With the substantial uptick in Microsoft Teams activity over the past few months, some organizations have had to adjust for this growing demand by hiring/reallocating an administrator to handle the Teams workload. As the administrator, you may not know what to expect, which is why I’m going to lay out what a typical day as a Teams Administrator may look like for you. At a high level, we’ll be covering three main topics:
- Configuring Teams settings and policies
- Using PowerShell, dynamic groups, and Microsoft Graph to streamline administration
- Assigning licenses
By the end of this blog series you’ll feel ready to tackle anything your end-users throw at you (well maybe not EVERYTHING…but this is a good start)! So without further ado, let’s get to your first day of being a Teams administrator!
Configuring Teams Settings and Policies
Let’s start things off in the Microsoft 365 admin center and assign our administrator the Teams Service Administrator role. Within the Microsoft admin center, we can designate administrator roles based on the level of access that they require for managing Microsoft Teams. This can involve management of the entire workload or maybe just a small subset of delegated permissions for troubleshooting call quality or telephony issues. For this scenario, we’ll give our administrator the Teams Service Administrator role. We can do that by following these steps:
- In the left navigation, select Users> Active users.
- In the Active users list, select the user whom we’ll be assigning the admin roles to.
- Once you’ve selected the user, under Roles, select Manage roles.
- In the Manage roles card, select Admin center access and then select the Teams service admin checkbox.
- At the bottom of the card, select Save changes.
You can find out more about the Teams administrator roles here.
Now that we have the admin role assigned we can ensure the administrator has the right permissions to perform tasks like making someone an owner of a team. Let’s actually go do that! As the Teams service administrator, you can change the ownership role that a user has for a specific team. The two main team roles as a user are:
- Team owner(s) – The person/people who create the team. Team owners can make any member of their team a co-owner when they invite them to the team or at any point after they’ve joined the team. Having multiple team owners lets you share the responsibilities of managing settings and membership, including invitations.
- Team member(s) – The people who the owners invite to join their team.
We can make this change within the Teams Admin Center within Teams > Manage teams. Just find the team you want to manage and select it. In that team, you should see a Role column stating whether the user is an owner or a member. Locate a user that you want to make the owner and select the drop-down and change that user to an owner. As soon as you make the change, it will save the setting automatically.
What if the user we wanted to add as an owner of the team isn’t part of that team yet? No need to worry, we’d just select the ‘+ Add‘ option to add new members to the team. Once they’ve been added you can designate them as an owner if you’d like.
Now let’s say that your manager has reached out to you regarding users storing their files in Dropbox and Google Drive and you’ve received the order to disable all third-party storage options for your end-users. Going forward upper management has indicated that your end-users will be strictly using OneDrive for Business and SharePoint Online for their cloud file storage. Simple enough, as the administrator you can turn on/off file sharing and cloud file storage options all within the Teams admin center! You can do this by navigating to the Org-wide settings > Teams settings. Scroll down until you see Files and toggle off the different file storage options and then select Save. Done!
Your manager has been so impressed with your awesome work so far that he has another ask for you, but this time it involves Exchange. Upper management has indicated that they want to control whom they can find and communicate with, in the organization. This is where Teams scoped directory search comes into play. With scoped directory search you’ll be able to create a virtual boundary that will control how your end-users can find and communicate with others. Microsoft can do this by leveraging the Exchange Address Book policies to support this type of custom view. Once the policy has been enabled, the results that will be returned by the search will be scoped according to how you’ve configured the policy. With all that being said, your end-users won’t have the ability to search or discover teams when scoped search is in effect. So assuming your organization already has the Exchange Address Book policy defined in Exchange, you’ll just need to enable this within Teams as well for it to take effect there! We can do this within Teams Settings. Once there, just scroll down until you see the Search by name option. Now just toggle this setting to On and Save. All set!
Let’s say your organization has users dispersed throughout the world! Often times English won’t be their primary language and they may have a hard time reading or writing a message in English. Upper management has asked you to see if you can change this for all users in your organization so they can have the ability to translate their chats to their native language. You can make this quick change to inline message translation which will allow your end-users to automatically translate their Teams messages into the language that is specified by their personal language settings for Office 365. You can make this change within the Teams Admin Center > Messaging Policies. Since upper management has requested that you make this change for all users, you’ll want to change the Global (Org-wide default). Once there, find the Translate messages option and toggle it to On and then Save.
Note: If upper management had just requested you make this change for a small subset of users you could do this by creating a new messaging policy and assigning that newly created policy with Inline message translation enabled to that small subset of users.
The day has been progressing and you’ve received a new request from upper management indicating that they want to start restricting external meeting participants from having the ability to request or give control of content during a meeting. As the Teams administrator, you can control screen sharing capabilities in meetings by either letting users share an entire screen, an app, or a file. In addition, you control a user’s ability to give or request control, allow PowerPoint sharing, whiteboarding abilities, and sharing of notes. Lastly, you can control whether anonymous and external users can request control of a shared screen or not. Upper management has indicated that they want to restrict this for all users with the exception of the Sales Team and Human Resources who use this regularly and need this to remain enabled. No need to worry, we can make this change within the Teams Admin Center > Meeting Policies. Given our situation, we’ll want to disable this for the Global (Org-wide default) and then create a new meeting policy for our Sales and HR departments where this capability is still enabled. After you’ve selected Global (Org-wide default), find the Content Sharing section and make sure the Allow an external participant to give or request control is set to Off.
As for our Sales and HR departments that need this setting enabled, we’ll create a new meeting policy by going to Meetings > Meeting Policies. Once there, select the + Add option. In the new meeting policy box, we’ll enter something simple to distinguish this policy among the others, something like HR + Sales department meeting policy. For the description, we can just include something along the lines of Restricted policy used by HR and Sales departments. Now we’ll find that same setting for Allow an external participant to give or request control and set it to On and then Save. From there you will assign this newly created policy to your HR and Sales department users.
Upper management has been very happy with the recent changes you’ve made and has been looking into enabling Live Events within your organization. However, seeing as Live Events are new to them, they only want to deploy this on a very small scale to the IT folks in your department and only want them experimenting with it for the meantime. They’ve also indicated that transcription and recording would be a nice feature to have within a Live Event so they want these features turned on. As the administrator, you may or may not be familiar with Live Events, but basically, it enables your organization to broadcast video and meeting content to larger online audiences (i.e. town hall meetings). To enable Live Events for just your IT folks, this will require that we create a new Live Events policy. You can do this in the Teams Admin Center > Meetings > Live Events Policies. From there, we’ll select the Global (Org-wide default) and toggle Off the Allow Scheduling option (if it isn’t already off) and then Save. Now we’ll create a new Live Events policy by selecting the + Add option and naming our new policy something like IT Department Live Event Policy. Now just turn On the ‘Allow scheduling’ option (if it isn’t already on). In addition, since we’ve been asked to include transcription capabilities we’ll toggle the Allow transcription for attendees to On. Lastly, we’ll set the Who can join scheduled live events option to Specific users or groups since we only want our IT folks joining and also setting the who can record an event option to Organizer can record. Don’t forget to Save! From here, we’d just need to assign this newly created policy to our IT folks so they can start experimenting with Live Events!
It’s just about lunchtime now, but before you reach for that sandwich you need to handle one more request from upper management. They’ve stated that some users have been using unsanctioned apps within Microsoft Teams and they want to restrict app usage to only Microsoft apps for all users. No need to worry, as the Teams administrator you can control what apps you want to make available for your end-users. You can make these changes within the Microsoft Teams Admin Center > Teams Apps > Permission policies. Since we’re making this change for all users we’ll select the Global (Org-wide default) option. Once there, you’ll notice things are broken down into 3 different categories: Microsoft Apps, Third-party apps, and custom apps. In this situation, we’ll want Microsoft Apps to Allow all apps, while Third-party apps and Custom apps should be set to Block all apps. As always, don’t forget to Save your changes! Now you can go enjoy that sandwich!
Although we’ve only just scratched the surface on all the capabilities you can control within the Teams admin center, this should give you a good idea of what you may encounter from day-to-day. In the next blog, we’ll continue our “Day in the Life of a Teams Administrator” series by showing you how you can streamline your administration by using PowerShell, Microsoft Graph, and Dynamic groups! See you after lunch!
