏳ Team Expiry Policies

Team expiry policies automatically delete inactive teams after a configurable period. When a team is nearing expiry, the owner receives email notifications to renew it. Configured in Entra admin center → Groups → Expiration.

⚠️ What Happens When a Team Expires Without Renewal

  • The Microsoft 365 Group (and its team) is soft-deleted — it enters a 30-day recovery window
  • During the 30-day window, a Global Administrator can restore the group and team with all content intact
  • After 30 days, the deletion becomes permanent — all chat history, files, channels, and the SharePoint site are deleted
  • Teams with at least one channel activity (message posted, file uploaded) in the last 30 days are auto-renewed without prompting the owner
PowerShell — Manage Team Lifecycle (Naming & Expiry queries)

Connect-MicrosoftTeams
Connect-MgGraph -Scopes "Group.Read.All","Directory.Read.All"

# Find teams with zero channels (likely abandoned)
Get-Team | ForEach-Object {
  $team = $_
  $channels = (Get-TeamChannel -GroupId $team.GroupId -ErrorAction SilentlyContinue | Measure-Object).Count
  [PSCustomObject]@{
    TeamName     = $team.DisplayName
    Visibility   = $team.Visibility
    Archived     = $team.Archived
    ChannelCount = $channels
  }
} | Where-Object ChannelCount -eq 0 | Sort-Object TeamName

# List all archived teams
Get-Team | Where-Object Archived -eq $true | Select-Object DisplayName,Visibility,GroupId

# Unarchive a specific team
$team = Get-Team -DisplayName "Old Project Team"
Set-TeamArchivedState -GroupId $team.GroupId -Archived $false

🏛️ Teams Templates

Teams templates let you create a new team pre-populated with a defined set of channels, tabs, and apps — saving setup time for repeating project or department structures. Templates are managed in TAC → Teams → Templates.

Teams Template Team Clone (Copy team)
What it creates New team with predefined channels, tabs, and installed apps from the template definition New team copying the structure (channels, tabs, apps) from an existing team
Content copied Structure only — no messages, no files, no members Structure only — no messages, no files; members optionally copied
Managed by Admin in TAC (or end users from custom templates) End users (from Teams client) or admins
Use case Standardised onboarding (e.g. "New Employee" template creates HR, IT, Benefits channels automatically) Quickly reuse an existing team's structure for a similar project
Tab apps Included as placeholder tabs (apps installed but may need reconfiguring) Tabs copied but may need reconfiguring for new context

💬 Messaging Policies

Messaging policies control what users can do in Teams chats and channel messages. Configured in TAC → Messaging → Messaging policies. The Global (org-wide default) policy applies to all users without an explicit assignment.

Policy Setting What It Controls
Owners can delete sent messages Whether team owners can delete messages posted by any team member in their channels
Delete sent messages Whether users can delete their own messages
Edit sent messages Whether users can edit their own sent messages (and for how long)
Read receipts Whether read receipts (ticks) are shown in 1:1 chats — User controlled, Turned on, or Turned off
Chat Whether the user can use chat at all
Giphy in messages Whether users can insert Giphy animations — and if so, the content rating (Strict, Moderate, No restriction)
Memes and stickers Whether meme and sticker editors are available in the compose box
URL previews Whether pasted URLs automatically expand into rich preview cards
Translate messages Whether users see the Translate option on messages in other languages
Priority notifications Whether users can mark messages as Urgent (repeating notifications) — can be limited to avoid notification fatigue
PowerShell — Messaging Policies

Connect-MicrosoftTeams

# View all messaging policies
Get-CsTeamsMessagingPolicy | Select-Object Identity,AllowGiphy,GiphyRatingType,AllowMemes,AllowUserChat,AllowPriorityMessages

# Create a policy for frontline workers (minimal distractions)
New-CsTeamsMessagingPolicy -Identity "Frontline-Messaging" -AllowGiphy $false -AllowMemes $false -AllowStickers $false -AllowUserDeleteMessage $false -AllowUserEditMessage $true -AllowPriorityMessages $false

# Assign to a specific user
Grant-CsTeamsMessagingPolicy -Identity user@techcareers.in -PolicyName "Frontline-Messaging"

# Batch assign to multiple users
New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "Frontline-Messaging" -Identity @("user1@techcareers.in","user2@techcareers.in")

💡 Best Practices

  • Restrict team creation to a dedicated security group from day one — unrestricted team creation leads to hundreds of orphaned, unmanaged teams within months
  • Set a team expiry policy with a 180-day renewal period — send renewal reminders at 30, 15, and 5 days. This automates cleanup without admin intervention
  • Use Teams templates for all repeating team structures (project kickoff, department onboarding, support escalation) — it enforces consistency and reduces setup time to seconds
  • Educate users on private vs shared channels before deployment — the most common confusion is expecting a private channel to appear in the parent team's files view (it won't — different SharePoint site)
  • Set a naming policy with at least a department prefix — [Finance], [IT], [HR] — this makes Teams search dramatically more useful as the tenant grows
  • Use the Global messaging policy as the baseline and create restrictive policies only for specific groups (frontline workers, external-facing roles) — avoid overcomplicating with many policies

🎓 Interview Q&A

Q: What is the difference between a private channel and a shared channel in Microsoft Teams?
A private channel is visible only to specific members within the same team — it creates its own separate SharePoint site collection for file storage and limits membership to a subset of the parent team's members. Users must already be team members to be added to a private channel. A shared channel can include members from other teams or external users from other Microsoft 365 organisations — without creating a guest account in your tenant. Shared channels use Azure B2B Direct Connect for external membership, which is distinct from guest access. Both channel types create their own SharePoint site collections separate from the parent team.

Q: Your organisation wants to prevent most users from creating new Teams. Only members of the IT-Champions security group should be allowed. How do you configure this?
Team creation is controlled by Microsoft 365 Group creation settings in Entra ID — not in the Teams Admin Center itself. Use PowerShell to update the Group.Unified directory setting: set EnableGroupCreation to false and set GroupCreationAllowedGroupId to the ObjectId of the IT-Champions security group. After this, only members of IT-Champions can create M365 Groups, which also restricts Teams creation. Global Administrators are exempt from this restriction regardless.

Q: A team expiry policy is configured with a 180-day lifetime. A team owner does not respond to the renewal emails and the team expires. What happens?
The team's backing Microsoft 365 Group is soft-deleted — it enters a 30-day recovery window where a Global Administrator can restore it with all content (chats, files, channels) intact. If no one restores it within 30 days, the deletion becomes permanent — all data including the SharePoint site, mailbox, and channel history is deleted with no recovery possible. Teams with recent activity (a message posted, file uploaded within the last 30 days) are automatically renewed without prompting the owner.

Q: What does a Teams naming policy do, and which users are exempt from it?
A Teams naming policy (configured in Entra admin center under Groups → Naming policy) automatically adds a prefix and/or suffix to every new team (M365 Group) name and blocks specified reserved words. For example, a prefix of "[Finance]" applied via the Department attribute would create "[Finance] Q3 Budget" from a user typing "Q3 Budget". Global Administrators and Group Administrators are exempt from naming policies — they can create groups with any name including blocked words. All other users, including Teams Administrators, are subject to the policy.

Q: What is the difference between a Teams template and cloning an existing team?
A Teams template is a pre-defined structure (channels, tabs, pinned apps) stored in the Teams Admin Center that can be selected when creating a new team — it creates the structure from scratch. A team clone (Copy team) copies the channel structure, tabs, and apps from an existing live team to create a new one. Both copy structure only — no messages, no files, and no chat history are copied in either case. Templates are better for standardised recurring patterns (managed centrally by admins); cloning is better for quick reuse of an existing team's specific configuration.

🎯 MS-700 Mock Test
Module 2 — Teams, Channels & Governance Policies
5 questions · Scenario-based · MS-700 exam style · Pass mark: 70%

Question 1 of 5

A project team needs a channel visible only to the finance manager and two directors within the team, without other team members seeing it. Which channel type should be used?

AStandard channel — set channel permissions to restrict visibility
BShared channel — invite only the three people needed
CPrivate channel — membership is independent of the parent team and hidden from non-members
DCreate a separate team for the three people instead

Correct answer: C. A private channel is visible only to its invited members, hidden from all other team members — even the team owner (unless the owner is also invited). Standard channels (A) have no per-member visibility restriction — all team members can see them. Shared channels (B) are for including people from other teams or external organisations, not for restricting visibility within a team.

Question 2 of 5

A legal team needs to collaborate with external counsel at a partner law firm on a channel in Teams. The external lawyers should use their own firm credentials — no guest accounts should be created in your tenant. Which channel type supports this?

APrivate channel — external users can be invited to private channels
BShared channel — uses Azure B2B Direct Connect, no guest account required
CStandard channel — configure external access to allow the partner domain
DCreate a guest account for each external lawyer and add them to a private channel

Correct answer: B. Shared channels use Azure B2B Direct Connect — external users access the channel with their own organisation's credentials and no guest account is created in your tenant. Private channels (A) require users to be members of the parent team first; external users can only join as guests (which creates a guest account). Standard channels (C) don't support external user membership at all.

Question 3 of 5

Users across the organisation are creating Teams with names like "Project", "Team 1", and "New Team" — making search impossible. You want all teams to automatically include the user's department in the name. What should you configure?

AA naming policy in Entra admin center → Groups → Naming policy using the Department attribute as a prefix
BA Teams policy in TAC → Teams → Teams policies with a naming requirement
CA messaging policy with a required naming format field
DTrain users to follow naming conventions manually

Correct answer: A. Team naming policies are configured in Entra admin center (Groups → Naming policy), not in the Teams Admin Center. You can add a prefix based on the user's Department Azure AD attribute — Teams automatically prepends [Department] to whatever the user types. The Teams Admin Center (B) does not have a naming policy feature — this is always controlled at the M365 Groups level in Entra ID.

Question 4 of 5

A user in the Finance team shared a file in a private channel called "Budget Planning". A colleague who is a member of the Finance team but NOT the private channel reports they cannot see the file in the team's Files tab. Why?

AThe file was shared incorrectly — it should have been uploaded to the team's main Files tab
BThe colleague needs to be made a team owner to see all channel files
CPrivate channels have their own separate SharePoint site collection — files are not visible in the parent team's Files tab and only accessible to private channel members
DThere is a SharePoint permissions sync delay — the file will appear after 24 hours

Correct answer: C. This is expected behaviour — each private channel creates its own separate SharePoint site collection with independent permissions. Files uploaded in a private channel are stored in that separate site and are NOT visible in the parent team's Files tab. Only members of the private channel can access those files. There is no sync delay — this is a permanent architectural distinction.

Question 5 of 5

A team expiry policy is set to 90 days. A team owner ignores all renewal reminder emails and the team expires. An admin tries to restore the team 45 days after expiry. Is restoration possible?

ANo — once a team expires, all data is immediately and permanently deleted
BYes — expired teams are retained for 1 year before permanent deletion
CYes — the admin can restore from the Teams Admin Center within 90 days
DNo — the team was soft-deleted for 30 days after expiry; at 45 days it is permanently deleted and cannot be restored

Correct answer: D. When a team expires, the backing M365 Group is soft-deleted — it enters a 30-day recovery window. A Global Administrator can restore it within those 30 days. At 45 days post-expiry, the soft-deleted period has passed and the deletion is now permanent — all data including the SharePoint site, mailbox, and channel history is gone with no recovery possible.

🔒

This module is lockedComplete Module 1 and pass its mock test to unlock this module.