Manage Teams, Channels, Chats, and Apps
Teams and membership
Every team is backed by a Microsoft 365 group, so membership is either assigned or driven dynamically by an Entra ID group rule; a dynamic team cannot have members edited manually in Teams. Guests must be enabled at tenant level before they can be added, and sensitivity labels applied to the team control container privacy and guest permissions. Team templates standardize channels and apps for repeatable provisioning.
Channel types (a favorite trap)
Standard channels are open to all team members and share the team's SharePoint site. Private channels limit visibility to a subset of team members, get their own SharePoint site, and can only include people who are already members of the team, including any owner who adds them. Shared channels connect people across organizations through Teams Connect, and guest accounts from your own tenant cannot be added to them. Channel moderation can restrict who posts in a channel.
Chats and apps
Messaging policies govern chat features such as edit and delete of sent messages, read receipts, and supervised chat. For apps, separate the two policies: app permission policies decide which apps (Microsoft, third party, custom) a user may use, while app setup policies install and pin apps. Org-wide app settings control tenant-wide availability and whether users may request apps. Custom apps must first be uploaded to the org catalog.
Worked example. You must stop one department using third-party apps while pinning Planner for everyone. Block third-party apps in an app permission policy assigned to that group, and pin Planner in an app setup policy. Assigning only the setup policy would pin Planner but block nothing.