Hard Difficulty Questions

Create a new standard channel named 'Dispatch' and add only the dispatchers as members.

Why it fails: Creating a separate channel with only the dispatchers restricts who can post, but it does not prevent the remaining members from starting conversations in the General channel, and it also moves the dispatchers out of the location where the announcements are expected. The requirement is to control posting behavior in General, not to relocate the dispatchers to a different channel.

Create a messaging policy that disables chat for the 3,990 members and assign it to the team.

Why it fails: Messaging policies are assigned to users, not teams, and they govern chat and channel messaging features such as edit, delete, and translation. Disabling chat would not selectively block starting new posts in General while still allowing replies, and applying it broadly would degrade the members' other collaboration capabilities well beyond the stated requirement.

Assign the dispatchers the Teams Communications Administrator role and configure a meeting policy for the team.

Why it fails: The Teams Communications Administrator role manages calling and meeting features such as phone numbers and voice routing, not channel posting rights. A meeting policy also has no bearing on whether members can start channel conversations, so this combination would not restrict posting in General nor enable announcements from the dispatchers.

Set AllowCloudRecording to false.

Why it fails: Cloud recording manages video and audio storage capabilities rather than textual meeting transcripts. Disabling recording would restrict video archiving without granting users the ability to generate live meeting transcripts, which are governed by a completely separate policy attribute.

Set AutoRecording to true.

Why it fails: Enabling auto-recording forces meetings to begin recording automatically upon startup, but it does not grant permissions for manual or automatic transcription generation. If transcription is disabled globally, the automatic recording stream will capture audio and video without producing accompanying text logs.

Change LiveCaptionsEnabledType to Enabled.

Why it fails: Live captions provide real-time subtitles during an active meeting for individual participants but do not save a persistent text transcript file to the cloud. Transcription is a distinct compliance and productivity feature requiring its own explicit policy enablement parameter.

Update the default Org-wide Teams policy for guests.

Why it fails: Teams policies are generally applied to user accounts. Guest accounts are governed by global guest access settings, not standard user-based Teams policies. Modifying the Teams policy for a guest user will not override the global guest settings, which act as the primary restriction for external identity permissions.

Create a conditional access policy in Microsoft Entra ID.

Why it fails: Conditional access policies manage authentication requirements, such as MFA or device compliance. They do not manage granular team-level permissions like channel creation. Using conditional access for this task would be ineffective because it does not understand the internal object model of a Microsoft Team.

Change the sensitivity label assigned to the team.

Why it fails: Sensitivity labels control data protection and external sharing, but they do not provide a toggle to restrict channel creation by guest users specifically. While useful for broader governance, they are not the appropriate tool for managing the specific functional permissions of guest identities in Teams.

The user must be a member of the 'Teams Group Creators' security group.

Why it fails: If the organization has restricted group creation to a specific group, the user must be a member of that group. This is a common security practice that prevents uncontrolled team sprawl by limiting which users have the authority to initiate the creation of new teams within the tenant.

The user must be a Global Administrator.

Why it fails: Team creation is a standard user capability and does not require elevated administrative privileges like the Global Administrator role. Assigning Global Administrator rights to standard users to allow them to create teams is a significant security violation that contradicts the principle of least privilege required for good administration.

The user must have a SharePoint site owner role.

Why it fails: While teams utilize SharePoint for file storage, the user does not need to be a site owner to create a team. The creation process is handled at the group level, and the system automatically provisions the necessary SharePoint infrastructure without requiring manual site owner permission assignments for the creator.

Location-based routing

Why it fails: Location-based routing restricts PSTN usage based on network topology to prevent toll bypass in regulated countries. It addresses regulatory compliance and cost management rather than optimizing audio media path latency across global regions.

Dynamic emergency calling

Why it fails: Dynamic emergency calling tracks user locations to provide accurate dispatch addresses to public safety answering points during emergency calls. It has no impact on general media routing performance or audio latency for standard business telephone calls.

A localized tenant dial plan

Why it fails: Dial plans handle number normalization and digit translation prior to call setup. They determine how dialed numbers are formatted but do not dictate the network path that audio packets traverse once the call session is established.

Turn off 'External access' for the partner domain.

Why it fails: Disabling external access completely prevents any communication between your users and the partner domain. This action is too restrictive for the scenario because it breaks the collaboration requirement, whereas the goal is only to limit the ability of those external users to search through the corporate global address list.

Disable 'Guest access' at the tenant level.

Why it fails: Turning off guest access at the tenant level removes the ability to add any external users to teams or channels. This effectively stops all collaborative efforts involving external parties, which contradicts the primary objective of allowing the partner organization to work within your Teams environment for specific project tasks.

Set 'Allow public IP addresses' to false in Meeting settings.

Why it fails: This setting is related to network configurations for media traffic and does not impact directory search or user visibility. Restricting IP addresses would affect how clients connect to meeting services but would have no effect on whether a guest user can find an internal employee through the search bar.

Teams Messaging policy settings

Why it fails: Messaging policies are managed within the Teams Admin Center and control the features of the chat interface. They are not a component of Microsoft Entra Conditional Access policies, which focus on the security and authentication layer of access rather than the functional features of the application.

A Skype for Business Voice route

Why it fails: Voice routes are used to manage how PSTN calls are directed through gateways and are a part of the phone system infrastructure. They have no relevance to the identity-based security policies and access controls managed by Microsoft Entra ID's Conditional Access feature for cloud applications.

The app is blocked by the tenant-level configuration.

Why it fails: The exhibit clearly indicates 'Blocked: false', meaning the app is not globally restricted by the tenant administrator. The problem must reside in a more granular permission layer, such as a user-specific app policy or a team-level setting that prevents the user from modifying app installations.

The app requires a paid subscription.

Why it fails: While apps may require paid subscriptions for full functionality, this is handled by the ISV and the internal billing process, not by Teams administration settings. Teams administrators control access, not the licensing status of the app itself, which usually becomes apparent after the app is installed.

The app is not approved for use in the Microsoft 365 Admin Center.

Why it fails: The exhibit shows the application distribution method as 'Organization' and the permission type as 'TenantAdmin', which implies the app has already been approved and made available for the organization. The issue lies within user-level permissions or team-specific configuration rather than the global approval status.

Run Set-CsTeamsClientConfiguration -AllowSugarSync $true.

Why it fails: This command directly modifies the client configuration object to enable the SugarSync integration. By setting the property to true, you override the previous restriction, allowing the client to communicate with the service and providing the user access to the previously blocked cloud storage functionality within their team.

Update the Teams App Permission Policy.

Why it fails: App permission policies control which apps can be installed by users from the Teams App Store. Since the issue is related to a specific client configuration parameter shown in the exhibit, changing the app permission policy will not alter the underlying client-side setting required for SugarSync support.

Restart the Teams client on the user's device.

Why it fails: Restarting the Teams client clears the local cache, but it cannot override administrative server-side configurations. Since the configuration is explicitly set to false in the tenant settings, a simple restart will not force the application to enable a feature that is currently disabled at the policy level.

Check if the user has a Communications Credits balance.

Why it fails: Communications Credits are typically used for Microsoft Calling Plans or toll-free numbers provided by Microsoft. In a Direct Routing scenario, the PSTN connectivity is provided by your own carrier via the SBC, so the call costs and credits are managed externally and do not affect the internal Teams routing logic.

Ensure the user has an Audio Conferencing license assigned.

Why it fails: An Audio Conferencing license allows users to host meetings with dial-in numbers for participants. It is not a requirement for making individual outbound PSTN calls via Direct Routing. Direct Routing requires a Teams Phone license and a properly configured Voice Routing Policy, but not necessarily conferencing capabilities.

Verify the Emergency Calling policy is set to 'Direct Routing'.

Why it fails: Emergency Calling policies define how 911 calls are handled and how location information is transmitted. While critical for safety and compliance, an incorrectly configured emergency policy will not prevent standard, non-emergency outbound calls from being successfully routed through the SBC and out to the public switched telephone network.

The user has 'Turn on new meeting experience' disabled in their client settings.

Why it fails: While the 'new meeting experience' was once a separate setting, it has long been the standard and only experience in modern Teams clients. Disabling it is no longer an option in current versions, so it cannot be the reason for missing features like Large Gallery in a modern deployment.

The 'Allow IP Video' setting is set to 'false' in the meeting policy.

Why it fails: If 'Allow IP Video' were set to false, the user wouldn't be able to see any video at all, not just the Large Gallery view. Since the issue is specifically about the view mode and not the total absence of video, the problem likely lies with the client-side rendering capabilities.

The meeting was scheduled as a 'Channel Meeting' instead of a private meeting.

Why it fails: The type of meeting—whether channel-based or private—does not restrict the available video view modes. Large Gallery is available in any meeting type as long as the minimum number of participants (usually 10 or more) have their cameras turned on and the client supports the rendering.

The meeting must have ended at least 24 hours ago.

Why it fails: Call Analytics data typically appears within 15 minutes of a call ending. Waiting 24 hours is unnecessary and would hinder timely troubleshooting efforts. The system is designed to provide near-real-time visibility, allowing administrators to address performance issues immediately as they occur.

The user must be assigned a Microsoft 365 E5 license.

Why it fails: While E5 licenses include advanced reporting capabilities, basic Call Analytics functionality is available across most business licenses. License assignment is not a prerequisite for the generation or viewing of standard call quality metrics within the Microsoft Teams Admin Center for individual calls.

Messaging policy

Why it fails: Messaging policies control features within chat, such as the ability to delete messages, use Giphys, or translate messages. They do not determine whether a user can initiate a chat with an external Teams user. Therefore, this policy would not explain why finance users cannot start external chats while internal chats work.

Teams app permission policy

Why it fails: Teams app permission policies control which apps are available to users within Teams, such as whether they can add tabs or bots. They have no bearing on the ability to chat with external users. The scenario describes a communication restriction, not an app availability issue, so this policy is not the right place to look.

Meeting policy

Why it fails: Meeting policies govern meeting features such as recording, transcription, and who can bypass the lobby. They do not control the ability to start one-on-one or group chats with external users. Since the problem is about chats, not meetings, this policy is irrelevant. Troubleshooting here would waste time and not resolve the external chat issue.

Call Quality Dashboard (CQD)

Why it fails: CQD provides aggregate call quality data across the organization and allows filtering by dimensions like user, location, and network type. However, it does not provide session-level details such as individual media streams, codecs, and network traversal for a single meeting. It is better suited for identifying trends and broad issues rather than deep-diving into one session.

Teams admin center > Users > Manage users > Call history

Why it fails: Call history in the Teams admin center shows a list of calls and meetings for a user, including date, time, and participants, but it does not include technical details about media streams, codecs, or network traversal. It is useful for auditing who called whom, but not for troubleshooting media quality at the stream level.

Microsoft 365 network connectivity test tool

Why it fails: The network connectivity test tool checks network readiness and connectivity to Microsoft 365 endpoints from a specific location. It does not provide per-session media stream details or codec information for a specific meeting. It is used for pre-deployment validation or diagnosing general network issues, not for analyzing a particular meeting's media characteristics.

Call Quality Dashboard (CQD)

Why it fails: CQD is designed for aggregate, organization-wide call quality analysis and trending, not for drilling into a specific meeting's details. While it can show overall quality, it does not provide the granular per-meeting diagnostics that Call Analytics offers. For a single meeting, Call Analytics is more direct.

Microsoft 365 Service Health Dashboard

Why it fails: The Service Health Dashboard provides information about service-wide incidents and advisories, not per-meeting call quality data. If the poor audio were due to a service incident, it might show there, but for a specific meeting's quality analysis, it is not the right tool. It lacks the granular metrics needed.

Teams user activity report

Why it fails: The Teams user activity report shows user-level activity such as messages, calls, and meetings, but it does not include call quality metrics like audio packet loss or jitter. It cannot help diagnose poor audio quality in a specific meeting. It is focused on usage, not quality.

A new meeting policy named user1@contoso.com is created

Why it fails: The 'Grant' verb in PowerShell is used for assigning an existing object to a target, not for creating a new object. To create a new policy, the 'New-CsTeamsMeetingPolicy' cmdlet would be required, which defines the parameters of the policy rather than assigning it to a specific user identity.

The RestrictMeetingPolicy is applied to all users in the tenant

Why it fails: This command specifies a single user identity using the '-Identity' parameter, meaning it only affects that specific account. To apply a policy to all users, an administrator would typically modify the Global policy or use a batch assignment method rather than targeting an individual's email address.

The user is prevented from joining any meetings

Why it fails: While the policy name suggests it might be 'restrictive', the command itself only performs the assignment. The actual impact on the user's ability to join meetings depends entirely on the specific settings configured within the 'RestrictMeetingPolicy' object, which are not visible or defined in this single assignment command.

Modify the Messaging policy

Why it fails: Messaging policies are focused on the content of conversations and chat interactions. They do not have any control over the Teams application navigation or the pinning of apps on the user interface. Therefore, this policy type is incapable of enforcing a specific layout of pinned applications.

Modify the App Permission policy

Why it fails: App permission policies allow you to choose which apps are available to the user, but they do not control the pinning or the sidebar layout. While these policies are essential for security, they do not dictate the user experience of pinned apps on the navigation bar.

Modify the Teams global org-wide settings

Why it fails: Global org-wide settings manage general platform behavior and defaults. While they impact all users, they do not provide the granularity to enforce a specific set of pinned apps for different user groups, which is a requirement that is best handled by creating and assigning individual App Setup policies.

Enable 'Sideloading' for all users in the Global App Setup policy.

Why it fails: Enabling sideloading for everyone would allow any user to upload their own app packages, which is a major security risk and does not facilitate the controlled distribution of a specific app. Sideloading is typically reserved for developers and should be restricted to prevent the installation of unvetted or malicious software within the tenant.

Publish the app to the public Microsoft Teams App Store.

Why it fails: Publishing to the public store would make the app available to every Microsoft Teams user globally, which is the opposite of the requirement to restrict it to only your internal Executives. Custom internal applications should always be managed through the organizational app catalog to maintain privacy and security of the company's proprietary code.

Add the app to the 'Pinned apps' list in the Global App Setup policy.

Why it fails: Adding an app to the Global App Setup policy would attempt to pin the app for every user in the entire organization. This violates the requirement to restrict the app to only the Executive team. App setup policies should be targeted using custom assignments rather than using the global policy for sensitive or department-specific applications.

Teams Meeting Policy in the Teams Admin Center.

Why it fails: The Teams Meeting Policy can enable or disable the ability to start a recording, but it does not provide granular control over the file permissions once the recording is saved. File-level actions like deletion are managed by the storage service (OneDrive/SharePoint) where the file actually resides after the meeting.

Teams Messaging Policy in the Teams Admin Center.

Why it fails: Messaging policies are intended to control chat features such as the ability to edit or delete sent messages, use emojis, or participate in group chats. They have no impact on the file management permissions of meeting recordings stored in SharePoint or OneDrive for Business libraries.

The 'Recording' tab in the Teams client settings.

Why it fails: User-level settings in the Teams client allow individuals to toggle personal preferences like captions or notifications. These settings do not offer administrative control over file permissions or organization-wide compliance requirements, which must be enforced through the central administration portals by a tenant or compliance administrator.

SharePoint Online migration

Why it fails: While Teams uses SharePoint for file storage, Teams Advisor is not a migration tool for moving data into SharePoint Online. Its purpose is to guide the configuration and adoption of Teams-specific features rather than managing the large-scale data transfer and document library mapping tasks associated with SharePoint migrations.

Exchange Online mailbox migration

Why it fails: Teams Advisor does not provide guidance or tools for migrating user mailboxes to Exchange Online. Mailbox migration is a separate administrative process handled through the Exchange admin center or specialized migration tools, and while it's a prerequisite for some Teams features, it falls outside the scope of Teams Advisor.