SharePoint Stuff

My organisation has started to use Microsoft Teams, albeit not globally but in small pockets there are groups of users with access to the product and are using it in anger interally.

Getting setup correctly and granting external, or guest access can be not such a simple request in my experience, so I thought it useful to document what I have observed, and some of the resolution steps applied to get Teams set up and working correctly for internal users, and how to make sure external access is enabled for guests.

In this guide:

1. How to enable Teams for internal users
   • Turn on/ off Teams at the tenant level
   • Turn Teams on/ off for individual users
2. How to enable guest access
   • Check Azure Active Directory
   • Check O365 Groups
   • Check Teams guest access
   • Check O365 settings
   • Check SharePoint sharing settings
3. Configuring the user initated Teams licenses
4. Troubleshooting Teams desktop application
   • Tip #1: the Office version matters
   • Tip #2: turn it off and on again
   • Tip #3: clear the cache
   • Tip #4 run credential manager

1. Enabling Teams for users internally

To enable Teams for individual users, they will need need to be assigned a Teams product license from the O365 admin center. Depending on your own policy for rolling out Teams, you can either do this at the tenant level or at the individual user level (for example, we turned off the Teams product at the tenant level, but assigned licenses at a user level).

Turn on Teams at the tenant level

• Navigate to the O365 admin center, click on Services & add-ins
• Search for Teams > under Settings by user/license type select the product license used in your tenant (for example E3)
• Make sure the ‘turn teams on or off for all users of this type’ is set to On

Turn on Teams for individual users

• Navigate to the O365 admin center, click on Users > Active Users
• Find the user you wish to turn Teams on for
• Under Product licenses > press edit
• Find the relevant product license (for example Office 365 E3) > press the drop down icon
• Find Microsoft Teams from the list of options, and make sure it is switched on

I believe that by default when an enterprise product license is switched on that by default all the apps and services will be set to on. However, if your organisation is within a managed service agreement, you could well be in a situation where some of these apps are switched off as part of the product license.

2. How to enable guest access

OK so before I begin detailing the steps I followed, there is a pretty great guest access checklist that Microsoft has provided that covers all the steps plus explanation in order to enable guest access in Teams. You can take a look at that below:

Microsoft Teams guest access checklist

Much of what I detail below were already turned on for me, so this just acts as a series of checks – much like the Microsoft guide, to run through to make sure guest access is set up correctly.

Check Azure Active Directory settings

• Log in to https://portal.azure.com
• Select Azure Active Directory > Users > User settings
• Under External users, select Manage external collaboration settings

These are the settings I used for external collaboration:

• Guest user permissions are limited: Yes
• Admins and users in the guest inviter role can invite: Yes
• Members can invite: Yes
• Guests can invite: Yes
• Enable email one-time passcode for guests: No
• Collaboration restrictions: allow invitations to be sent to any domain (most inclusive)

Check Office 365 Groups

• In the O365 admin center, go to Settings > Services & Add-ins > Office 365 Groups
• Make sure Let group members outside the organization access group content is set to On
• Make sure Let group owners add people outside the organization to groups is set to On
• Make sure Let group members outside the organization access group content is set to On

Check Teams guest access settings

• In the Teams admin center, select Org-Wide settings > Guest access
• Set the Allow guest access in Microsoft Teams switch to On
• Press Save

Check O365 sharing settings

• In the O365 admin center, go to Settings > Security & privacy
• Under Sharing > select Edit
• Make sure Let users add new guests to this organization is set to On
• Press Save

Check SharePoint sharing settings

Sign in to the Microsoft 365 admin center.

• In the O365 admin center, select SharePoint
• In the SharePoint admin center, select Sharing
• Under Sharing outside your organization, select Allow sharing with the external users that already exist in your organizations directory

NOTE: Basically, any of these options will work, outside of don’t allow sharing outside your organization.

3. Configuring user initiated Teams licenses

Something else you might experience as part of the rollout of Teams, is the prevalence of user initiated Microsoft Teams (Commercial Cloud) licenses. These are auto-assigned licenses that users recieve that do not currently have a Teams license.

If you wish to turn off this ability, you can by doing the following:

• In the O365 admin center, go to Settings > Services & add-ins > User owned Apps and Services

• Make sure that Let users install trial apps and services is set to Off

4. Troubleshooting tips for the Teams desktop application

Since rolling out Teams, along with the desktop app I have noted a few common issues and some simple resolution steps:

Tip #1: the Office version matters

Some users struggle to open files in Teams, and get issues that the file is locked or has to be saved locally and re-uploaded.

The build version of Office has an effect on the behaviour between the Office apps and Teams. For example, I noted that someone who had Office Version 1611 (Build 7571.2109) would be unable to open files in Teams, and were unable to open the file in edit mode. Where as myself running Office Version 1802 (Build 9029.2253) had no issues. When the user updated their Office version to 1802 or later, the issues were resolved.

Tip #2: turn it off and on again

Sometimes the simplest solution is the best one, and in these cases many times simply removing the Teams product license for the user > saving > then re-applying the license works wonders.

Along the same vein for this, having concurrent Teams licenses from your enterprise and commerical cloud user initiated licenses has also been promlematic for me, hence why we made the decision to turn off the commercial cloud licenses.

Tip #3: clear the cache

Tip #3 and tip #4 pretty much go hand in hand, but clearing the cache when trying to get Teams working is never a bad idea in my opinion.

• Close the Teams app, and make sure the process has stopped in Task Manager
• Go to Start > Run > and enter C:\Users\[YOUR_USERNAME]\AppData\Roaming\Microsoft\Teams

From here, delete all the files from the following folders:

• \Application Cache\Cache\
• \blob_storage\
• \Cache\
• \databases\
• \GPUCache\
• \Local Storage\
• \tmp\

Then clear these files out from C:\Users\[YOUR_USERNAME]\AppData\Local\:

• \Google\Chrome\User Data\Default\Cache
• \Google\Chrome\User Data\Default\Cookies
• \Google\Chrome\User Data\Default\Web Data
• Internet Explorer Temporary Internet Files
• Internet Explorer Cookies

NOTE: Mark Vale also includes a PowerShell script on his post about this that will be much quicker way to do it. You can check that out here.

Tip #4 run credential manager

This final tip helps if you see authentication errors when users try to login to the desktop app.

• Press Start, type Run
• Enter rundll32.exe keymgr.dll,KRShowKeyMgr
• In stored usernames and passwords, find the msteams_adalsso credentials and press remove on each one