Andy, One advantage I have found that others might find helpful with Shared Channels is with channel assigned call queue agents. We use channels for CQ agents frequently but a disadvantage we had was that you could not assign private channels to a Call Queue only standard channels (or at least I have not found how). So every member of the team had to be a member of the Call Queue. We have a number of cases of a single department having multiple Call Queues. Example a CSR group that covers north, east, south, and west regions with limited cross overs. Previously the solution would be to have have a separate Team for each CQ. Shared channels provides and an effective solution. Not sure if this was an intended solution from Microsoft but it works!
Andy, Thanks for the info you've been putting out. Had a pre-migration group that only the original members could receive emails. After much research, I found that SubscriptionEnabled was set to false. Couple of PS commands later and everyone was happy.
Hi Andy, great channel, thanks for putting in so much effort. Definitely a great place to keep up to date and learn. Just wanted to point out something though that seems incorrect on the video. The role based chat restrictions do not work in the way you described them in the video. You mention that the full permission is similar to Facebook where you can edit and delete your message etc. You say the restricted limits them to posting messages and not editing them afterwards like say Whatsapp. It actually has nothing to do with that as far as i can see. Those limitations are elsewhere in Teams policies. This new role based restriction essentially determines who can actually actually initiate chats with others. So in an education scenario, you would set students to restricted via policy. They can ONLY then chat directly to users with the Full Permission policy but not anyone else. Limited users (teachers maybe) could talk to other teachers but not by default have private chats with students unless supervised by a full permission user. The full permission user can be contacted or contact anyone. So maybe that would be a head of department or a safeguarding staff member. Depends on your scenario and your organisation. Definitely not about how you can interact with a message you have posted as far as i can see. Just seems to be (in education at least) a good way to enable chat for students with some actual control. Rather than just be forced to disable it for them due to security concerns.
Firstly thanks so much for you comments I really do appreciate them. You have clarified and made some great points and that’s what my channel is about learning and community and I take my hat off to you with thanks 😊
Thanks again Andy. I have a question, can you give a full tutorial on how to enable information protection labels for Microsoft 365 groups, I know you created a video but it was not the full version
Hi Andy, again very interesting video. Nice new features. About the nested groups. We are using dynamic groups for asigning licences. But there is a drawback with this scenario. For example we assigning an M365 license and enable a limited set of features it works fine for all members. But when i want a special set assigned for a part of users inside the group i have no option for example with another group with a subset of the first group and then exclude the second one. This would be ha!ndy to manage all our needs regarding licenses. Looking forward to see this coming soon. So include and exclude nested groups with the full set of options instead of assigning directly onto the user.
Thanks so much Oliver, always nice to hear from you. You know what my friend. You should feed this back to the product group. Submit via the product feedback feature in AAD. They'd love to see this feedback :-)
One of my current issues, is with MFA in a hybrid environment. The 365 outlook desktop app is suppose to support it. But it keeps going into a login loop and doesnt promot for MFA. Works fine on the web Version. I'm thinking it has to do with the cached outlook profile, but deleting it out and rebuilding doesn't fix it.
Make sure you have the latest version of the app installed. Ensure time is correct on your devices. Sounds like a caching issue. Check docs.Microsoft.com or The Microsoft Tech community. Sorry I’m not a one man help desk, that’s what I would try. Good luck 👍😊
@@AndyMaloneMVP Oh no I didn't expect you to have the answer I was merely talking about my issue. I appreciate the response greatly. The only thing I can think of is it being a cache issue. Sense it's some people have the issue, some people don't. I love your videos and you content man thank you very much for what you do.
Hi Andy, great channel, thanks for putting in so much effort. Do you know about the problem with roaming profiles and ms appx? (for sure you know) (= Is the UE-V solution? or you got something better? :p Regards
@@TheNiemamnazwy Azure AD joined devices can be managed in Azure AD and Intune, but not hybrid. docs.microsoft.com/en-us/azure/active-directory/devices/enterprise-state-roaming-enable and here docs.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics#:~:text=In%20the%20Microsoft%20Endpoint%20Manager%20admin%20center%2C%20select%20Devices%20%3E%20Group,GPO%20in%20the%20XML%20file. And here docs.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows. Anything else I’d place a support ticket. Good luck 😊
@@AndyMaloneMVP in that case, however, I think I misunderstood the first question. However, it is about "on promise" My users have mobile (Roaming) profiles. As long as they are working on their own PC everything is fine. However, after logging into another PC, they cannot start OfficeHub AppX properly. :(
Hi Andy, very interesting video, And Nice features. Is there a way to have files and folder in the shared channels "SharePoint site” to be read only for invited teams or members? I would like to provide internal HR information (employee manual, Code of conduct vacation template) to different teams, but it should be only HR who is able to edit the document. The member/teams who are invited as user should be allowed to use the chat and some apps If possible (else I can make the app restricted by user login.) Regards Martin
Hi Martin, my initial thoughts are that as a shared channel is essentially a sub site in teams, it creates its own SharePoint document library. So I’m thinking that you can probably set restrictions on users and what access they will have. Without actually setting this up I’ll be honest I’m not sure. These are just my thoughts. Technically I suspect it would be possible. As it’s a document library I’m guessing you can create subfolders within it. I would check out docs.microsoft.com and search for teams shared channels and see what Microsoft has to say. Good luck and thanks for the comment, Andy.
Hi Martin, i think this should be possible. You can create a new folder inside the document library which is automatically created and than adjust the permissions for that folder. The folder will inherit the permissions from the sharepoint site/teams by default, but you can use the option "stop inheriting permissions" and than change the permission level for the "Members" and "Visitors" group to "Read-only", the "owners" group can still have the Full control permission level.
Also, just to ask, your section about limitations on nested groups is interesting. I tend to find nesting never works so just plain avoid it as we primarily sync from on prem to cloud. In the blue page you put up though, the restrictions in there seem to say that AD to M365 group nesting won't work. M365 to M365 nesting groups won't work. Security to M365 won't work and distribution to M365 won't work. So nesting anything really in a M365 group is not possible? I think you mention it is only for permission groups? How do i add a group to an Azure365 group to get it to allow permissions to inherit? The options in Azure AD groups are to add members and doing that with nested groups does not work right? Adding a group via roles also does not work? Not sure what actually works then haha? I must be a bit dim and missing the point? Thanks!
Hi was actually chatting with some folks at MS about this and they agree. It seems to me that it’s a feature that’s …. Well, not quite complete shall we say. That slide by the way came direct from Microsoft and at this time is correct. Thanks again for the great feedback, very much appreciated 😊🎉👍
I could be wrong but I don’t think shared channels support guest access do they? My understanding is that it is just external access, not guest (hopefully i am wrong here). So does shared channels support access from an individual account (not related to a school or work account), as I thought the external access in shared channels requires the external users to be part of a managed tenant (but I could be wrong here as well)?
@@AndyMaloneMVP Also, could I invite the same user in two ways to the same shared channel? So if they were already a guest in the team, add that guest to the shared channel, and then invite their external identity to the shared channel so that for that one channel, they can access from their tenant but for the rest of the team resources, they switch to their guest identity?
Awesome Video.. very informative... Appreciate your time to make this Video... Have a Query...How to control Users in Teams Naming convention of Group Names while they creating the Groups with their own Groups name.(ex: Tracking Team... Test Team ....). There should be some good Names for the Teams Groups..
That’s a good question. Suffixes and prefixes can be created in the Microsoft groups area in azure active directory, however any automation requires either the use of power shell or power automate. In either way I think that you’re looking at some kind of automation, which essentially is a customs solution here. As far as I know anyway. I’m sorry I couldn’t help you further. I would perhaps reach out to Microsoft support
Hi Andy. When adding a external user it results in 'we didn't find any matches'. Any suggestions? I've already checked if creation of shared channels is allowed. What I found the Teams update policy is set at 'Follow office preview'. Could be this the error? I've also checked the M365 group settings via M365 admin center (org settings). But this should be OK.
I have a query Sir If the onprem ad policy is set to 90 days and the Office 365 tenant is set to 60days. Which policy will be into effect, even when the password writeback feature is enabled?
@@AndyMaloneMVP thank you for the response sir, i agree with you on the security part. Is there an explanation why will the on premises password expiry will come into affect in my scenario?
@@cuteandmischievous4476 because in hybrid. Active directory is the authenticating body. Not Azure. Plenty of reading on docs.Microsoft.com I’m sure you’ll find some 😊
Hmm could be a licence thing perhaps. Also needs to be enabled via Azure AD external access check out this video 😊 th-cam.com/video/GI279H1Je_M/w-d-xo.html It may not be available for some non premium accounts, business basic etc. Thanks for the comment 😊
Andy, One advantage I have found that others might find helpful with Shared Channels is with channel assigned call queue agents.
We use channels for CQ agents frequently but a disadvantage we had was that you could not assign private channels to a Call Queue only standard channels (or at least I have not found how). So every member of the team had to be a member of the Call Queue.
We have a number of cases of a single department having multiple Call Queues. Example a CSR group that covers north, east, south, and west regions with limited cross overs. Previously the solution would be to have have a separate Team for each CQ. Shared channels provides and an effective solution. Not sure if this was an intended solution from Microsoft but it works!
Great feedback, thanks for collaborating :-)
Awesome and great to be a part of this growing community. Thanks Andy.
You’re most welcome Tony🎉🎉🎉😀😀😀
Another great one Andy. Even during holidays watching your videos
Learning never stops Patrick👍
Andy, Thanks for the info you've been putting out. Had a pre-migration group that only the original members could receive emails. After much research, I found that SubscriptionEnabled was set to false. Couple of PS commands later and everyone was happy.
Hey Terry thats great news and thanks for the feedback :-)
Great news on your channel!!! You know your stuff and I am glad you share your knowledge. MVP
Thanks Chris May thanks for your support 🙏😊🎉👍
Hi Andy, great channel, thanks for putting in so much effort. Definitely a great place to keep up to date and learn.
Just wanted to point out something though that seems incorrect on the video. The role based chat restrictions do not work in the way you described them in the video. You mention that the full permission is similar to Facebook where you can edit and delete your message etc. You say the restricted limits them to posting messages and not editing them afterwards like say Whatsapp. It actually has nothing to do with that as far as i can see. Those limitations are elsewhere in Teams policies. This new role based restriction essentially determines who can actually actually initiate chats with others. So in an education scenario, you would set students to restricted via policy.
They can ONLY then chat directly to users with the Full Permission policy but not anyone else. Limited users (teachers maybe) could talk to other teachers but not by default have private chats with students unless supervised by a full permission user. The full permission user can be contacted or contact anyone. So maybe that would be a head of department or a safeguarding staff member. Depends on your scenario and your organisation. Definitely not about how you can interact with a message you have posted as far as i can see. Just seems to be (in education at least) a good way to enable chat for students with some actual control. Rather than just be forced to disable it for them due to security concerns.
Firstly thanks so much for you comments I really do appreciate them. You have clarified and made some great points and that’s what my channel is about learning and community and I take my hat off to you with thanks 😊
Thanks again Andy.
I have a question, can you give a full tutorial on how to enable information protection labels for Microsoft 365 groups, I know you created a video but it was not the full version
Hi Johnathan thanks for the comment. Absolutely I’ll see what I can do 👍😊
Hey Andy,
Thanks for the Video !
I don't see "Store" under Teams devices, any idea why?
You don't have permissions.
thank u very much for very usefull video . can u make a video please about Citrix Server and App ?
Normally I would love to, however unfortunately Citrix is not one of my products, very sorry but I hope that you’ll still stay with my channel.😊
Hi Andy, again very interesting video. Nice new features. About the nested groups. We are using dynamic groups for asigning licences. But there is a drawback with this scenario. For example we assigning an M365 license and enable a limited set of features it works fine for all members. But when i want a special set assigned for a part of users inside the group i have no option for example with another group with a subset of the first group and then exclude the second one. This would be ha!ndy to manage all our needs regarding licenses. Looking forward to see this coming soon. So include and exclude nested groups with the full set of options instead of assigning directly onto the user.
Thanks so much Oliver, always nice to hear from you. You know what my friend. You should feed this back to the product group. Submit via the product feedback feature in AAD. They'd love to see this feedback :-)
One of my current issues, is with MFA in a hybrid environment. The 365 outlook desktop app is suppose to support it. But it keeps going into a login loop and doesnt promot for MFA. Works fine on the web Version. I'm thinking it has to do with the cached outlook profile, but deleting it out and rebuilding doesn't fix it.
Make sure you have the latest version of the app installed. Ensure time is correct on your devices. Sounds like a caching issue. Check docs.Microsoft.com or The Microsoft Tech community. Sorry I’m not a one man help desk, that’s what I would try. Good luck 👍😊
@@AndyMaloneMVP Oh no I didn't expect you to have the answer I was merely talking about my issue. I appreciate the response greatly. The only thing I can think of is it being a cache issue. Sense it's some people have the issue, some people don't. I love your videos and you content man thank you very much for what you do.
@@travisskeans2511 You are very welcome Travis thank you and have a great day
Hi Andy, great channel, thanks for putting in so much effort.
Do you know about the problem with roaming profiles and ms appx? (for sure you know) (=
Is the UE-V solution? or you got something better? :p
Regards
Are you referring to this on Orem or cloud
@@AndyMaloneMVP cloud
@@TheNiemamnazwy Azure AD joined devices can be managed in Azure AD and Intune, but not hybrid. docs.microsoft.com/en-us/azure/active-directory/devices/enterprise-state-roaming-enable and here docs.microsoft.com/en-us/mem/intune/configuration/group-policy-analytics#:~:text=In%20the%20Microsoft%20Endpoint%20Manager%20admin%20center%2C%20select%20Devices%20%3E%20Group,GPO%20in%20the%20XML%20file. And here docs.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows. Anything else I’d place a support ticket. Good luck 😊
@@AndyMaloneMVP
in that case, however, I think I misunderstood the first question. However, it is about "on promise"
My users have mobile (Roaming) profiles. As long as they are working on their own PC everything is fine. However, after logging into another PC, they cannot start OfficeHub AppX properly. :(
@@TheNiemamnazwy hmm not sure I’d place a support call, sorry.
Hi Andy, very interesting video, And Nice features.
Is there a way to have files and folder in the shared channels "SharePoint site” to be read only for invited teams or members?
I would like to provide internal HR information (employee manual, Code of conduct vacation template) to different teams, but it should be only HR who is able to edit the document.
The member/teams who are invited as user should be allowed to use the chat and some apps If possible (else I can make the app restricted by user login.)
Regards Martin
Hi Martin, my initial thoughts are that as a shared channel is essentially a sub site in teams, it creates its own SharePoint document library. So I’m thinking that you can probably set restrictions on users and what access they will have. Without actually setting this up I’ll be honest I’m not sure. These are just my thoughts. Technically I suspect it would be possible. As it’s a document library I’m guessing you can create subfolders within it. I would check out docs.microsoft.com and search for teams shared channels and see what Microsoft has to say. Good luck and thanks for the comment, Andy.
@@AndyMaloneMVP thanks a lot for your time and answer.
Hi Martin, i think this should be possible. You can create a new folder inside the document library which is automatically created and than adjust the permissions for that folder. The folder will inherit the permissions from the sharepoint site/teams by default, but you can use the option "stop inheriting permissions" and than change the permission level for the "Members" and "Visitors" group to "Read-only", the "owners" group can still have the Full control permission level.
Nice video Andy 👏
Thank you kindly 👍😊
Also, just to ask, your section about limitations on nested groups is interesting. I tend to find nesting never works so just plain avoid it as we primarily sync from on prem to cloud. In the blue page you put up though, the restrictions in there seem to say that AD to M365 group nesting won't work. M365 to M365 nesting groups won't work. Security to M365 won't work and distribution to M365 won't work. So nesting anything really in a M365 group is not possible? I think you mention it is only for permission groups? How do i add a group to an Azure365 group to get it to allow permissions to inherit? The options in Azure AD groups are to add members and doing that with nested groups does not work right? Adding a group via roles also does not work? Not sure what actually works then haha? I must be a bit dim and missing the point? Thanks!
Hi was actually chatting with some folks at MS about this and they agree. It seems to me that it’s a feature that’s …. Well, not quite complete shall we say. That slide by the way came direct from Microsoft and at this time is correct. Thanks again for the great feedback, very much appreciated 😊🎉👍
I could be wrong but I don’t think shared channels support guest access do they? My understanding is that it is just external access, not guest (hopefully i am wrong here). So does shared channels support access from an individual account (not related to a school or work account), as I thought the external access in shared channels requires the external users to be part of a managed tenant (but I could be wrong here as well)?
External access is guest access :-) Any external address is added as a guest account in Azure AD.
@@AndyMaloneMVP So can anyone then be invited to a shared channel even if not from a managed tenant?
@@AndyMaloneMVP Also, could I invite the same user in two ways to the same shared channel? So if they were already a guest in the team, add that guest to the shared channel, and then invite their external identity to the shared channel so that for that one channel, they can access from their tenant but for the rest of the team resources, they switch to their guest identity?
@@davidcarrico3385 yes unless there is a block rule setup to deny it.
Awesome Video.. very informative... Appreciate your time to make this Video... Have a Query...How to control Users in Teams Naming convention of Group Names while they creating the Groups with their own Groups name.(ex: Tracking Team... Test Team ....). There should be some good Names for the Teams Groups..
That’s a good question. Suffixes and prefixes can be created in the Microsoft groups area in azure active directory, however any automation requires either the use of power shell or power automate. In either way I think that you’re looking at some kind of automation, which essentially is a customs solution here. As far as I know anyway. I’m sorry I couldn’t help you further. I would perhaps reach out to Microsoft support
Hi Andy. When adding a external user it results in 'we didn't find any matches'. Any suggestions?
I've already checked if creation of shared channels is allowed. What I found the Teams update policy is set at 'Follow office preview'. Could be this the error?
I've also checked the M365 group settings via M365 admin center (org settings). But this should be OK.
I think this video will really help. You😊 th-cam.com/video/AorUXeUjDmw/w-d-xo.html
I have a query Sir
If the onprem ad policy is set to 90 days and the Office 365 tenant is set to 60days. Which policy will be into effect, even when the password writeback feature is enabled?
The AD policy takes precedence. However I’d seriously use MFA. Passwords are a security nightmare.
@@AndyMaloneMVP thank you for the response sir, i agree with you on the security part. Is there an explanation why will the on premises password expiry will come into affect in my scenario?
@@cuteandmischievous4476 because in hybrid. Active directory is the authenticating body. Not Azure. Plenty of reading on docs.Microsoft.com I’m sure you’ll find some 😊
@@AndyMaloneMVP thank you so much sir i missed it. God bless you..
Sir what if right back policy is placed on office 365 tenant, will onprem take precedence?
Thanks so much
Hey Andy, I recently discovered your channel, good stuff. I was wondering why my tenant don't show the option to change to public preview in teams.
Hmm could be a licence thing perhaps. Also needs to be enabled via Azure AD external access check out this video 😊 th-cam.com/video/GI279H1Je_M/w-d-xo.html It may not be available for some non premium accounts, business basic etc. Thanks for the comment 😊
wow... im 10 months late and still in quarantine
What you or your email? 🤪 I hope not you 😀
sadly im with you a year later lol
At least you’re here now 👍
yee