In recent weeks a number of organisations with ‘default’ Office 365 configuration settings have told me they are not using SharePoint but they are using MS Teams, and have even created new Teams.
Every new Team in MS Teams creates a linked SharePoint site via the Office 365 Group that is created when the Team is created. If the ability to create Office 365 Groups is not restricted the following is likely to happen:
- Naming conventions go out the window. New Teams and SharePoint sites will probably be created with random names (eg ‘Andrews Team’, ‘Footy tipping’).
- The SharePoint environment will ‘go feral’; new sites will not be provisioned according to business requirements.
This post describes what happens when a Team is created and recommends the creation of new Teams by creating an Office 365 Group.
What happens when a Team is created
At the bottom left of the MS Teams client is the option to ‘Join or create a team’. This option will be visible even if the ability to create Teams is not enabled for end users (because the control is on the creation of Office 365 Groups).
The dialogue box that opens gives the option to ‘Create Team’.
The user now has the choice to build a new team from scratch or create it from an existing Office 365 group or team. For the purposes of this post, we will assume the user chooses the first option.
The user is then asked if the team should be private, public or organisation wide. The options will affect the visibility of the Team to others. For the purpose of this post, the new Team is ‘Private’.
The next option is to name the site (‘Footy Tipping’) and give it a description.
The user is then prompted to add members (people who have edit rights) to the new Team. They may add individuals by name, a distribution list, or a security group. If external access is allowed, they may also add people outside the organization as guests. People or groups that are added are made ‘Members’ by default but this may be changed to ‘Owners’.
A key point here is who will have access to the Team if there is a single Owner. What if that person leaves the organisation?
The new Team has been created with a ‘General’ channel. The three dots to the right of the name allow the Owner to modify the members of the Team, add channels, get a link to the Team (to send to others and delete the Team.
Along the top of the new Team are three default tab: Posts, Files, Wiki.
The ‘Files’ tab appears (for those who are new to this) to allow documents to be uploaded to the Team, Synced to their File Explorer and so on. This is actually the default Documents library of the SharePoint site that is created when the Office 365 Group is created when the Team is created.
What happens in Office 365 Groups
The end user is not likely to care much about what happens anywhere else, they have a new Team and can start chatting.
Meanwhile, in the Groups area of the Office 365 Admin portal, a new Office 365 Group appears. The Global Administrator should be keeping an eye on the creation of new Groups, if they are not controlled, especially if there is a requirement to adhere to naming conventions for all AD Groups (Distribution Lists, Security Groups, and Office 365 Groups).
The Group name has had the space removed in the Group’s email address (and, as we will see, in the SharePoint site). The Global Admin can review and change the Members.
The Global Admin may also changed the settings to allow external senders to email the Group and to send copies of Group conversations (in Outlook, see below) and events to Group members. (The Microsoft Teams settings takes the Global Admin to the MS Teams Admin portal).
So, an end user has ‘simply’ created a Team, but now there is a new Office 365 Group with a mailbox (not visible but can receive emails) and a SharePoint site.
What happens in Outlook
Every new Office 365 Group has an Exchange mailbox, similar to a shared mailbox, but when a new Team is created from MS Teams, the mailbox is not visible in Outlook. If the Global admin enables the ability to ‘send copies of group conversations and events to group members’, the group members may use that Group’s mailbox address.
The mailbox is visible when a Group is created first, which is a good reason to create a new Team by creating the Office 365 Group first.
Channel chat message are stored in a hidden folder in the Group’s mailbox, where they are subject to any retention policy applied to the chat messages, separate from any retention policy applied to the mailbox.
What happens in SharePoint
As noted already, every new Team gets a SharePoint site because the Team has created an Office 365 Group.
The SharePoint Admin will see the new site in the SharePoint admin portal:
The SharePoint Admin may, via the ‘Permissions’ section, view and update the Group Owner/s and also may add additional ‘Admins’. They may make the site a Hub site and decide whether the site can be shared externally or not (the default is not shared externally).
The SharePoint admin may also delete the site – but consider that it is not now just a site but a Team and also an Office 365 Group. Some care needs to be taken here – which should be deleted first, and what happens if a retention policy has been applied to the Teams channel or the Office 365 Group?
If the SharePoint admin opens the site they will see a standard ‘modern’ team site with a single default document library. This is the ‘Files’ library that appears as a tab in the Teams General channel.
In the Permissions section of the site, the Site Owners show as the Team owners group, and the Site members (add/edit rights) show as the Team members group. There are no site visitors.
If the SharePoint admin goes to Advanced permissions settings and clicks on Site Collection Administrators they will see that only the Footy Tipping Owners are in this section. Organisations should consider adding a Security Group, that includes any records or information managers, in this section. Otherwise, any records will be more difficult to manage and the records managers will need to request access from the SharePoint admin.
Two important points that are sometimes missed:
- Aside from the Global and SharePoint admin, only the Team Owners and Members can access the SharePoint site.
- The SharePoint site may be shared with another person (or Group) and given Member or Visitor access but this does NOT give them access to the Team channel. They need to be added to the Team Owners or Members to have access to the Team channel.
Summary
Allowing end users to create a Team in MS Teams has a flow-on effect:
- It creates an Office 365 Group with an associated SharePoint site
- It creates an Exchange mailbox
- It will (initially, unless this is changed) make the SharePoint site inaccessible to records managers.
- It gets complicated if it is decided to delete the Team, SharePoint site, or Office 365 Group.
It is recommended, in organisations rolling out MS Teams to end users, that the ability to create Office 365 Groups is disabled except for Global Admins, and any new Team is created from a new Office 365 Group that includes the option to ‘Add Microsoft Teams to your group’, as shown below:
This will result in the following outcomes:
- Controlled creation of Office 365 Groups, SharePoint sites and Teams, with appropriate naming conventions.
- A new and visible mailbox for both the Group and the Team.
- Stop SharePoint from ‘going feral’ and becoming uncontrolled.
- Establish better governance controls for recordkeeping.
Records about the world 
Great article Andrew. There was an article I’ve been sending around for the last year or so about the same basic issue, it’s nice to see it laid out nice and simply, and with a nice clear solution. Also easy to see why vendors like Avepoint are making such good headway in the market, it’s so much more complex than it needs to be.
Great article. It really helps clarify the subject matter. Thank you.
This is an EXCELLENT article Andrew – well written, informative and helpful.