2. 9/13/ :42 PM
An overview of Microsoft Teams architecture, including security and compliance features
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Principles Designed for the cloud Agility at scale
9/13/ :42 PM
Principles
Designed for the cloud
Agility at scale
Amplify the value of O365
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Architecture

5. Teams brings together O365 and Skype
9/13/ :42 PM
Teams brings together O365 and Skype
Teams Clients
Office 365 platform and services
Teams Services
Skype Infrastructure
Azure
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Teams Client Architecture
9/13/ :42 PM
Teams Client Architecture
Optimized for agility
Auto-updates
Desktop
Mobile
Web
Windows
Mac WP
iPhone/iPad
Android
Electron
UWP
IOS
Android
C++
Objective C
HTML5/CSS
Angular
jQuery, lodash etc.. (200+ Open Source Components)
TypeScript, Node, SASS C#
Swift
Java
Browsers: Edge, IE11, latest Chrome, latest Firefox | Desktop: Windows 10, 8.1, 7(SP1), Mac OS X
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Teams Conversations Logical Architecture
9/13/ :42 PM
Teams Conversations Logical Architecture
Modern Group
Chat
Team
SharePoint Team Site
Folder
Channel
One
Drive
Tabs
Images
Message
Reply Chain
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. 9/13/ :42 PM
Teams services
Teams Services
Often referred to as the “Middle Tier” although it is actually a collection of Micro-services
More efficient / Less complex
Scale flexibility
Lower risk / deployment agility
Optimize for evolutionary change
Front end servers
Identity
Team mgmt
Auth
Admin
AAD sync
Extensibility
Tabs
Compliance
Audit
Graph
Retention
Bots
Notifications
Config
Setting store
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. 9/13/ :42 PM
Teams and Skype
Skype Infrastructure
Leverage the next generation compliant skype services for messaging and VOIP calling
PSTN calling and conferencing leverages the Skype for Business Online stack
Presence to leverage the new unified presence services
Messaging
Calling /Meeting
Chat
Calling service
Call recording
Media
Transport relays
Voic
Search
Media processor
Trouter
URL preview
Media controller
Meeting scheduler
Notification Hub
Registrar
Personal expression
People
Config
Identity
Presence
Experimentation
Skype Identity
Permission service
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Information Protection
9/13/ :42 PM
Teams and Office 365
Office 365
Teams strives to realize the full benefits of O365 both as a platform and for end user capabilities
A part of our vision is to be an App hub for Office 365 and bring together the best capabilities
Teams does not aim to re- invent the wheel, instead leverages the features of other O365 workloads
Platform
Applications
Exchange
OneNote
Modern Groups
PowerApps
SharePoint
Planner
Stream
PowerPoint, Word, Excel
OneDrive for Business
Information Protection
Data and analytics
Microsoft Power BI
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. 9/13/ :42 PM
Teams on Azure
Azure
Azure is the core platform that Teams is built on (cloud-first)
Massive scale support
Global foot print
Redundancy and Disaster recovery
Compliance
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. High Level Architecture
9/13/ :42 PM
Key
High Level Architecture
Microsoft Teams
Skype services
Azure and O365
Teams
Web
Desktop
iOS
App
Android
App
Windows Phone
App
Electron
calling
SERVICES
Companions
Web
Settings and
O365 access
Telemetry
Messaging
Audio / video
Notes
Files
Files
Other Workloads
OneNote
WAC
OneDrive for business
SharePoint
Experimentation
Teams services
Chat & Presence services
Next Gen Calling
AAD
Most recent
files
MRU
Identity
Calendar
Exchange
PSTN
Search
Extensibility
Connectors
Notification Hub
Firehose Listener
Service
SMTP
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Regions for Teams Chat/Media
181 countries | 25 languages
Chat data stored ‘In Region’ based on tenant affinity
If tenant in Australia, Canada, India, Japan, the United Kingdom, or the United States Files are stored ‘In Country’ (SPO)
Teams honors EU model clauses
Teams has now added UK as an datacenter location: Cardiff + London
AMERICAS
EMEA
APAC
Dublin UK
Amsterdam
Bay
Des Moines
Hong Kong
Singapore
Teams Data in UK
Microsoft Confidential 2

14. AAD sync Currently supported Under development
Operations performed on Groups are synched to Microsoft Teams
Currently supported
Group property updates
Group manager changes
Group member changes
Group hard delete
User property updates
User hard delete
Microsoft
Teams
AAD
Sync normally completes in 15 minutes.
SLA is 24 hours
Under development
Group soft-delete and restore
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. Where Are My Conversations Stored?
9/13/ :42 PM
Where Are My Conversations Stored?
Chat service
In memory processing for speed
Leverages Azure storage (blob, tables, queues)
Substrate / Exchange
Chat and channel messages are also stored in Exchange for information protection
Conversation images & media
Inline Images/Stickers are stored in a media store, Giphys are not stored.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Where Are My Files Stored?
9/13/ :42 PM
Where Are My Files Stored?
1:N chats
Files are uploaded to OneDrive for Business and permissions are set for the members of the chat
Team conversations
Files are uploaded to SharePoint. A folder is associated with each channel in the team
Cloud storage
Dropbox, Box, Citrix ShareFile, Google Drive
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Enabling Microsoft Teams
9/13/ :42 PM
Enabling Microsoft Teams
For the full Microsoft Teams experience, every user should be enabled for Exchange Online, SharePoint Online, OneDrive for Business and Office 365 Group creation.
User's mailbox
is hosted in:
Team and Channel mgmt
Create and view meetings
Modify user profile picture
Add and configure connectors
Add and configure tabs & bots
Info Protection (eDiscovery)
Exchange Online
Yes
Exchange Online Dedicated vNext
Exchange Online Dedicated – Legacy
(Sync to Azure AD required) No
Exchange on-premises
Exchange 2016 CU3 or later
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Microsoft Teams Guest Access Architecture
One identity
Azure Active Directory (AAD) is the master for Teams identity and membership across Office 365 (Teams, SharePoint, Apps, etc.)
Federated resources
O365 services extend with their data (e.g., conversations stored in Teams chat service & documents stored in SPO & OneDrive)
Loose coupling
Services notify each other of changes to a team (e.g., creation, deletion, updates)
Using sync from AAD to Teams, Exchange Online AD and SharePoint Online AD they achieve reliability if they miss notifications
Guest Users addition directly via AAD
AAD
O365 Groups
AAD
O365 Groups
Identity
Resource URLs
Owners
Members
Guest Users addition by
team owners in Teams

19. Security & Compliance

20. Security and Privacy Privacy Security 9/13/2018 12:42 PM
Security by design
Data Encryption at rest and in transit
Dedicated security professionals
Threat models, Security Reviews, Automated Security Tools
Penetration testing with regular rotation of 3rd party penetration testers
All keys stored in Azure Key Vault
Admin: Screening, training, access control
Host: Access control, anti-malware, patch management, AAD Modern Authentication
Network: Firewalls, edge routers
Facility: Physical controls, video surveillance, access control
Bug Bounty Program (We pay friends, hackers and researchers to find security bugs)
Privacy by design
Data stored in-region based on tenant affinity
No customer content accessible in logs or telemetry
Grant least privilege required to complete task
Dedicated Privacy professionals
Adhere to Office 365 data classification and data handling standards
Access to Production environments is locked down
Working to support General Data Protection Regulation (GDPR) ahead of May 2018 deadline
© Microsoft Corporation. All rights reserved.

21. Compliance Tiers Controls
9/13/ :42 PM
is where you can download the audit reports.
for Microsoft Compliance Standards Download
Compliance Tiers
Controls
Today
CY2018 H1
More than 950 Office 365 controls
Access control
Auditing and logging
Identification and authorization
Awareness and training
Continuity planning
Incident response
Risk assessment
Communication protection
Information integrity
Deployment Approvals and management
Ongoing compliance processes
Recurring audits like SOC, FEDRAMP, ISO+ independent verification
© Microsoft Corporation. All rights reserved.

22. How Team Enables Information Protection
9/13/ :42 PM
How Team Enables Information Protection
1:1 chats
Group chats
Channel messages
O365 Information Protection tools
eDiscovery
Legal Hold
Compliance content search
Archive
Retention
Audit Logs
Microsoft
Teams
Chat
service
O365
substrate
SharePoint Files
OneNote
OneDrive for Business
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Information Protection Roadmap
Capability
Archiving Teams Data
Compliance Content search
eDiscovery – Messaging/Files
Legal hold
Auditing and reporting
Exchange Online Protection
Conditional Access and Intune MAM
Moderator support
Allowed List of Apps
Windows Information Protection
Tenant-specific retention policy
eDiscovery – Calling/Meetings
Data loss prevention (DLP)
Advanced Threat Protection
Available Today

24. Administration via PowerShell

25. Install the module

26. List of cmdlets available

27. Listing of Teams (that you are a member of)
9/13/ :42 PM
Listing of Teams (that you are a member of)
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. Create Teams

29. 9/13/ :42 PM
Get started
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. Administration via web (future)

31. 9/13/ :42 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

35. Security & Compliance with Teams
9/13/ :42 PM
Security & Compliance with Teams
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. 9/13/ :42 PM
Appendix
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

37. GA
Archiving
Archiving in Office 365 enables preservation of all content immutably and enables retention, eDiscovery and other compliance capabilities.
What is archived?
Teams Information Protection dataset includes the following elements -
1:1 chats
Group chats
Channel messages
SharePoint Files
OneNote content
Wiki content
OneDrive for Business
What is the default archiving policy?
Messages are automatically moved to the archive mailbox after two years*
Where is Microsoft Teams data archived?
Microsoft Teams chats and channel messages are archived using Exchange online storage
1: 1 chats and group chats are journaled to individual mailboxes
Channel messages are journaled to group mailboxes
How do I manage archiving?
Archiving for Microsoft Teams leverages existing O365 archiving management tools that are used for and SharePoint files.
O365 Compliance Admins will have a fast learning curve with Teams Archival Process since it leverages the Security and Compliance Center in Office 365 admin portal.
Immutable data
Integrated management
Safeguard your data
Highly reliable, available and performant.
Unlimited Storage*
Gartner has named Microsoft a Leader in the 2016 Magic Quadrant for Enterprise Information Archiving

38. Compliance Content SearchGA
Compliance Content Search
Content Search can be used to search mailboxes, SharePoint Online sites, OneDrive for Business Locations and Teams Data across all of the organization. There are no limits on the number of mailboxes or the number of searches that can be run at the same time.
Search Across item types
Search Organization wide
Highly Scalable
Export for offline use
Uncover Search Statistics
What accounts/locations can I includes in a search?
All Teams user accounts and locations (SharePoint, Exchange, OneDrive for biz) within a tenant can be included in a content search.
What search filters can be applied to a search?
Case Keywords, Team/Channels, To/From lists, Date Time, Size, Message Type and File types are some of the many criteria supported in Content Search.
Can I download/export results from a search?
All Compliance Content Search results can be exported into a Outlook Data File or .PST File. Individual Files and attachments can also be downloaded and exported in a report.

39. GA
eDiscovery
Electronic discovery is the electronic aspect of identifying, collecting and producing electronically stored information (ESI) in response to a request for production in a law suit or investigation. 
$1.2M1 Median litigation budget, excluding settlement costs
$33B1 Legal costs for the biggest U.S. banks in 2014
40% of Large corporations have one or more lawsuits with $20M+ at issue
Does eDiscovery in Office 365 work with Teams Data?
The Teams Information Protection Dataset is covered along with all the other communication and productivity workloads in the O365 Security and Compliance Center.
What are the different stages of a typical eDiscovery process at a large company?
The Electronic Discovery Reference Model (EDRM) provides guidance for the stages involved in the eDiscovery process i.e. Information management, Identification, Preservation, Collection, Processing, Review, Analysis, Production and Presentation.
Unified eDiscovery Center
In-Place hold
Quickly identify the most relevant data
View/Export data in standard EDRM format
Case management
Access Control
Content Searches
Hold(s)
Export
Advanced eDiscovery
All of in-Place +
Duplicate detection
Relevance Searches with Machine Learning
Unstructured Data analysis
In-place eDiscovery
Reduce eDiscovery costs

40. GA
Legal Hold
When a reasonable expectation of litigation exists, organizations are required to preserve electronically stored information (ESI) relevant to the case. This expectation often exists before the specifics of the case are known and organizations may need to preserve broadly all information related to certain individuals, keywords or topics.
Can user continue to user Teams when they are put on hold?
Yes, users can continue to use Teams seamlessly when their data is put on hold.
What is the difference between Litigation Hold and In-Place Hold?
Litigation Hold is normally used when an entire mailbox has to be put on hold. In-place hold is used when holds are to be created and placed based on fine tuned search criteria across mailboxes.
What happens to edits and deletes when a user is on hold?
All Teams Chats, Channel Messages (both current and archived) are subjected to hold
All Edits to Messages are allowed but will be tracked separately than the original message.
All Deleted Teams data will still be persisted.
What Teams Data can be put on Hold?
All of the Teams Information Protection dataset can be put on litigation hold. This includes 1:1 chats, Group chats, Channel messages, Files, OneNote and Wiki.
Permanently Preserved Data within O365 solution
Flexibility: Multiple Time Based Holds
Integrated management with eDiscovery
Narrow Down on Legal Data – Intelligent Query based holds
Transparent to End User

41. Auditing and Reporting
Auditing and reporting supports the need for IT Admins to track important business events within Office 365 and now Teams.
What types of events are being captured for auditing in Teams?
What is the SLA for when the audit log is updated?
Audit Log(s) will be updated and available for searching and reporting in up to 24 hours from when the activity was done in Teams Client.
Account Logon events
User/Admin Login and Logout from teams Client(s)
Service Logins and Sessions
Object/File Access Events
File Creation/Access/Upload/Deletion
File rename/modification/movement/restoration
File Copy/Checking in and out
Process Tracking events
Setting Store Changes – Client and Admin Portals
Additions of Connectors or Bots
Editing of Posted Chat messages
Account Management events
User Roles/Permissions setting/editing
Teams Enablement or License assignment events
Group/Team/Channel Creation and Deletion and member updates
Audited Events
Audit all Teams Events
Audit all/specific users
View, Filter, Export results
Unlimited Auditing Timeline

42. Conditional Access and MAM for Teams
IT admins can make the use of Microsoft Teams more secure by enforcing restrictions on both managed and non managed devices using Intune MAM and CA policies.
What platforms/devices are supported for Teams Conditional Access/MAM?
What are the general factors in setting up Conditional Access policies?
Will Exchange and SharePoint Conditional Access Policies apply to Teams? GA
Device / Platform
Mobile Client
iOS (7.1+)
Android (4.0+)
Desktop Client
Windows PC (8.1+)
Mac OS X
Web Client
IE, Edge
You can set a conditional access policy to protect access based on:
Targeted Sets or Groups of users
The device compliance definition and status
The platform that is running on the device
The type of apps that are used to access the services (example: Teams)
If the user/device is non compliant, a message is displayed that directs the user to the Intune Company Portal app or website where there are remediation steps.
Prevent data loss between Teams and other personal apps
Employees can use their favourite device to access Teams securely 
Protect data at the Teams App level without having to manage devices
Simplified enrolment process to increase user adoption
Yes, because Teams Services rely on Exchange Online and SharePoint online.

43. Retention
Retention Policies allow IT admins to manage the lifecycle of content within Office 365, including all data from Teams.
What does Retention mean in the context of Microsoft Teams?
Teams related Retention polices
Retention period
Retention action
Chats (1x1, 1xN)
Configurable by tenant (days) in Security and Compliance Center, example: 30 days
Delete & Allow recovery
Permanently delete
Archive
Channel messages
Configurable by tenant (days) in Security and Compliance Center, example: 365 days
Files (SharePoint Online and OneDrive for Business)
Configurable by Tenant for Site Templates, Site Collections and Document Deletion
Manage through Records Management
Flexible – different policies for different types of Items
Standard Preservation & Deletion Policy templates
Integrates with Legal Hold and e-Discovery
Integrated Management
How does Retention and Persistent Chat in Teams work together?
Retention Policies if set, will wipe out the Teams Data from all possible locations in the Microsoft cloud infrastructure. If persistent chat is a requirement without retention, then default retention policy can be overridden to extend it for N no. of years (or indefinitely)

44. Moderator Support
Moderation provides the ability for a Team or Tenant Admin to control the nature of messages being sent and persisted in any chat in Teams.
Admin Controls:
Allowing Team Owners to delete all messages
Allow Tenant Admin to disable private chat (1xN) all together.
Muting and Moderation (EDU targeted)
Ability for a Teacher to mute a student in a Team
What is the user experience for a student who has been muted?
Only a Team Owner (i.e. Teacher) can mute a member. Once muted, the member cannot post/reply to messages.
What about moderation features for Team Admins in general?
For moderation of posting on General Channel of a team, there are new team settings that allow admins to control the noisiness of the general channel:
Anyone can post in general
Anyone can post but will be alerted before they do so (large teams)
Only owners can post on general
Is there full support for these features on mobile?
Yes, all of the above features are going to be available on all Teams Clients.
Flexible – different controls at both tenant (global) and team(local) levels
Graceful User Experience for “moderated” participant
Prevents bullying and other bad behavior in classroom situations

45. Allowed List of Apps
Apps (Bots, Connectors and Tabs) represent flow of important information both in and out of the Tenant. While Teams strongly supports the concept of empowering the end user to find the right app for the right scenario, we also ensure that IT Admins have ways of controlling usage and distribution of apps within their organization.
What controls do I have as a Tenant admin at this time?
Control default state (on/off) for all 3rd Party store published
Apps Control side loading of Apps by end users in Teams
Control default state (on/off) for yet unpublished apps as a preventive step
What does side-loading of apps in Microsoft Teams mean?
End users can take apps that they have built using the Microsoft bot framework and add them to their Teams.
How do I populate Teams with a restricted set of Apps upfront?
This feature is on our roadmap. We want to allow admins to be able to side-load a set of pre-approved LOB Apps for their tenant.

46. Windows Information Protection
Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices without requiring changes to your environment or other apps.
How does WIP Apply to MSTeams?
MS Teams Windows Client is a WIP Aware app and classified as Enterprise or Corporate Owned. Data created from Teams is subject to encryption and protection offered through WIP Policies on Windows 10 Enterprise devices.
What are the different controls WIP offers?
Classify all data into Enterprise or Personal at a user level
Restricting Copy or Download of Enterprise data & using Allowed Apps only to access Enterprise Data
Encrypt all Enterprise data at rest & prevent accidental data disclosure to public spaces and removable media
Flexibility to allow user to hide or allow overrides of the policy and or audit data sharing actions
Remotely wipe all Enterprise data from MDM enrolled devices while leaving personal data behind in employee termination scenarios
Prevent enterprise data leaks, even on BYOD devices
Maintain ownership and control
Control the network/data access and sharing for all Apps

47. Resources to Learn More
9/13/ :42 PM
Resources to Learn More
Your hub for all things Microsoft Teams including vision, practical onboarding guidance, success stories, and support.
Assistance for customers to realize their vision with Microsoft cloud services
Resource
Link
Office Blog
Office Roadmap
Product Help
Known Issues List
Team Developer Hub
© Microsoft Corporation. All rights reserved.

48. Please evaluate this session Your feedback is important to us!
9/13/ :42 PM
Please evaluate this session Your feedback is important to us!
From your PC or Tablet visit MyIgnite at
From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

49. 9/13/ :42 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.