Microsoft MS-700 Managing Teams Exam Dumps and Practice Test Questions Set 11 Q 151-165

Visit here for our full Microsoft MS-700 exam dumps and practice test questions.

Question 151: 

An organization wants to prevent users from creating new teams in Microsoft Teams while still allowing them to create Microsoft 365 Groups in other services. Which setting should be configured?

A) Disable Teams creation in Teams admin center under Teams policies

B) Modify the Microsoft 365 Groups creation policy in Azure AD

C) Configure a messaging policy to restrict team creation

D) Use PowerShell to set TeamCreationAllowedGroupId parameter

Answer: A

Explanation:

Team creation management in Microsoft Teams is a common governance requirement for organizations that want to maintain control over their Teams environment while preventing Teams sprawl and ensuring proper naming conventions and structure. Understanding the relationship between Microsoft Teams and Microsoft 365 Groups is essential for implementing appropriate controls. Every team in Microsoft Teams is backed by a Microsoft 365 Group, which means that team creation policies intersect with broader Microsoft 365 Groups governance. However, Microsoft provides granular controls that allow administrators to restrict team creation specifically without affecting group creation in other Microsoft 365 services like Outlook, SharePoint, or Planner.

The distinction between controlling Teams creation versus broader Microsoft 365 Groups creation is important for organizational flexibility. Some organizations want to restrict who can create teams (which are collaboration spaces with channels, tabs, and apps) while still allowing users to create groups for email distribution, shared calendars, or site collections. Other organizations want comprehensive control over all group creation. Microsoft Teams provides specific administrative controls that operate independently from the broader Azure AD group creation policies, allowing administrators to implement Teams-specific restrictions without impacting other services.

A is correct because the Teams admin center provides specific settings to control team creation independently from Microsoft 365 Groups creation in other services. In the Teams admin center, administrators can navigate to Teams > Teams policies and configure policies that control whether users can create private teams, public teams, or any teams at all. These policies can be applied globally or assigned to specific users or groups, providing granular control. The key distinction is that these Teams-specific policies only affect team creation within Microsoft Teams client and don’t restrict users from creating Microsoft 365 Groups through Outlook, SharePoint, Planner, or other services. This allows organizations to implement different governance models for Teams versus other collaboration tools. For example, you might restrict team creation to specific departments while still allowing all users to create email distribution groups or shared calendars. This is the correct approach when you specifically want to control Teams creation without affecting broader group creation capabilities.

B is incorrect because modifying the Microsoft 365 Groups creation policy in Azure AD affects group creation across all Microsoft 365 services, not just Teams. When you configure group creation restrictions in Azure AD (either through the Azure portal or PowerShell using Set-AzureADDirectorySetting), these restrictions apply to group creation in Teams, Outlook, SharePoint, Planner, Yammer, and all other services that create Microsoft 365 Groups. The question specifically asks to prevent team creation while still allowing group creation in other services, which this approach doesn’t accomplish. If you implement Azure AD group creation restrictions, users would lose the ability to create groups everywhere, not just in Teams. While Azure AD group creation policies are important for comprehensive governance, they’re too broad for the specific requirement described in the question.

C is incorrect because messaging policies in Microsoft Teams control messaging features and capabilities like chat deletion, message editing, priority notifications, read receipts, and similar communication features, not team creation permissions. Messaging policies don’t include settings related to team creation or management. The policy categories in Teams admin center each have specific purposes: messaging policies for chat features, meeting policies for meetings and calling features, app policies for application management, and teams policies for team creation and management. Attempting to restrict team creation through messaging policies would not work because these policies don’t contain relevant settings. The correct policy category for team creation is Teams policies.

D is incorrect because while PowerShell can be used to configure team creation settings, the TeamCreationAllowedGroupId parameter is actually used with Azure AD group settings and affects all Microsoft 365 Group creation, not just Teams. This parameter specifies a security group whose members are allowed to create groups across all services. Using this approach would restrict both Teams creation and group creation in other services, which contradicts the requirement. Additionally, this parameter is part of the broader Microsoft 365 Groups governance approach rather than Teams-specific controls. While PowerShell is valuable for Teams administration, the correct approach for this specific requirement is using the Teams admin center to configure Teams policies that specifically control team creation without affecting other services.

Question 152: 

A company needs to implement a policy that automatically deletes chat messages older than 90 days to comply with data retention requirements. Which feature should be configured?

A) Messaging policy in Teams admin center

B) Retention policy in Microsoft 365 compliance center

C) Data loss prevention (DLP) policy

D) Information barriers policy

Answer: B

Explanation:

Data retention and compliance management in Microsoft Teams requires understanding the comprehensive compliance infrastructure provided by Microsoft 365. Organizations face various regulatory requirements, legal obligations, and internal policies that dictate how long different types of data must be retained and when it must be deleted. Microsoft Teams generates several types of data including chat messages, channel messages, files, meeting recordings, and metadata, each potentially subject to different retention requirements. Implementing proper retention policies ensures compliance while also managing storage costs and reducing legal discovery exposure. Understanding where retention policies are configured and how they interact with Teams data is essential for compliance administrators.

Microsoft 365 provides centralized compliance controls through the Microsoft 365 compliance center (formerly Security & Compliance Center), which offers retention policies, eDiscovery tools, data loss prevention, and information governance features that work across multiple services including Teams, Exchange, SharePoint, and OneDrive. Retention policies can be configured to either retain data for specific periods (preventing premature deletion) or delete data after specified periods (ensuring data doesn’t persist longer than allowed). These policies operate at the service level and can be scoped to specific users, groups, or locations, providing flexible compliance controls that meet various regulatory requirements.

B is correct because retention policies configured in the Microsoft 365 compliance center (or Purview compliance portal in newer licensing models) are the proper mechanism for automatically deleting Teams chat messages based on age. Retention policies for Teams can be configured to delete items older than a specified period (in this case, 90 days), can target different Teams locations including Teams channel messages and Teams chats (1:1 and group chats), support both preservation (prevent deletion) and deletion actions, can be scoped to specific users or applied organization-wide, and process items automatically in the background. To implement the requirement, administrators would navigate to the compliance center, create a retention policy, select Teams as the location, configure the policy to delete items older than 90 days, and apply it to all users or specific groups. The policy runs continuously in the background, marking qualifying messages for deletion. It’s important to note that retention policies can take up to 7 days to process deletions, and deleted items are removed from user views but may be preserved in hidden folders for eDiscovery purposes if hold policies exist.

A is incorrect because messaging policies in the Teams admin center control messaging features and user capabilities such as whether users can edit or delete their own messages, use priority notifications, enable read receipts, use chat, or send memes and GIFs, but they do not provide automatic data retention or deletion capabilities based on message age. Messaging policies are about controlling features and user experience, not about compliance-driven data lifecycle management. While messaging policies are important for managing Teams functionality, they don’t address retention requirements. Automatic deletion of messages based on age requires retention policies configured in the compliance center, not messaging policies in the Teams admin center.

C is incorrect because Data Loss Prevention (DLP) policies are designed to prevent sensitive information from being shared inappropriately by detecting and blocking or warning about content that matches specific patterns (like credit card numbers, social security numbers, or custom sensitive information types), not for automatically deleting data based on age. DLP policies scan content in real-time and take actions like blocking sharing, notifying users, generating alerts, or applying protective labels when sensitive content is detected. DLP is a preventive control for data protection, not a retention control for data lifecycle management. While DLP and retention policies are both compliance features, they serve completely different purposes. The requirement to delete messages older than 90 days requires retention policies, not DLP.

D is incorrect because information barriers are policies that prevent certain groups of users from communicating with each other, typically used in organizations with regulatory requirements to prevent conflicts of interest (like in financial services where trading desks must be separated from advisory functions). Information barriers control who can communicate with whom in Teams, Outlook, OneDrive, and SharePoint, but they don’t manage data retention or deletion. Information barriers are about segregating user populations to prevent inappropriate communication, not about automatically deleting old messages. For the requirement of deleting chat messages older than 90 days, retention policies in the compliance center are the appropriate solution, not information barriers.

Question 153: 

An organization wants to prevent users from installing third-party apps in Teams but allow installation of apps from the organization’s custom app catalog. Which configuration should be implemented?

A) Configure app permission policies allowing only custom apps

B) Disable all apps in app setup policies

C) Use conditional access policies to block third-party apps

D) Configure information barriers to restrict app access

Answer: A

Explanation:

Application management in Microsoft Teams is a critical aspect of governance and security that allows organizations to control which applications users can install and use. Teams supports three categories of apps: Microsoft apps (built by Microsoft like Planner, Forms, or Power BI), third-party apps (built by external vendors and available in the Teams app store), and custom apps (built by or for the organization and uploaded to the organization’s app catalog). Different organizations have different risk tolerances and governance requirements around applications—some organizations freely allow all apps to encourage adoption and productivity, while others strictly control apps to minimize security risks, ensure compliance, and prevent data exfiltration. Understanding how to implement granular app controls is essential for Teams administrators.

Microsoft Teams provides comprehensive app management through several policy types and controls. App permission policies control which apps are available to users and can be configured at different levels of granularity including blocking all apps, allowing all apps, blocking specific apps, or allowing only specific apps. App setup policies control which apps are pinned in users’ Teams interface and whether users can upload custom apps. Organizations with custom-developed applications often want to allow these trusted apps while blocking external apps, requiring specific configuration that distinguishes between these app categories. The ability to allow custom apps while blocking third-party apps provides a balanced approach that enables organizational innovation while maintaining security controls.

A is correct because app permission policies in the Teams admin center provide granular control over which categories and specific apps users can install, including the ability to allow custom apps while blocking third-party apps. App permission policies can be configured to allow or block apps by category (Microsoft apps, third-party apps, custom apps) or individually by specific app. For the scenario described, administrators would navigate to Teams admin center > Teams apps > Permission policies, create or modify a policy, set Microsoft apps to «Allow all apps» (if desired), set third-party apps to «Block all apps», and set custom apps to «Allow all apps». This configuration allows users to access Microsoft’s built-in apps and custom apps from the organization’s app catalog while preventing installation of any third-party apps from external vendors. The policy can then be assigned to users globally or to specific groups. This approach provides the exact control described in the question—blocking third-party apps while permitting custom organizational apps.

B is incorrect because app setup policies control which apps are pinned in users’ Teams interface and whether users can upload custom apps, but they don’t provide the granular permission control needed to allow custom apps while blocking third-party apps. App setup policies primarily manage the user experience by determining which apps appear pinned in the app bar and whether users can pin their own apps. While app setup policies do include a setting for allowing user pinning and uploading of custom apps, they don’t provide the category-level blocking of third-party apps that app permission policies offer. Disabling all apps in app setup policies would prevent all app usage, not selectively allow custom apps. The correct policy type for controlling which categories of apps users can install is app permission policies, not app setup policies.

C is incorrect because conditional access policies in Azure AD control access to applications and services based on conditions like user location, device compliance, sign-in risk, and platform, but they don’t provide granular control over individual Teams apps or app categories. Conditional access operates at the service level—you can use conditional access to control whether users can access Teams itself based on various conditions, but once users have access to Teams, conditional access doesn’t control which specific apps within Teams they can install. Conditional access might require MFA for accessing Teams from certain locations or block access from unmanaged devices, but it doesn’t distinguish between Microsoft, third-party, and custom apps within the Teams environment. For controlling app categories and specific apps within Teams, app permission policies are the appropriate tool.

D is incorrect because information barriers prevent specific groups of users from communicating with each other to maintain ethical walls and prevent conflicts of interest, but they don’t control which applications users can install or access. Information barriers are about segregating user populations and preventing communication between them, not about application permissions. An information barrier might prevent users in the trading department from communicating with users in the advisory department, but it doesn’t restrict which Teams apps those users can install. Information barriers and app permission policies serve completely different governance purposes. For controlling which categories of apps users can install, including allowing custom apps while blocking third-party apps, app permission policies are the correct solution.

Question 154: 

A Teams administrator needs to configure external access to allow users to communicate with users from a specific partner organization using a different email domain. Which setting should be configured?

A) External access in Teams admin center allowing specific domains

B) Guest access in Teams admin center

C) Azure AD B2B collaboration settings

D) Federation settings in Microsoft 365 admin center

Answer: A

Explanation:

External collaboration in Microsoft Teams can be configured through two distinct mechanisms: external access (also called federation) and guest access. Understanding the differences between these features, their capabilities, and appropriate use cases is critical for Teams administrators managing external collaboration. External access and guest access serve different purposes and provide different levels of integration with external users. External access enables communication with users from other organizations who remain in their own tenants and use their own accounts, while guest access invites external users into your organization’s Teams and resources with guest accounts created in your Azure AD. Choosing the appropriate mechanism depends on the collaboration requirements and security posture.

External access (federation) allows users in your organization to find, call, chat, and set up meetings with users from external organizations, but external users remain in their own organizations and access their own resources. External access is ideal for lightweight communication with partners, vendors, or customers where you want to enable communication without granting access to your internal resources. The communication happens across organizational boundaries with each user authenticated by their own organization. External access can be configured to allow communication with all external organizations, specific domains only, or blocked entirely. This model provides quick communication capabilities without the administrative overhead of creating and managing guest accounts for external users.

A is correct because external access in the Teams admin center allows Teams users to communicate with users from external organizations by configuring which domains are allowed or blocked for federation. To configure external access for a specific partner organization, administrators navigate to Teams admin center > Users > External access, where they can choose to allow all external domains, allow only specific domains (by adding them to the allow list), or block specific domains (by adding them to the blocked list). For the scenario described where communication is needed with a specific partner organization, administrators would select «Allow only specific external domains» and add the partner’s domain (like contoso.com) to the allowed list. This enables Teams users to chat, call, and meet with users from that specific partner organization, with each user remaining authenticated in their own tenant. External access provides peer-to-peer communication without requiring guest accounts or access to internal resources, making it appropriate for external communication scenarios.

B is incorrect because guest access is a different feature that invites external users into your organization as guest accounts, granting them access to teams, channels, files, and other resources within your tenant. Guest access involves creating Azure AD B2B guest accounts for external users and adding them as members of specific teams where they can participate in channels, access shared files, and collaborate more deeply. While guest access provides richer collaboration capabilities, it’s more complex to manage, requires invitation and account creation, grants access to internal resources, and is typically used when external users need to be part of ongoing project teams. The question describes needing to enable communication with users from a partner organization, which suggests external access (federation) rather than deep integration through guest access. External access is simpler and more appropriate for organization-to-organization communication without granting resource access.

C is incorrect because Azure AD B2B collaboration settings manage guest access capabilities including who can invite guests, guest user permissions, and collaboration restrictions, but they don’t configure external access (federation) between organizations. Azure AD B2B is the underlying technology for guest access in Teams, controlling how guest accounts are created, managed, and what permissions they have. While B2B settings are important when using guest access, they don’t enable the federation-based external access model described in the question. If you wanted external users to become guests in your organization with access to specific teams and resources, you would configure both Azure AD B2B settings and Teams guest access. However, for enabling communication with users from a partner organization while they remain in their own tenant, external access (federation) in Teams admin center is the appropriate setting.

D is incorrect because while federation historically was configured through Exchange or Skype for Business settings in various admin centers, modern Teams external access configuration is managed through the Teams admin center specifically. The Microsoft 365 admin center is used for many organizational settings, user management, licensing, and service administration, but external access for Teams is configured in the Teams admin center under the External access section. While some legacy federation settings might exist in other admin centers for backward compatibility with older services, the current and correct location for configuring Teams external access is the Teams admin center. Administrators should use the Teams admin center to manage all Teams-specific policies and settings, including external access configuration.

Question 155: 

An organization needs to prevent users from sharing sensitive financial data in Teams chats and channels. Which policy type should be implemented?

A) Data Loss Prevention (DLP) policy

B) Retention policy

C) Messaging policy

D) Sensitivity labels

Answer: A

Explanation:

Data protection in Microsoft Teams is essential for preventing unauthorized sharing of sensitive information that could lead to compliance violations, data breaches, or intellectual property loss. Organizations handle various types of sensitive data including financial information, healthcare records, personal identifiable information (PII), trade secrets, and confidential business information. Preventing inappropriate sharing of this data requires proactive controls that can detect sensitive content and take preventive or corrective actions. Microsoft 365 provides multiple data protection mechanisms including DLP policies, sensitivity labels, retention policies, and information barriers, each serving different purposes in the overall data protection strategy. Understanding which tool addresses which protection scenario is crucial for implementing effective security controls.

Data Loss Prevention (DLP) is a security technology that identifies, monitors, and protects sensitive information in use, in motion, and at rest. DLP policies work by scanning content for patterns that match sensitive information types such as credit card numbers, social security numbers, bank account numbers, health records, or custom patterns defined by the organization. When DLP policies detect sensitive content, they can take various actions including blocking sharing, restricting access, notifying users with policy tips, alerting administrators, or encrypting content. DLP in Microsoft Teams monitors chat messages, channel messages, and files shared in Teams, providing real-time protection against inappropriate sharing of sensitive data. This proactive approach prevents data loss before it occurs rather than responding after incidents happen.

A is correct because Data Loss Prevention (DLP) policies are specifically designed to prevent users from sharing sensitive information by detecting content that matches sensitive information types and taking protective actions. For preventing sharing of sensitive financial data in Teams, administrators would create a DLP policy in the Microsoft 365 compliance center (or Purview) that defines what constitutes sensitive financial data (using pre-built sensitive information types like credit card numbers, bank routing numbers, SWIFT codes, or custom patterns for organization-specific financial data), applies to Teams chat and channel messages, configures actions to take when sensitive content is detected (such as block sharing, require justification, notify users, or alert administrators), and assigns the policy to users or groups. When users attempt to share messages containing financial data matching the policy, Teams immediately prevents the sharing and displays a policy tip explaining why the content was blocked. This provides real-time protection exactly as described in the question’s requirement to prevent sharing of sensitive financial data.

B is incorrect because retention policies manage data lifecycle by specifying how long content must be retained and when it should be deleted, but they don’t prevent users from sharing sensitive content. Retention policies are reactive controls that apply after content is created and shared—they ensure data is preserved for compliance periods or deleted after retention periods expire, but they don’t scan content for sensitive information or block sharing at the time of creation. A retention policy might ensure that financial data in Teams messages is retained for 7 years for regulatory compliance, but it wouldn’t prevent users from inappropriately sharing that data in the first place. DLP policies provide preventive controls that stop inappropriate sharing, while retention policies provide lifecycle management after sharing occurs.

C is incorrect because messaging policies in Teams control messaging features and capabilities like whether users can delete messages, edit messages, use priority notifications, send memes, or use read receipts, but they don’t scan content for sensitive information or enforce data protection rules. Messaging policies manage user experience and available features, not content-based security controls. You could use messaging policies to disable certain messaging features organization-wide, but this doesn’t provide the intelligent content scanning and selective enforcement that DLP offers. For preventing sharing of specific types of sensitive content like financial data, DLP policies that scan message content for sensitive information types are the appropriate solution, not messaging policies that control feature availability.

D is incorrect because while sensitivity labels are valuable for data classification and protection, they work differently than DLP policies and require user action to apply. Sensitivity labels allow users (or automatic classification rules) to tag content with classification levels like Confidential, Highly Confidential, or Public, then enforce protection settings like encryption, access restrictions, or watermarks based on those labels. However, sensitivity labels rely on content being properly labeled, either manually by users or automatically by trainable classifiers. DLP policies provide more immediate and automatic protection by scanning all content in real-time for sensitive information patterns regardless of labeling. While an organization might use both DLP and sensitivity labels together for comprehensive data protection, for the specific requirement of preventing sharing of sensitive financial data, DLP policies provide direct and automatic enforcement without relying on labeling.

Question 156: 

A company wants to restrict Teams usage so that only licensed users in specific departments can create and participate in private channels. Which configuration achieves this requirement?

A) Assign Teams policies to specific users allowing private channel creation

B) Configure Azure AD conditional access for private channels

C) Use PowerShell to disable private channels organization-wide, then enable for specific users

D) Create a custom Teams template with private channels disabled

Answer: A

Explanation:

Private channels in Microsoft Teams provide a way to create focused collaboration spaces within teams where only specific team members can access conversations and files. While standard channels are visible to all team members, private channels restrict access to invited members only, providing additional privacy and segmentation within teams. Organizations may want to control who can create private channels for various reasons including governance concerns, compliance requirements, reducing complexity, or ensuring appropriate usage. Microsoft Teams provides granular policy controls that allow administrators to manage private channel creation at the user or group level, enabling different policies for different organizational roles or departments.

Teams policies encompass various settings that control what users can do within Teams, including team creation, channel creation, app usage, messaging capabilities, meeting features, and calling features. The policies can be assigned globally (applying to all users unless overridden) or to specific users or groups, providing flexible governance that can vary by role, department, or security requirements. For private channel management specifically, the relevant policy settings are found in Teams policies which control not only team creation but also private channel and shared channel creation permissions. This granular control allows organizations to enable private channels for some users while restricting them for others, based on business needs.

A is correct because Teams policies in the Teams admin center allow administrators to control private channel creation permissions and can be assigned to specific users or groups, enabling granular control by department. To implement the requirement, administrators would navigate to Teams admin center > Teams > Teams policies, create custom policies or modify existing ones with settings for «Create private channels» set to On for users who should have this capability, assign these policies to users in the authorized departments (either directly to users or to groups), and ensure the global policy or policies assigned to other users have private channel creation disabled. Teams policies provide per-user granularity, meaning different users can have different capabilities based on their assigned policies. This approach enables precise control, allowing only specific licensed users in designated departments to create and use private channels while preventing others from doing so. The policy assignment can be done through the Teams admin center GUI or PowerShell for bulk operations.

B is incorrect because Azure AD conditional access policies control access to applications and services based on conditions like user location, device state, sign-in risk, and platform, but they don’t provide granular control over specific Teams features like private channel creation. Conditional access operates at the service authentication level—you can use conditional access to require MFA for accessing Teams, block access from certain locations, or require compliant devices, but once users are authenticated and accessing Teams, conditional access doesn’t control which specific features within Teams they can use. Feature-level controls like private channel creation are managed through Teams policies, not conditional access policies. Conditional access and Teams policies serve complementary but different purposes—conditional access for authentication and access control, Teams policies for feature and capability control.

C is incorrect because while PowerShell can be used to manage Teams policies and settings, there isn’t a straightforward cmdlet structure that disables private channels organization-wide and then enables them for specific users in the manner described. More importantly, this approach suggests a process that’s more complex than necessary when Teams policies already provide the needed granularity through the admin center. Teams policies can be configured and assigned through PowerShell using cmdlets like New-CsTeamsChannelsPolicy, Set-CsTeamsChannelsPolicy, and Grant-CsTeamsChannelsPolicy, but the proper approach is to create policies with appropriate settings and assign them to users, not to disable features globally and then selectively enable them. The Teams policy framework is designed to provide this granularity natively, and using the policy assignment model (whether through GUI or PowerShell) is the correct approach.

D is incorrect because Teams templates define the initial structure of teams including pre-configured channels, tabs, and apps that are created when someone uses the template to create a new team, but templates don’t control user permissions or capabilities like who can create private channels. Templates are about standardizing team structure and initial configuration to ensure consistency and save setup time, not about enforcing ongoing governance policies. A template might include or exclude initial private channels in its structure, but it doesn’t control whether users can create additional private channels after the team is created. That ongoing capability control is managed through Teams policies. Templates and policies serve different purposes—templates for initial team structure, policies for ongoing feature and capability control.

Question 157: 

An organization needs to configure Teams so that meeting recordings are automatically uploaded to OneDrive instead of SharePoint. Which setting should be modified?

A) Meeting policy in Teams admin center

B) OneDrive retention policy

C) SharePoint admin center storage settings

D) This behavior cannot be changed; recordings always go to SharePoint for channel meetings

Answer: D

Explanation:

Meeting recordings in Microsoft Teams have specific storage behaviors that administrators and users should understand for proper file management, sharing, and governance. When users record Teams meetings, the recordings are automatically saved to specific locations based on the type of meeting: non-channel meetings (regular meetings not associated with a channel) have recordings saved to the organizer’s OneDrive, while channel meetings (meetings scheduled in a Teams channel) have recordings saved to the SharePoint site associated with that team, specifically in the Recordings folder. This behavior is built into the Teams architecture and reflects the collaborative nature of channel meetings versus personal meetings. Understanding these automatic behaviors is important for managing storage, permissions, and retention policies.

The automatic storage location for meeting recordings was designed to align with the meeting context and appropriate access controls. OneDrive storage for regular meetings makes sense because these are typically personal or ad-hoc meetings where the organizer controls access and sharing. SharePoint storage for channel meetings aligns with team collaboration principles where channel members should have access to meeting artifacts. This architectural decision affects various aspects of Teams administration including storage capacity planning, retention policy application, permission management, and user training. While administrators can control many aspects of Teams meetings through policies, the fundamental storage location behavior for channel meeting recordings is built into the platform architecture.

D is correct because the storage location for Teams meeting recordings is determined by the meeting type and cannot be changed through administrative settings. Non-channel meetings (standard meetings not associated with a channel) automatically store recordings in the meeting organizer’s OneDrive for Business, while channel meetings (meetings scheduled in a Teams channel) automatically store recordings in the SharePoint document library associated with that team, specifically in a Recordings folder within the channel’s files. This behavior is architectural and not configurable through policies or settings in the Teams admin center, SharePoint admin center, or OneDrive admin center. Administrators cannot force channel meeting recordings to save to OneDrive instead of SharePoint, as this would conflict with the access model for channel content which should be available to all channel members. Understanding this built-in behavior is important for capacity planning, retention policy application, and user education. If users or organizations need different storage behaviors, they would need to manually move recordings after they’re created, but the initial automatic storage location is determined by meeting type and cannot be administratively changed.

A is incorrect because while meeting policies in the Teams admin center control many aspects of meeting behavior including whether recording is allowed, who can record, whether transcription is available, and many other meeting features, they do not control where recordings are stored. Meeting policies enable or restrict recording capabilities but don’t change the automatic storage location which is architecturally determined by meeting type. You can use meeting policies to control who can record meetings, but the recordings will still follow the standard behavior: OneDrive for non-channel meetings, SharePoint for channel meetings. Meeting policies provide extensive control over meeting features but don’t override the fundamental storage architecture.

B is incorrect because OneDrive retention policies manage how long content in OneDrive is retained and when it’s deleted for compliance purposes, but they don’t control where Teams meeting recordings are initially stored. Retention policies are about data lifecycle management (retention and deletion), not about controlling storage location for newly created content. A retention policy might specify that recordings in OneDrive must be retained for 3 years, but it doesn’t cause channel meeting recordings to be stored in OneDrive instead of SharePoint. Retention policies and storage location are separate concepts—retention policies apply to content wherever it’s stored, but don’t determine where new content is initially saved.

C is incorrect because SharePoint admin center storage settings manage storage quotas, default sharing permissions, access control, and other SharePoint configuration, but they don’t control how Teams meeting recordings are stored or provide options to redirect channel meeting recordings to OneDrive. SharePoint settings affect the SharePoint environment where channel meeting recordings are stored, but they don’t change the fundamental behavior that channel meetings store recordings in SharePoint rather than OneDrive. This storage behavior is built into Teams architecture and not configurable through SharePoint admin center settings. SharePoint settings might affect how recordings are shared or retained once they’re in SharePoint, but they don’t redirect storage to OneDrive.

Question 158: 

A Teams administrator needs to implement a policy that prevents users from bypassing the lobby in meetings, ensuring all participants wait for admission. Which policy setting should be configured?

A) Meeting policy — «Automatically admit people» set to «Only me»

B) Meeting policy — «Anonymous users can join a meeting» set to Off

C) Meeting policy — «Let dial-in callers bypass the lobby» set to Off

D) App permission policy restricting meeting access

Answer: A

Explanation:

Meeting security in Microsoft Teams has become increasingly important as virtual meetings have become standard for business communication. Controlling who can join meetings and how they’re admitted helps prevent «Zoom-bombing» style disruptions, unauthorized access to confidential discussions, and ensures meeting organizers maintain control over their meeting spaces. The lobby feature in Teams meetings acts as a virtual waiting room where participants wait until admitted by meeting organizers or presenters. Different organizations have different security postures for meetings—some want open collaboration with easy joining, while others require strict control with manual admission of all participants. Microsoft Teams provides granular meeting policies that control lobby behavior, allowing organizations to balance security with user experience.

The «Automatically admit people» setting in Teams meeting policies is one of the most important security controls for meetings. This setting determines which participants can bypass the lobby and join meetings directly versus which participants must wait in the lobby for admission. The options include everyone (least restrictive, anyone including anonymous users joins directly), people in my organization and guests (organization users and invited guests join directly, external anonymous users wait), people in my organization (only organization users join directly, guests and external users wait), organizer and co-organizers only (most restrictive, only the organizer and any designated co-organizers join directly, all others wait), and invited users only (users specifically invited join directly, others wait). Understanding these options and their security implications is essential for implementing appropriate meeting controls.

A is correct because the meeting policy setting «Automatically admit people» set to «Only me» (which corresponds to «Organizer and co-organizers only» in some interface versions) enforces the most restrictive lobby behavior, requiring all participants except the organizer and co-organizers to wait in the lobby for admission. When this policy is applied to users, any meetings they organize will automatically place all other participants—including people from the same organization, guests, and external anonymous users—into the lobby, where they must wait until the organizer or a co-organizer manually admits them. This provides maximum meeting security by ensuring the organizer has explicit control over who enters the meeting, preventing unauthorized participants from joining even if they have the meeting link. To implement this, administrators navigate to Teams admin center > Meetings > Meeting policies, select or create a policy, set «Automatically admit people» to «Organizer and co-organizers only» (or «Only me»), and assign this policy to users who need this security level. This setting ensures participants cannot bypass the lobby as required by the question.

B is incorrect because while the setting «Anonymous users can join a meeting» controls whether users without authentication can join Teams meetings at all, it doesn’t enforce lobby waiting for authenticated users. Setting this to Off completely blocks anonymous users from joining meetings (they can’t even reach the lobby), but authenticated users from the organization or guests could still bypass the lobby depending on the «Automatically admit people» setting. This setting is binary (On or Off) for anonymous access, not about lobby behavior. If you want to allow anonymous users but require them to wait in the lobby, you would keep anonymous access On but configure «Automatically admit people» appropriately. The question asks specifically about preventing lobby bypass, which requires configuring the «Automatically admit people» setting, not the anonymous access setting.

C is incorrect because «Let dial-in callers bypass the lobby» is a specific setting that controls whether participants joining via phone (PSTN dial-in) can skip the lobby, but it doesn’t address the broader requirement of ensuring all participants wait in the lobby. Setting this to Off ensures phone participants also wait in the lobby, which is good for security, but doesn’t control lobby behavior for participants joining via the Teams client, web, or mobile apps. This is a supplementary security control that should be configured in addition to the main «Automatically admit people» setting, but it’s not sufficient by itself to ensure all participants wait for admission. The primary control for comprehensive lobby enforcement is the «Automatically admit people» setting, with dial-in caller settings providing additional control for PSTN participants specifically.

D is incorrect because app permission policies in Teams control which apps users can install and use within Teams, not meeting access or lobby behavior. App permission policies manage the Teams app ecosystem including Microsoft apps, third-party apps, and custom apps, allowing administrators to control which applications are available to users. These policies have no relationship to meeting security, participant admission, or lobby controls. Meeting access and lobby behavior are controlled through meeting policies, specifically the «Automatically admit people» setting, not through app permission policies. This answer represents a fundamental misunderstanding of the different policy types and their purposes in Teams administration.

Question 159: 

An organization wants to ensure that all team names follow a specific naming convention with a required prefix based on department. Which feature should be configured?

A) Naming policy in Azure AD

B) Teams creation template

C) Teams policy in Teams admin center

D) PowerShell script to rename teams

Answer: A

Explanation:

Team and group naming governance is an important aspect of organizational management in Microsoft Teams and Microsoft 365. As organizations grow and users create numerous teams, maintaining a consistent naming structure becomes challenging without automated controls. Clear naming conventions help users identify teams’ purposes, understand ownership or departmental association, maintain professional appearance, simplify searching and discovery, and ensure compliance with organizational standards. Without enforced naming policies, team names can become inconsistent, confusing, or even inappropriate. Microsoft provides naming policy features that automatically enforce naming conventions including required prefixes, suffixes, and blocked words, ensuring consistency without requiring manual oversight.

Naming policies work by intercepting team and group creation requests and automatically applying prefix or suffix rules before the team is created. These policies can incorporate both static text (like «Dept-» as a prefix) and dynamic attributes from Azure AD (like the user’s department name). The naming policy enforcement happens automatically and transparently—users enter their desired team name, and the system automatically adds required prefixes or suffixes. This approach ensures 100% compliance with naming standards without relying on user training or manual enforcement. Understanding where naming policies are configured and how they interact with Teams creation is important for implementing effective governance.

A is correct because naming policies are configured in Azure Active Directory (Azure AD) and automatically enforce naming conventions for all Microsoft 365 Groups, which includes Teams since every team is backed by a Microsoft 365 Group. To implement a naming policy that adds department-based prefixes, administrators navigate to Azure AD > Groups > Naming policy, where they can configure prefix and suffix requirements using either static text or dynamic attributes from user properties. For the scenario described, administrators would configure a prefix using the [Department] attribute, which would automatically pull each user’s department from their Azure AD profile and add it as a prefix to any team name they create. For example, if a user in the «Sales» department creates a team named «Q1 Planning,» the naming policy automatically creates the team as «Sales-Q1 Planning.» Additionally, naming policies can block specific words to prevent inappropriate or reserved terms. Once configured, the naming policy applies automatically to all team creation, including through Teams client, PowerShell, Microsoft Graph API, or any other method, ensuring consistent enforcement across all creation methods.

B is incorrect because Teams creation templates provide pre-configured team structures including channels, tabs, and apps that are created when someone uses the template, but templates don’t enforce naming conventions or automatically add prefixes to team names. Templates standardize team structure and configuration but don’t control or modify the team names users choose. A user selecting a template still enters whatever team name they want (subject to naming policies if configured), and the template creates the predefined structure with that name. Templates and naming policies serve complementary but different purposes—templates for consistent team structure, naming policies for consistent team naming. For enforcing prefix-based naming conventions, naming policies in Azure AD are the appropriate solution, not templates.

C is incorrect because Teams policies in the Teams admin center control various Teams features and capabilities including team creation permissions, private channel creation, discovery settings, and other functional aspects, but they don’t enforce naming conventions or add prefixes to team names. Teams policies determine who can create teams and what features are available, but they don’t modify or validate team names. You could use Teams policies to restrict who can create teams to specific users who might follow naming conventions manually, but this doesn’t provide automated enforcement. For automatic prefix enforcement with department-based variables, naming policies in Azure AD are the correct solution, as they apply to all Microsoft 365 Group creation including Teams.

D is incorrect because while PowerShell scripts could theoretically be used to rename teams after creation to enforce naming conventions, this is a reactive and imperfect approach rather than a proactive enforcement mechanism. A PowerShell script would need to continuously monitor for new teams and rename them, which creates a window where teams exist with incorrect names, requires ongoing script execution and maintenance, doesn’t prevent users from seeing or using incorrectly named teams during the gap, and doesn’t educate users about naming standards at creation time. Azure AD naming policies provide proactive, real-time enforcement that applies naming conventions immediately at creation time, ensuring teams never exist with incorrect names. PowerShell is valuable for many administrative tasks, but for consistent naming enforcement, the proper solution is Azure AD naming policies, not reactive scripting.

Question 160: 

A company needs to configure Teams so that external participants cannot record meetings organized by internal users. Which setting should be modified?

A) Meeting policy — «Cloud recording» set to Off for users

B) Meeting policy — «Anonymous users can start a meeting» set to Off

C) External access settings to block recording

D) Meeting policy — «Who can record» set to «Organizers and co-organizers»

Answer: D

Explanation:

Meeting recording controls in Microsoft Teams provide important governance capabilities for organizations concerned about confidentiality, compliance, and content control. Recording meetings captures audio, video, screen sharing, and active speaker video, creating comprehensive records of meetings that can be valuable for reference, training, or compliance purposes. However, organizations may have legitimate concerns about who can initiate recordings, particularly when external participants are involved. External participants might record sensitive discussions, proprietary information, or confidential negotiations that the organization doesn’t want distributed outside their control. Teams provides granular policy controls over recording capabilities that allow organizations to balance the benefits of recording with security and confidentiality requirements.

Meeting policies include several settings related to recording functionality including whether cloud recording is enabled at all, who can record meetings (everyone, organizers and co-organizers only, or organizers only depending on the version), whether recordings are automatically expired, and whether transcription is available. The «Who can record» setting specifically controls which roles in a meeting can initiate recordings, providing the granular control needed to prevent external participants from recording. Understanding the difference between disabling recording entirely versus restricting who can record is important—organizations may want recording capability for internal use while preventing external participants from creating recordings. This nuanced control allows the recording feature’s benefits while addressing security concerns.

D is correct because the meeting policy setting «Who can record» (or «Cloud recording» with role-based options in some policy versions) can be configured to restrict recording initiation to organizers and co-organizers only, which prevents external participants from starting recordings. When this policy is set to «Organizers and co-organizers,» only the meeting organizer (who is internal in this scenario) and any co-organizers they designate can start recordings. External participants joining the meeting—whether as authenticated users from other organizations or anonymous participants—cannot initiate recordings because they don’t have organizer or co-organizer roles. To implement this, administrators navigate to Teams admin center > Meetings > Meeting policies, select or create a policy, locate the recording settings, set «Who can record» to «Organizers and co-organizers» (or configure «Cloud recording» with appropriate role restrictions), and assign this policy to internal users. This ensures that while meetings can still be recorded for legitimate purposes, only internal organizers control when recording occurs, preventing external participants from capturing meeting content without permission.

A is incorrect because setting «Cloud recording» to Off completely disables meeting recording for all users assigned that policy, including internal organizers. This is too restrictive for the requirement, which asks specifically to prevent external participants from recording, not to disable recording entirely. If recording is disabled for internal users, they cannot record their own meetings even when no external participants are present, losing valuable functionality. The requirement is more nuanced—allow recording but control who can initiate it. Setting cloud recording to Off is appropriate when organizations want to completely prohibit recording for compliance or security reasons, but when the goal is specifically to prevent external participant recording while maintaining internal recording capability, configuring who can record based on roles is the appropriate approach.

B is incorrect because «Anonymous users can start a meeting» controls whether anonymous participants (those joining without authentication) can start a scheduled meeting if they arrive before the organizer, but this setting has no relationship to recording permissions. This setting is about meeting start control, not recording control. If set to Off, anonymous users must wait in the lobby until an authenticated user joins and starts the meeting, but this doesn’t prevent them from recording once the meeting starts if recording permissions allow it. Anonymous meeting start and recording permissions are separate controls managed through different policy settings. For preventing external participants from recording, the «Who can record» setting is the relevant control, not meeting start settings.

C is incorrect because external access settings in Teams admin center control federation and inter-organization communication including which external domains users can communicate with, but they don’t provide granular feature controls like recording permissions for individual meetings. External access enables or blocks communication with external organizations at a broad level, but once communication is allowed, feature-level controls like recording permissions are managed through meeting policies, not external access settings. External access doesn’t have settings specifically for blocking recording by external users. For controlling who can record meetings with external participants, meeting policies with the «Who can record» setting provide the appropriate granular control.

Question 161: 

An organization wants to archive inactive teams that haven’t been used for more than 180 days while preserving the content for compliance. Which approach should be used?

A) Delete the teams and rely on deleted item retention

B) Archive the teams using the Teams client or PowerShell

C) Apply a retention policy to preserve the content, then delete teams

D) Use Microsoft 365 Groups expiration policy

Answer: B

Explanation:

Team lifecycle management is an important governance challenge for organizations using Microsoft Teams. As teams proliferate, many become inactive over time as projects complete, initiatives end, or teams transition to other collaboration spaces. Inactive teams consume licenses, storage space, and administrative overhead while creating clutter that makes it harder for users to find active, relevant teams. However, organizations typically cannot simply delete inactive teams because they contain potentially valuable historical information, may be needed for compliance or legal discovery, or might need to be reactivated if the project resumes. Microsoft Teams provides team archiving functionality specifically designed for this scenario, allowing organizations to preserve team content while reducing the active management burden.

Archiving a team places it in a read-only state where the team and all its content remain accessible but users cannot post new messages, add channels, or modify content. Archived teams don’t appear in users’ regular teams lists (though they can be shown by filtering for archived teams), reducing clutter while preserving discoverability when needed. The underlying Microsoft 365 Group and associated resources like SharePoint sites and mailboxes are also placed in inactive states, potentially reducing licensing costs depending on the organization’s license types. Archiving is reversible—teams can be unarchived if the need arises. Understanding the difference between archiving (preservation with reduced activity), deletion (removal with recovery period), and retention policies (compliance-focused content preservation) is important for implementing appropriate lifecycle management.

B is correct because archiving teams is the purpose-built feature for preserving inactive teams’ content while removing them from active use, exactly matching the requirement to archive inactive teams while preserving content. Team owners can archive teams through the Teams client by navigating to the team, selecting More options (…), and choosing «Archive team.» Administrators can archive teams in bulk using PowerShell with the Set-TeamArchivedState cmdlet, which is particularly useful for archiving multiple inactive teams identified through usage reports. When a team is archived, all chat and channel messages remain searchable and accessible for compliance and reference, the SharePoint site becomes read-only, the associated mailbox is placed on inactive status, membership remains unchanged (members can still view content), the team can be unarchived if needed, and licensing implications may reduce costs depending on the license type. For the scenario of managing teams inactive for 180 days, administrators would use the Teams usage reports or Microsoft Graph API to identify inactive teams, then use PowerShell to archive them in bulk while ensuring content remains available for compliance purposes.

A is incorrect because deleting teams is more aggressive than necessary and relies on deleted item retention rather than purposeful preservation. When teams are deleted, they enter a soft-deleted state for 30 days (during which they can be restored), but after 30 days they’re permanently deleted. While content might be preserved by retention policies if configured, deleted teams are removed from user access and are not designed as an archival strategy. Deletion is appropriate when teams are truly no longer needed and retention policies handle compliance preservation, but archiving is specifically designed for the «inactive but may need access» scenario described in the question. Archiving provides ongoing read access to team content while deletion removes access entirely (requiring restoration or relying on compliance tools like eDiscovery to access preserved content). For preserving inactive teams as described, archiving is the appropriate approach, not deletion.

C is incorrect because while this approach could technically work (applying retention policies to preserve content, then deleting teams), it’s unnecessarily complex and removes user access to the content. Retention policies preserve content for compliance purposes and enable retrieval through eDiscovery tools, but accessing content through eDiscovery is more complex than accessing archived teams. Additionally, this approach provides no easy path to reactivate the team if needed—you would need to restore the deleted team within 30 days or accept that it’s permanently gone (with only content preserved in compliance systems). The archiving feature was specifically designed to handle this scenario more elegantly by preserving content, maintaining accessibility, and allowing reactivation if needed. Using retention policies plus deletion is over-engineering a solution when archiving provides the needed functionality directly.

D is incorrect because Microsoft 365 Groups expiration policy automatically deletes groups (and their associated teams) after a configured period of inactivity unless renewed, which is the opposite of what’s needed for preserving inactive teams. Expiration policies are designed for automatic cleanup of abandoned groups, not for archiving with content preservation. While expiration policies send renewal notifications before deletion, they ultimately result in deletion if not renewed. The question specifically asks to preserve content while archiving inactive teams, which requires the archiving feature, not expiration policies that lead to deletion. Expiration policies and archiving serve different governance goals—expiration for automatic cleanup, archiving for preservation of inactive teams.

Question 162: 

A Teams administrator needs to prevent users from using Giphy, memes, and stickers in team conversations. Which policy type should be modified?

A) Messaging policy

B) Meeting policy

C) App permission policy

D) Teams policy

Answer: A

Explanation:

Content and communication controls in Microsoft Teams allow organizations to establish appropriate workplace communication standards that balance professional conduct with collaborative culture. Different organizations have different tolerance levels for informal communication elements like animated GIFs, memes, and stickers—some encourage these for building culture and engagement, while others consider them unprofessional or distracting. Additionally, some organizations may need to restrict these features for compliance or regulatory reasons, bandwidth concerns in limited network environments, or to prevent inappropriate content sharing. Microsoft Teams provides granular controls over these communication features through various policy types, each controlling different aspects of the Teams experience.

Messaging policies in Teams control the features available to users within chat and channel conversations including the ability to delete sent messages, edit sent messages, use priority notifications, enable read receipts, use immersive reader, translate messages, and use fun content like Giphy, memes, and stickers. These policies can be customized and assigned to different users or groups, allowing organizations to provide different communication features to different populations. For example, executives might have different messaging policies than general staff, or certain departments with specific compliance requirements might have more restrictive policies. Understanding which policy type controls which features is essential for implementing appropriate communication governance.

A is correct because messaging policies in the Teams admin center specifically control whether users can use Giphy, memes, and stickers in their team conversations. To restrict these features, administrators navigate to Teams admin center > Messaging policies, select the global policy or create a custom policy, and configure the following settings: «Use Giphy in conversations» can be set to Off to disable animated GIFs, «Use Memes in conversations» can be set to Off to prevent meme usage, and «Use Stickers in conversations» can be set to Off to block stickers. Additionally, for organizations that want to allow Giphy but with content restrictions, there’s a «Giphy content rating» setting that can be set to Strict or Moderate (or disabled by turning off Giphy entirely). Once configured, the policy is assigned to users or groups, and the settings take effect immediately. This provides the exact control described in the question—preventing users from using Giphy, memes, and stickers in team conversations through appropriate policy configuration.

B is incorrect because meeting policies control settings and features related to Teams meetings including audio and video permissions, recording capabilities, screen sharing options, meeting scheduling settings, and participant controls, but they don’t control chat-based communication features like Giphy, memes, or stickers. Meeting policies focus on the meeting experience specifically, not general messaging capabilities. While meetings include chat functionality, the availability of Giphy, memes, and stickers in those chats is still controlled by messaging policies, not meeting policies. This is an important distinction—meeting policies for meeting-specific features, messaging policies for chat and communication features.

C is incorrect because app permission policies control which apps users can install and use within Teams including Microsoft apps, third-party apps, and custom apps, but Giphy, memes, and stickers are built-in messaging features, not apps. App permission policies manage the Teams app ecosystem and marketplace, allowing administrators to block or allow specific applications. While Giphy is technically delivered through integration with Giphy’s service, the control for whether users can use it in conversations is managed through messaging policies’ built-in settings, not through app permission policies. App permission policies don’t include settings for these communication features. Messaging policies provide the appropriate controls for Giphy, memes, and stickers.

D is incorrect because Teams policies (also called Teams settings) control team-level features including whether users can create teams, create private channels, discover teams, and other team management capabilities, but they don’t control chat-based communication features like Giphy, memes, or stickers. Teams policies focus on team creation and management governance, not the communication features available within team conversations. The naming can be confusing—»Teams policies» control team creation and management, while «messaging policies» control communication features. For restricting fun content elements in conversations, messaging policies are the correct policy type, not Teams policies.

Question 163: 

An organization wants to implement a solution that automatically classifies and labels sensitive content in Teams messages and applies encryption. Which feature should be configured?

A) Sensitivity labels with auto-labeling policies

B) Data Loss Prevention (DLP) policy

C) Retention labels

D) Information Rights Management (IRM)

Answer: A

Explanation:

Information protection in Microsoft Teams requires comprehensive controls that can identify sensitive content, apply appropriate classifications, and enforce protection measures like encryption or access restrictions. Organizations handle various types of sensitive data including confidential business information, personal data, financial records, and intellectual property that require protection from unauthorized access or inappropriate sharing. Modern information protection goes beyond simple access controls to include classification, labeling, and persistent protection that follows content wherever it travels. Microsoft 365 provides integrated information protection capabilities including sensitivity labels, DLP policies, and encryption that work together to protect sensitive information throughout its lifecycle.

Sensitivity labels are a foundational information protection feature that allows organizations to classify content based on sensitivity and automatically apply protective actions based on that classification. Labels can be applied manually by users, recommended by automatic classifiers, or applied automatically based on content inspection. When applied, sensitivity labels can enforce protections including encryption (restricting who can access content), access controls (limiting permissions), content marking (adding watermarks, headers, or footers), and container protection (controlling team and site settings). Auto-labeling policies use machine learning and pattern matching to detect sensitive content and automatically apply appropriate labels, providing consistent protection without relying on user judgment or action. This combination of automatic classification and enforcement provides comprehensive protection for sensitive content.

A is correct because sensitivity labels with auto-labeling policies provide the complete solution described in the question: automatic classification, labeling, and encryption of sensitive content. Sensitivity labels are configured in the Microsoft 365 compliance center (or Purview) where administrators define labels like «Public,» «Internal,» «Confidential,» and «Highly Confidential» with associated protections. For each label, administrators can configure encryption settings that restrict access to specific users or groups, define usage rights (view-only, edit, forward), and set expiration dates. Auto-labeling policies automatically inspect content in Teams messages (and other locations like Exchange and SharePoint) for sensitive information types, trainable classifiers, or keywords, then automatically apply the appropriate sensitivity label. For example, an auto-labeling policy could detect financial data in Teams messages and automatically apply a «Confidential» label that encrypts the message and restricts access. This provides the automatic classification, labeling, and encryption requested in the question, ensuring sensitive content is protected consistently without requiring user action.

B is incorrect because while Data Loss Prevention (DLP) policies can detect sensitive content and take protective actions like blocking sharing or notifying users, they don’t apply persistent classification labels or encryption to content. DLP policies are preventive controls that monitor content and enforce policies at the point of sharing or use, but they don’t classify or encrypt content for persistent protection. DLP might block a user from sharing a message containing credit card numbers, but it doesn’t label that message as confidential or encrypt it for ongoing protection. DLP and sensitivity labels are complementary—DLP prevents inappropriate sharing, while sensitivity labels provide classification and persistent protection. For the specific requirement of automatically classifying, labeling, and encrypting sensitive content, sensitivity labels with auto-labeling policies are the appropriate solution, not DLP alone.

C is incorrect because retention labels manage data lifecycle by specifying how long content should be retained and when it should be deleted for compliance purposes, but they don’t provide classification-based encryption or access controls. Retention labels are about compliance and lifecycle management (keeping content for required periods or disposing of it when appropriate), not about protecting content from unauthorized access. A retention label might specify that financial records must be retained for 7 years, but it doesn’t encrypt those records or restrict who can access them. Retention labels and sensitivity labels serve different purposes—retention for compliance lifecycle management, sensitivity for classification and protection. For automatically classifying and encrypting sensitive content, sensitivity labels are required, not retention labels.

D is incorrect because Information Rights Management (IRM) is the underlying technology that enforces encryption and usage restrictions for protected content, but it’s not the user-facing feature that automatically classifies and labels content. IRM (also called Azure Information Protection in its cloud implementation) is the encryption and rights management engine that sensitivity labels use to enforce protection, but organizations configure and apply sensitivity labels, not IRM directly. Think of IRM as the engine and sensitivity labels as the interface—users and administrators work with sensitivity labels, which in turn utilize IRM/Azure RMS to enforce encryption. Additionally, IRM alone doesn’t provide automatic classification—that comes from auto-labeling policies working with sensitivity labels. For the complete solution of automatic classification, labeling, and encryption, sensitivity labels with auto-labeling policies is the correct answer.

Question 164: 

A company needs to configure emergency calling for Teams Phone users to ensure that when users dial emergency services, security personnel are automatically notified. Which feature should be implemented?

A) Emergency call routing policy

B) Emergency calling policy with notification contacts

C) Calling policy with emergency addresses

D) Direct Routing configuration

Answer: B

Explanation:

Emergency calling in Microsoft Teams Phone is a critical safety feature that must be properly configured to ensure users can reach emergency services and that appropriate organizational personnel are notified when emergency calls occur. Unlike traditional office phone systems where emergency calls originate from fixed locations easily identified by emergency services, Teams Phone users may be mobile or remote, creating complexities for emergency response. Microsoft Teams provides comprehensive emergency calling capabilities including dynamic location determination, emergency call routing, and notification features that alert designated security or facilities personnel when emergency calls are made. Proper configuration of emergency calling is not only a safety imperative but may also be legally required in many jurisdictions.

Teams Phone emergency calling involves several components: emergency addresses (physical locations registered for emergency services), emergency locations (specific places within addresses like floors or wings), emergency calling policies (which control notifications and other emergency calling features), call routing policies (which determine how calls are routed to emergency services), and location information services (which determine user locations for dynamic emergency address assignment). Understanding the distinctions between these components and their specific purposes is essential for implementing comprehensive emergency calling solutions. Some features control how calls reach emergency services, while others focus on notifying internal personnel—the question specifically asks about notification, which requires specific policy configuration.

B is correct because emergency calling policies in Teams admin center specifically include settings for configuring notification contacts who are automatically alerted when users make emergency calls. Emergency calling policies are configured in Teams admin center > Voice > Emergency policies > Calling policies, where administrators can create policies that include external emergency addresses, notification mode (send notification only, conferenced in but are muted, or conferenced in and are unmuted), and notification contacts (users or groups who should be notified). For the scenario described where security personnel should be notified when emergency calls occur, administrators would create an emergency calling policy, set notification mode to an appropriate option (typically «Send notification only» or «Conferenced in but are muted» allows security to be aware without interfering with the emergency call), add security personnel as numbers for emergency calls notification, and assign this policy to Teams Phone users. When a user dials emergency services (like 911 in the US), the designated security contacts automatically receive notifications (Teams notification, SMS, or are conferenced into the call depending on the notification mode), allowing them to respond appropriately such as meeting emergency responders at the building entrance or securing the area.

A is incorrect because emergency call routing policies control how emergency calls are routed to emergency services (Public Safety Answering Points or PSAPs), not who gets notified when emergency calls occur. Call routing policies determine technical aspects like whether calls go directly to emergency services, through an on-premises gateway via Direct Routing, or to a specified emergency number, based on the user’s network location. While call routing is important for ensuring emergency calls reach the appropriate destination, it doesn’t provide the notification feature described in the question. Emergency calling policies (not routing policies) include the notification settings needed to alert security personnel. Both policy types are important for comprehensive emergency calling, but notification specifically requires emergency calling policies.

C is incorrect because calling policies in Teams control general calling features like forwarding, simultaneous ringing, voicemail, and call groups, but they don’t include emergency calling notification settings. Calling policies manage everyday calling functionality, not emergency-specific features. Additionally, emergency addresses are registered in the Teams admin center under Locations rather than being part of calling policies—they’re organizational data about physical locations, not policy settings. Emergency notification is specifically configured through emergency calling policies (a separate policy type), not general calling policies. The distinction between regular calling policies and emergency calling policies is important—they’re separate policy types with different purposes.

D is incorrect because Direct Routing is a connectivity option that allows organizations to connect their own Session Border Controllers (SBCs) and PSTN carriers to Teams Phone, but it’s not specifically about emergency calling notification. Direct Routing is relevant for emergency calling in that it can be configured to route emergency calls through on-premises infrastructure to local emergency services, but the notification feature described in the question (alerting security personnel) is configured through emergency calling policies regardless of whether the organization uses Microsoft Calling Plans, Direct Routing, or Operator Connect. Direct Routing is an infrastructure choice for PSTN connectivity, while emergency notifications are configured through emergency calling policies that work with any PSTN connectivity option.

Question 165: 

An organization wants to analyze Teams usage patterns including which teams are most active, message volumes, and user engagement metrics. Which tool provides this information?

A) Microsoft 365 usage analytics in the admin center

B) Teams admin center Analytics & reports

C) Azure AD audit logs

D) Microsoft Graph API queries

Answer: B

Explanation:

Usage analytics and reporting in Microsoft Teams are essential for understanding how the platform is being adopted, identifying highly engaged teams versus inactive ones, making informed decisions about governance and lifecycle management, demonstrating value to stakeholders, and optimizing the Teams environment based on actual usage patterns. Organizations invest significant resources in deploying and managing Teams, and comprehensive reporting helps ensure that investment delivers returns through productive collaboration. Microsoft provides multiple reporting and analytics tools across different admin centers, each with different focuses and capabilities. Understanding which tool provides which information is important for efficient administration and decision-making.

Teams-specific analytics provide insights into collaboration patterns including team activity levels, message volumes across teams and channels, user participation and engagement, meeting usage, calling patterns, device usage, and application adoption. These metrics help administrators identify successful teams that can serve as models, identify inactive teams that might be candidates for archiving, recognize power users who might serve as champions, spot adoption challenges in specific departments, and measure the impact of training or change management initiatives. Different admin centers and tools provide different levels of detail and different perspectives on usage—some focus on broad organizational patterns while others provide granular team or user-level details.

B is correct because the Teams admin center Analytics & reports section provides comprehensive, Teams-specific reporting including team activity reports showing which teams are most active with message and post volumes, user activity reports showing individual user engagement with Teams features, device usage reports showing which platforms and devices users are accessing Teams from, app usage reports showing which Teams apps are being used, meeting and calling reports providing detailed telephony and meeting analytics, and PSTN usage reports for organizations using Teams Phone. These built-in reports are specifically designed for Teams administration and provide the exact information requested in the question including team activity levels, message volumes, and user engagement metrics. To access these reports, administrators navigate to Teams admin center > Analytics & reports, select the desired report type, configure the timeframe and filters, and view or export the results. The reports provide actionable insights for governance, adoption measurement, and optimization decisions. This is the purpose-built tool for Teams usage analysis and is the correct answer for the scenario described.

A is incorrect because while Microsoft 365 usage analytics in the admin center (Microsoft 365 admin center > Reports > Usage) provides usage information across Microsoft 365 services including Teams, it offers a broader organizational view rather than the Teams-specific depth available in the Teams admin center. The Microsoft 365 usage analytics shows adoption across services like Teams, SharePoint, Exchange, OneDrive, and Office applications, helping administrators understand overall Microsoft 365 adoption patterns. While it includes Teams data, it’s not as detailed or Teams-focused as the Analytics & reports section in the Teams admin center. For general Microsoft 365 adoption analysis, the Microsoft 365 admin center is appropriate, but for detailed Teams-specific analytics including which specific teams are most active and detailed engagement metrics, the Teams admin center provides more comprehensive and granular reporting.

C is incorrect because Azure AD audit logs track administrative actions, sign-ins, and security events across Azure AD and Microsoft 365, but they don’t provide usage analytics or engagement metrics for Teams. Audit logs show events like who created a team, who modified permissions, authentication attempts, and policy changes, which is valuable for security monitoring and compliance, but they don’t analyze usage patterns or measure engagement. Audit logs answer questions like «who did what and when» for security and compliance purposes, while usage reports answer questions like «how much is Teams being used and by whom» for adoption and optimization purposes. These are different types of information serving different administrative needs. For analyzing Teams usage patterns and engagement, Teams admin center reports are appropriate, not Azure AD audit logs.

D is incorrect because while Microsoft Graph API can be queried to retrieve Teams usage and reporting data programmatically (and in fact, the reports in the admin center are built on Graph API data), using Graph API directly requires development expertise, authentication setup, and custom code or tools. Graph API is appropriate when organizations need custom reporting, integration with external business intelligence tools, automated data collection, or specific data not available in standard reports. However, for the straightforward requirement of analyzing Teams usage patterns, the built-in Analytics & reports in the Teams admin center provides ready-to-use reports without requiring development work. Graph API is the underlying data source, but the Teams admin center reports provide the accessible interface for administrators. Unless custom or automated reporting is specifically needed, the built-in reports are the more appropriate and efficient solution.