Webinar deep dive into teams governance
•Download as PPTX, PDF•
0 likes•196 views
Whether you are already actively using Microsoft Teams or are just in the process of rolling it out, you do not want to forget about governance. Our experts share their vast experience on how they have guided clients in making the right decisions around Microsoft Teams governance for a successful rollout. In this first session, you will learn insights and best practices for: - Automated Teams Governance - Microsoft Teams Policies - External and Guest Access
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Webinar deep dive into teams governance
Similar to Webinar deep dive into teams governance (20)
More from Withum
More from Withum (20)
Recently uploaded
Recently uploaded (20)
Webinar deep dive into teams governance
- 1. WithumSmith+Brown, PC | BE IN A POSITION OF STRENGTH 1 SM Webinar: Deep Dive into Microsoft Teams Governance
- 2. WithumSmith+Brown, PC | BE IN A POSITION OF STRENGTH 2 SM Housekeeping Webinar is being recorded 45 minutes session 15 minutes Q&A or however long it takes session at the end Send in your questions! Type your questions in the Questions Pane of the GotoWebinar Panel Slides and recording will be emailed after the webinar
- 3. WithumSmith+Brown, PC | BE IN A POSITION OF STRENGTH 3 SM About Ashley Hickman Ashley Hickman Ahickman@Withum.com Project Manager/ Business Analyst 5+ years in technology consulting for commercial, non-profit and government clients Committed to providing user centric solutions Fun Fact: I love gardening! I currently have everything planted to make a summer salsa.
- 4. WithumSmith+Brown, PC | BE IN A POSITION OF STRENGTH 4 SM About Arya Parsee Arya Parsee aparsee@withum.com Senior Program Manager Began as a Developer implementing custom applications in SharePoint 2003-2016. Then I pivoted to managing projects, engaging with clients to solve their problems. Manages client relationships. Fun Fact: I love to run!
- 5. withum.com Withum | BE IN A POSITION OF STRENGTH What to Expect From Today’s Webinar •Automated Governance •Team Policies •External and Guest Access
- 6. withum.com Withum | BE IN A POSITION OF STRENGTH Future Governance Webinars • Apps Governance – Register Here • Teams Organization and Lifecycle • Guidance for Teams/Channel Creation
- 8. withum.com Standard Teams Functionality What functionality do you get standard within Teams? • Chat • Teams/Channels • Meetings • Voice • Apps, Bots and Connectors
- 9. withum.com Why Consider Automated Governance Components? Team Naming Policies Expiration Policies Retention Policies Security Group for Teams
- 10. withum.com Team Naming Policies Having a naming convention helps to manage the growth of Teams, Groups, and SharePoint. Creating a new Team also creates an Office 365 Group and SharePoint Site Collection.
- 11. withum.com Expiration Policies Teams can become the “wild wild west”
- 12. withum.com Retention Policies Keep data that’s needed to comply with your organization’s internal policies, industry regulations, or legal needs. Delete data that’s considered a liability, that you are no longer required to keep or has no value.
- 13. withum.com Security Groups for Team Creators It is often too easy for users to begin creating Teams! This leads to Teams Sprawl.
- 14. withum.com Added Licensing for Automated Governance Azure AD Premium Plan 1 provides additional governance features to supplement Teams which includes Teams Naming Policies, Expiration Policies and Security Group for Teams Creators Office 365 Enterprise E3 or above is needed for creating retention Policies
- 16. withum.com digital.withum.com What are Team Policies? Control what users in your organization can do in teams and channels
- 17. withum.com digital.withum.com Why setup a custom Policy? There is no one size fits all options for policies in Microsoft Teams. Every organization is different and need a way to manage Teams based on their needs.
- 18. withum.com digital.withum.com Some Important Team Policies To Consider Meeting Messaging Live Event Apps
- 19. withum.com digital.withum.com How Do Teams Policies Work? You can edit the global policy or create and assign a custom policy.
- 21. withum.com External Access Allows users outside your organization to find, call, chat, and set up meetings with you. External access is turned on by default within Teams.
- 22. withum.com Guest Access Guest access is turned off by default within Teams. Gives you the ability to add people from outside your organization to teams and channels.
- 23. withum.com Q&A
- 24. withum.com Next Steps – Download Teams Governance Tip Sheet Download Now Learn some of the key considerations and discussion points to get you started with governance planning for Teams.
Editor's Notes
- Just as a reminder please join us on August 20th for a demo-driven session of some popular Microsoft Teams applications including a custom Bot that Withum developed and of course best practices for app governance! We will also have a separate webinar down the road to cover Teams Organization and Lifecycle and Guidance's around Teams/Channel Creation
- With Microsoft Teams you get the following standard functionality Chat Teams/Channels Meetings Voice Apps, Bots and Connectors One thing to note is that additional add-on licenses are available for such things as Audio Conferencing, Toll Free Numbers and Phone Systems
- These are the most common automation use cases for teams that we see Specifying a naming convention Specifying an expiration date Specifying a retention policy Limiting who in the organization can create a Team
- It is important to know having a naming convention helps to manage the growth of Teams, Groups, and SharePoint. What is supported? Prefixes or suffixes to define the naming convention of Teams Custom blocked words Ashley what her thoughts are on naming conventions? I think naming conventions are a great way to provide structure and consistency for users. It helps with findability of Teams and Channels. It also can help minimize Team sprawl. Pre-fixes or suffixes can also distinguish internal Teams vs teams you may share with a vendor or guest
- Teams sometimes becomes the “wild wild west”. Lots of teams may get created in an organization that are never used. These teams if left unchecked can create a burden on tenant resources How do expiration policies work? Owners are notified to renew the Team as the expiration nears; Teams not renewed are automatically deleted (Notifications are received 30 days, 15 days and 1 day prior to expiration) Team owners can hit the Renew now in the team settings to renew the team Deleted (expired) Teams can be restored within 30 days by the Owner or a Teams Administrator I know myself that I have created lots of test sites for client use cases. I unfortunately am guilty just like everyone else and forget to delete them once I am done. Expiration policies will automatically remind me that I should probably delete those Teams that I had created that are no longer in use. Also one other thing is as a best practice you should have more than one team owner in case someone is on PTO while they receive an expiration notices
- So what is Retention Policy? You may have retention policies in place for other applications in Office 365 It is keeping your data that you need to comply with internal policies, industry regulation or legal needs It also gives you the ability to delete data that you no longer need Internally at Withum we decided to have our one on one chat history deleted after 30 days in Teams. Other organizations may decide to keep the default and never delete their users chat history due to compliances. Some organizations may use the “7 or never rule”. Where they retain information for 7 years or never delete information
- It is often too easy for users to begin creating Teams! This leads to Teams Sprawl. Best Practice is to Limit who in the organization can create new Teams This is done by placing a restriction on team creation to only be done by members of a particular security group There are two schools of thoughts. Microsoft tells you that everyone should be allowed to initially create a Team and by using Expiration policies to cleanup Teams. However most IT Departments want more control of who creates a Team. This is where we work closely with our clients to define the right choice for them.
- Ok so now that we have discussed some of these great automated governance features. So you may ask yourself what's truly needed to enable these features since they are not part of the standard Teams capability? Azure AD Premium Plan 1 which provides for Teams Naming Policies, Expiration Policies and Security Group for Teams Creators Office 365 Enterprise E3 or above is needed for creating retention Policies So you have to decide which if any of these licenses makes sense from a cost perspective from your organization. Or if you want to even try to handle some of these things manually like naming conventions, or by having an IT Admin going through the various created teams and deciding what to keep or delete periodically. Ashley anything you want to add in regarding the licenses? There are a lot security benefits for Azure Premium P1 plans that organizations many want to consider it for, such as custom conditional access policies, password protection, advanced security and usage reports
- Teams Policies allows the administrator to Control what users in your organization can do in teams and channels We generally see larger companies with over 100 employees apply custom policies. Sometimes applying too many policies can become a maintenance nightmare for smaller organizations.
- There is no one size fits all options for policies in Microsoft Teams. Every organization is different and needs a way to manage Teams based on their needs. Some organizations just use the default Org-Wide Settings Some need to split it out by Departments
- This is where we spend a lot of time with clients in governance sessions to make decisions Meeting policies are used to control what features are available to users when they join Microsoft Teams meetings. Messaging policies are used to control what chat and channel messaging features are available to users in Teams. Teams live events policies are used to turn on or off features, such as who can join a live event, if transcription is provided for attendees, or if recording live events is available for people that schedule and hold live events. App permission policies control what apps you want to make available to Teams users in your organization. So the reason I highlight these 4 policies in particular is that these are the most used components for the majority of the organization.
- You can edit the global policy or create and assign a custom policy. If a user is assigned a custom policy, that policy applies to the user. If a user isn't assigned a custom policy, the global policy applies to the user.
- As we know with Governance, access and specifically who has access to what is important to define
- As we know with Governance, access and specifically who has access to what is important to define First thing to be aware of regarding External access is that it is already turned on within your tenant if you have Office 365 If your organization currently doesn’t allow or permit external access, make sure to turn off this setting when rolling out Teams External access allows people in your organization to find, call, chat & set up meetings with people outside of your company. External users have no access to your organization's teams or team resources. The Teams admin can turn it off or specify which domains to include (or exclude). We’re seeing many companies, including our own getting rid of their phones and hardware. Especially now, many of us are remote and need the flexibility to chat, make calls, and take meetings from anywhere. External access is a great option and the Teams app is a great option. Arya what is your experience around External Access? I have personally seen most organization keep external access on. A few have allowed or blocked external access to various domains to restrict access. We usually define these settings during Governance workshops and figure out the use cases for these settings.
- Guest Access is Turned OFF by default This is where Guest access differs from External access in that guest are invited to a specific team and/or channel, meaning they have the ability to see and contribute content and conversations within the Team or Channel Before enabling guest access, consider what your organization’s current process is for collaborating with vendors, contractors or clients outside your organization/domain. Guest access within Teams is a great addition and can be added to an existing policy or process If you don’t have an existing guest access policy or are considering not leveraging it for Teams, I would encourage you to reconsider. Often when people need to collaborate with people outside the organization, they’re exchanging emails back & forth. Adding attachments, ccing, bccing. Items and feedback get lost, are you working on the latest version? Etc… What we see at a lot of clients is that the more savvy individual takes matters into their own hands. If the tools aren’t provided by IT, they find their own. This can lead to shadow IT platforms within departments or the use of personal platforms like google drive and box. Why should you care about this?? As soon as data leaves your environment it is no longer subject to any security measures, governance, retention or DLP policies that you’ve established. It poses a potential risk to your organization If needed, provide users a safe and secure way to collaborate and coauthor on content with people outside your organization. This is an area from a governance perspective where we invest time with clients to tease out what policies should apply to guest users, how they will be added and what information/use cases will they be permitted for. Teams doesn't restrict the number of guests you can add. However, the total number of guests that can be added to your tenant is based on what your Azure AD licensing allows - usually 5 guests per licensed user. Anytime you allow guests, we recommend you review guest access periodically to identify users who have access that they don't need anymore. You can use Azure AD to create an access review for group members or users assigned to an application. Creating recurring access reviews can save you time. (If you need to routinely review users who have access to an application or are members of a group, you can define the frequency of those reviews. ***Access reviews are available with the Premium P2 edition of Azure AD, which is included in Microsoft Enterprise Mobility + Security, E5.)
- Before we dive into the Questions and Answers I wanted to remind everyone about our Teams Governance on August 20th that will cover our Apps Governance and our cool demos of various Apps including our Withum Chat Bot that helps with the HR Onboarding process Staged Q&A Ashley we have a question here. Do you need both the AD Azure AD Premium 1 license and an Office 365 E3 to perform automation? Microsoft licensing is always changing and tricky to navigate. From the start of a project we evaluate your current licensees against your needs and requirements to help you make the right selection, should you need a change. Going back to your question, you can leverage either a P1 license or O365 E3 to accomplish the automation topics we covered today. This is often a decision where we include stakeholders from HR, Legal and IT to ensure the license is meeting not only your governance needs, but security, compliance and legal ones as well. Arya we have a question here. If you grant a guest access to a Team, can they see all Teams? Great question! Guests will only have access to the Team or private Channel that they have been granted access to. They won’t see any other Teams. For example, guests grant us access to Teams in their tenants all the time for a project and we only see the project Team, we don’t see or have access to any other Teams.
- Sasha to fill out