Create a dream Teams · 2021. 6. 2. · Build a solid Microsoft Teams foundation from the moment of creation • Enable guest access. • Implement a process to periodically review

Create a dream TeamsMastering Microsoft Teams management across the entire lifecycle

Sh

are

Gate

by G

Soft

ShareGate by GSoft

Jasper Oosterveld

Microsoft MVP & Modern

Workplace Consultant at InSpark

Laurent St-Pierre

Community Enablement Manager

at ShareGate

Agenda

• Part I: Build a solid Microsoft Teams foundation from the moment of creation

• Part II: Maintain a healthy and secure Microsoft Teams environment—at scale

• Part III: Defining end-of-life strategies to keep your Teams organized and up-to-date

Goal

Cover beginning-of-life best practices to help you

understand why users create their teams—so you

can apply the right governance policies and security

settings from the moment of creation.

Build a solid Microsoft Teams foundation from the moment of creation

Main topics


• Creation process

• Collaboration process

• Classification process

Creation process


Why do business users create teams?


• Collaborate with colleagues

• Collaborate with colleagues and guests

Who can create a team?


• All employees

• A selection of employees

• Delegated to IT

Where can you create a team?


• Microsoft Teams application

• Provisioning solution

• SharePoint team site

• Microsoft 365 administration center

What are Teams templates?


• 13 out-of-the-box templates for different scenarios

• Customize or create your own

• Add additional channels and tabs per template

• Assign one or more templates per policy for all, or a

selection of, employees

Example: Select a Teams template


What is a naming policy?

A naming policy allows you to provide a team with a

pre-defined naming convention.


Three options to apply a naming policy


• Provisioning solution

• Manually by the business users

• Azure Active Directory

(requires Azure Premium P1 license)

What are our recommendations?


• Naming policy exposes the purpose and goal of a team.

• Increasing the ease-of-maintenance for the IT

administrator.

Collaboration process


P1: Build a solid Microsoft Teams foundation from the moment of creation

External sharing


What is external sharing?


• Instead of inviting a guest into the entire team, business

users share one or more files with a guest.

• The guest receives an e-mail with a link to the files.

• The guest has to enter a verification code.

Verification code (1)






What type of sharing links are available?


• Everyone

• New & existing guests

• Existing guests

• Disabled

Where do you manage external sharing?


• SharePoint Online administration center.

• Sensitivity labels through Microsoft Information Protection

Protection framework (MIP)

• A third-party tool like ShareGate Apricot

What is our recommendation?


• Enable external sharing with new & existing guests.

• Implement a periodic review of sharing links.

(More on that in session 2!)

• Educate your team owners & members.

• Start with defining your classification scheme & strategy.

Guest access


What are guests?


• People without a Microsoft 365 license assigned

from your organization.

Why would you allow guests in Teams?


• Reduce shadow IT.

• Provide an efficient collaboration experience.

• More control & insights into who’s working with

your colleagues & content.

What can a guest do in Teams?


• The permissions are set within the Microsoft Teams

Administrator Guest Access & settings of the

specific team.

Guest Access Settings


Team Settings


How do you enable guest access?


• Azure Active Directory

• Microsoft 365 admin center

• Microsoft Teams admin center

What guests can be invited?


IT administrators allow invitations to be sent to any domain

(most inclusive)

OR

Deny invitations to the specified domains

OR

Allow invitations only to the specified domains (most

restrictive)

Invitations & domains


How are guests invited?


IT administrators add guests in Azure AD

OR

Owners of a team invite guests.

Be aware:

• A guest is considered a member!

• A guest receives access to all the content of the public

channels.

What are our recommendations?


• Enable guest access.

• Implement a process to periodically review guests. (more

on that in session 2!)

• Enable MFA for guests.

• Educate your team owners.

• Work with private channels for internal collaboration.

• Start with defining your classification scheme & strategy.

Collaboration settings


What are important policies?


1. Teams policies: Enable private channels.

2. App policy: Enable Microsoft Apps & limit or block 3rd

party apps.

Review the Team & channel settings


Classification process


P1: Build a solid Microsoft Teams foundation from the moment of creation

What is classification?


1. Classify a team according to its purpose.

For example: Project or department.

2. Classify a team according to its level of sensitivity.

For example: Internal or Highly Sensitive.

How to create a classification scheme?


• The classification scheme is often determined by the

regulation of your country or company industry.

For example: E.U. GDPR or U.S. Health Insurance Act

(HIPAA)

Real-world classification scheme

Non-business data,

for personal use only.

Company

data specifically

prepared and approved

for public use.

Company data intended

for general use within

and outside the

organization (business

partners).

Sensitive company data

that poses a business

risk if it is shared with

unauthorized people.

Highly sensitive

company data that

poses a business risk

if it is shared with

unauthorized people.

Personal Public Internal Confidential Top secret


What classification options are there?


• Sensitivity labels with Microsoft Information

Protection (MIP)

• ShareGate Apricot’s group purpose and sensitivity tags

How do sensitivity labels work with Teams?


• The sensitivity label is assigned during or after the creation of a team.

• Enforce the following security settings for a team:

• Privacy of the team

• Enable or disable guest access

• Type of external sharing link

• The type of access to SharePoint content with unmanaged devices

Be aware: Enabling this feature requires that you possess at least one active

Azure Active Directory Premium P1 license.



What is our recommendation?


1. Start defining your classification scheme for Teams.

2. Implement a classification/tagging system for Teams.

Takeaways from part I


• Talk with your business users about their requirements and needs.

• Enable guest access & sharing links at the organization level.

• Define & implement your classification scheme & strategy.

Resources


• Teams template capabilities & limits

• Manage who can create Microsoft 365 Groups

• Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and

SharePoint sites

• Detailed Microsoft 365 Compliance Licensing Comparison PDF (April 2021)

https://docs.microsoft.com/en-us/microsoftteams/get-started-with-teams-templates-in-the-admin-console

https://docs.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view=o365-worldwide

Contact us

Jappie 🧘🏼♂️ (@jasoosterveld) | Twitter

Jasper Oosterveld | LinkedIn

Jasper Oosterveld - Microsoft MVP | Website

ShareGate (@sharegatetools) | Twitter

ShareGate (@sharegate) | LinkedIn

Sharegate.com | Website


https://twitter.com/jasoosterveld

https://www.linkedin.com/in/jasperoosterveld/

https://www.jasperoosterveld.com/

https://twitter.com/sharegatetools/



https://www.linkedin.com/company/sharegate/



http://sharegate.com/

Create a dream Teams · 2021. 6. 2. · Build a solid Microsoft Teams foundation from the moment of creation • Enable guest access. • Implement a process to periodically review

Documents