-->
Teams provides a rich set of tools to implement any governance capabilities your organization might require. This article guides IT pros to ask the right questions to determine their requirements for governance, and how to meet them.
Special character does not work in Teams Chat I am not sure and cannot find the answer to the question in the subject line, so I thought to ask the community. I found a list of ALT-# that provides me the capability to show special characters. Think of a “team” as a house. In Microsoft Teams you work in different “teams”. You can think of.
Tip
Watch the following session to learn about more about Governance in Microsoft Teams: Governance, management and lifecycle in Microsoft Teams
Group and team creation, naming, classification, and guest access
Your organization might require that you implement strict controls on how teams are named and classified, whether guests can be added as team members, and who can create teams. You can configure these areas by using Azure Active Directory (Azure AD) and sensitivity labels.
| - | - | - |
|---|---|---|
| Decision points |
| |
| Next steps |
|
Note
To help you plan ahead, learn more about setting these policies and what licenses they require.
Note
Limiting group and team creation can slow your users’ productivity, because many Microsoft 365 and Office 365 services require that groups be created for the service to function. For additional information, navigate to and expand Why control who creates Microsoft 365 Groups.
Additional information
After you’ve determined your requirements, you can implement them by using Azure AD controls. For technical guidance on how to implement these settings, see:
Group and team expiration, retention, and archiving
Your organization might have additional requirements for setting policies for expiration, retention, and archiving teams and teams data (channel messages and channel files). You can configure group expiration policies to automatically manage the lifecycle of the group and retention policies to preserve or delete information as needed, and you can archive teams (set them to read-only mode) to preserve a point-in-time view of a team that’s no longer active. Note that teams that are archived continue to have the expiration policy applied and may be deleted unless excluded or renewed.
| - | - |
|---|---|
Decision points |
|
Next steps |
|
Tip
Use the following table to capture your organization’s requirements.
| Capability | Details | Azure AD Premium license required | Decision |
|---|---|---|---|
| Expiration policy | Manage the lifecycle of Microsoft 365 groups by setting an expiration policy. | P1 | TBD |
| Retention policy | Retain or delete data for a specific time period by setting retention policies for Teams in the Security & compliance center. Note: Using this feature requires licensing of Microsoft 365 or Office 365 Enterprise E3 or above. | No | TBD |
| Archive and restore | Archive a team when it’s no longer active but you want to keep it around for reference or to reactivate in the future. | No | TBD |
Note
Group expiration is an Azure AD Premium feature. For this feature to be available, your tenant must have a subscription to Azure AD Premium and licenses for the administrator who configures the settings and the members of the affected groups.
Additional information
What Does Microsoft Teams Helper Do
For technical guidance on how to implement these settings, see:
Set up Microsoft 365 groups expiration.
Set up Teams retention policies.
Archive or restore a team.
Group and team membership management
Consistently managing members of project based, or restricted groups are necessary for teams that require rapid onboarding and offboarding or users and guests. Your organization may also need to make sure all current members have the business justification to be in a team. Managing members can be hard because team owners can leave and users don’t usually leave groups on their own accord when a project ends or when they change roles. The best way to manage group membership that allows users to get access when needed but ensure the group doesn't have a risk of inappropriate access is through two district processes: entitlement management and access reviews.
Entitlement management allows you to delegate to someone, such as a project manager, to collect all the resources that are needed, including teams memberships, into a single package. They can also define who can make requests: either users in your tenant or from other connected organizations. The project manager will receive access requests in their email and approve or deny requests in the MyAccess portal. Administrators can configure the conditions of access to include an expiry date or period by when the user or guest will be removed from the team unless access is renewed. Administrators can also set up the groups associated with teams to take part in access reviews. For access reviews, the group owners will receive regular reminders to review the members of a team. Access reviews include recommendations, which makes it easier for group owners to go through their regular attestation process.
| - | - | - |
|---|---|---|
| Decision points | Does your organization require a consistent process for managing membership of one or more teams? Does your organization require owners, or the members themselves, to justify their continued membership of one or more teams on a regular basis? Does your organization require approval for users and guests to request access to resources including teams, groups, SharePoint sites, and apps? | |
| Next steps? | Document your organizations requirements for each team or specific teams for membership expiry. Plan how your organization can bundle teams, groups, SharePoint sites, and apps together in access packages. Plan which people, such as the requestor's manager, a project manager, a sponsor for a connected organization or a security officer in your organization will need to approve or deny access requests. |
Tip
Use the following table to capture your organization’s requirements.
| Capability | Details | Azure AD Premium license required | Decision |
|---|---|---|---|
| Access reviews | Setup access reviews to recertify the membership of specific teams at regular interval | P2 | TBD |
| Entitlement management | Setup access package to allow users and guests to request access to teams | P2 | TBD |
Note
To help you plan ahead, learn more about what licenses they require.
Additional information
For technical guidance on how to implement these settings, see:
Teams feature management
Another important aspect of governance and lifecycle management for Teams is the ability to control what features your users will have access to. You can manage messaging, meeting, and calling features, either at the Microsoft 365 or Office 365 organization level or per-user.
| - | - |
|---|---|
Decision points |
|
Next steps |
|
Teams feature management focus areas
Teams provides granular capabilities for controlling messaging, meeting, calling, and live event features and more, via policies. Different policies can be applied to all users by default or per user as required by your organization.
For detailed lists of all settings, including technical guidance on how to implement them for your organization, see the following articles:
Additionally, you can set up moderation for a channel and give moderator capabilities to certain users so that they can control who can create channel posts and respond to them. See Set up and manage channel moderation in Microsoft Teams for more information.
Security and compliance
Teams is built on the advanced security and compliance capabilities of Microsoft 365 and Office 365 and supports auditing and reporting, compliance content search, e-discovery, Legal Hold, and retention policies.
Important
If your organization has compliance and security requirements, review the in-depth content provided about this topic in the article Overview of security and compliance in Microsoft Teams.
Related topics
Summary
This guide provides a Microsoft Teams Rooms (MTR) application remediation tool for systems that may experience issues that affect starting the application. The tool that is described in this document is a PowerShell script that tries to remedy the issue and update the application to a single, consistent version.
More information
After you update MTR from a release earlier than 4.4.41.0, a small subset of MTR may experience an issue that affects the Microsoft Store deployment engine in which the application does not start. All systems that are recovered by using any version of this tool are expected to work correctly. However, you may have a situation in which a system that is running an earlier build of MTR (for example, a new deployment of hardware that was pre-installed with a previous version) stops working when you try to update to MTR release 4.4.41.0 or later. In this case, you can download this PowerShell script, and then run the following PowerShell command:
Run powershell -executionpolicy unrestricted .MTRemediate-4.4.63.0.ps1
Notes:
If you are running the script from the SYSTEM context, you will have to pass the -Arm switch after the script file name to explicitly request arming.
If the script is not in the same path as your current working directory, you will have to specify an appropriate path to the script file. It's permitted to run the file from a network share (the script will automatically copy itself locally to the computer that it's run on).
The -Disarm switch can be used after the script file name to explicitly request that the script undo the changes it usually makes when it arms. In the unlikely event that the script gets stuck or otherwise does not clean up a system from the armed state, you can use this switch to force the clean up to run again.
The computer will restart multiple times, and the process will take 10-45 minutes to finish. Any of the following conditions indicates that the system process is finished:
Running the script by using the -Check flag generates a 'Disarmed' message.
The log file indicates that the script finished running.
The C:RigelMTRemediate.ps1 file no longer exists.
The log output for the tool is available from the following location:
C:UsersSkypeAppDataLocalPackagesMicrosoft.SkypeRoomSystem_8wekyb3d8bbweLocalStateTracingMTRemediate
Check this file for information about whether the remediation process is successful. If the tool encounters a problem, it should automatically generate a compressed log file in C:Rigel. This compressed log file will contain the traces from running the tool, in addition to other system logs.
If the tool does not automatically resolve your problem, and you are running Windows 10, version 1909 or 1903, re-run the script by using the following PowerShell script:
powershell -executionpolicy unrestricted .MTRemediate-4.5.35.0.ps1 -Uninstall
This will force a more aggressive recovery. Notice that this mode risks losing both the application settings and the diagnostic logs that the script generates in case of errors. Therefore, we do not recommend that you use this mode in typical conditions.
How Does Microsoft Teams Work
If your problem is not resolved by this tool, it’s possible that your system is in an unrecoverable state. In this case, you may have to reimage it by using a recovery image that’s provided by the device OEM.
For additional help, contact your customer service representative to help identify and resolve the problem. Make sure that you provide the log output of this tool when you request support.
Still need help? Go to Microsoft Community.