Select Two (Multi-Select) Questions

A Teams Messaging policy

Why it fails: Messaging policies are used to control the features available within chats and channels, such as the use of emojis or the ability to delete messages. They have no role in the creation process of a team or the enforcement of naming standards for Microsoft 365 Groups or Teams.

A Skype for Business Server hybrid connection

Why it fails: Hybrid connections are used for managing users across both on-premises Skype for Business and Microsoft Teams environments during a migration. This infrastructure component is unrelated to the governance and naming policies applied to modern Microsoft 365 Groups within the cloud-based Microsoft Entra ID service.

Teams Messaging policy settings

Why it fails: Messaging policies are managed within the Teams Admin Center and control the features of the chat interface. They are not a component of Microsoft Entra Conditional Access policies, which focus on the security and authentication layer of access rather than the functional features of the application.

A Skype for Business Voice route

Why it fails: Voice routes are used to manage how PSTN calls are directed through gateways and are a part of the phone system infrastructure. They have no relevance to the identity-based security policies and access controls managed by Microsoft Entra ID's Conditional Access feature for cloud applications.

CPU utilization over 90%

Why it fails: While high CPU can cause stuttering, it is an endpoint performance issue rather than a network connection issue. It does not manifest as network packet loss or high RTT, which are the metrics specifically used to diagnose local network instability in Call Analytics.

Low participant count

Why it fails: The number of participants is a contextual detail rather than a quality metric. A call can be high quality with many participants or low quality with only two, meaning participant count provides no diagnostic value for investigating network connectivity or packet loss issues.

Unsupported client version

Why it fails: Using an unsupported client can cause compatibility issues, but it is not a network quality metric. Reporting an unsupported version does not explain high packet loss or latency; those issues are infrastructure-driven and occur regardless of the specific client version being utilized.

Teams Client Diagnostic Logs

Why it fails: Diagnostic logs are specific to an individual user's client behavior and local environment. They are used for deep-dive technical troubleshooting of specific software errors or crashes, but they do not provide information about the global status of the Microsoft Teams cloud service health.

Teams Advisor

Why it fails: Teams Advisor is a tool used during the initial rollout to help plan the deployment of Teams workloads like Chat, Groups, and Meetings. It creates a project plan and tracks progress, but it is not a monitoring tool for ongoing service health or incidents.

Teams App Store

Why it fails: The Teams App Store is where users and admins manage third-party and custom applications. It has no functionality related to monitoring the operational health of the Teams core service or notifying administrators about service degradations or regional outages currently affecting the tenant.

SharePoint Online migration

Why it fails: While Teams uses SharePoint for file storage, Teams Advisor is not a migration tool for moving data into SharePoint Online. Its purpose is to guide the configuration and adoption of Teams-specific features rather than managing the large-scale data transfer and document library mapping tasks associated with SharePoint migrations.

Exchange Online mailbox migration

Why it fails: Teams Advisor does not provide guidance or tools for migrating user mailboxes to Exchange Online. Mailbox migration is a separate administrative process handled through the Exchange admin center or specialized migration tools, and while it's a prerequisite for some Teams features, it falls outside the scope of Teams Advisor.

A Caller ID policy to mask the user's phone number.

Why it fails: Caller ID policies are used to control the outbound calling identity of users, such as showing a service number instead of a personal extension. While useful for privacy, they do not impact the logic of an Auto Attendant's call routing or its ability to handle after-hours voicemail transitions.

A Call Park policy for the shared voicemail box.

Why it fails: Call Park allows users to place a call on hold and retrieve it from another device using a code. This feature is unrelated to the automated routing logic of an Auto Attendant or the storage and delivery of voicemail messages for calls that occur outside of defined business hours.

A Mobility policy for the shared voicemail user.

Why it fails: Mobility policies control how calls are handled on mobile devices, such as using the Teams app versus the cellular network. These settings do not influence the server-side routing of an Auto Attendant or the selection of voicemail targets based on the time of day or business schedules.

A Global Administrator role assigned to the room's account.

Why it fails: Assigning a Global Administrator role to a room resource account is a significant security risk and is completely unnecessary for its operation. The account only needs the permissions associated with a standard resource mailbox and the appropriate Teams Room license to perform its intended functions in the meeting space.

A public IP address assigned directly to the MTR console.

Why it fails: MTR systems should reside on an internal network behind a firewall, just like any other client device. They communicate with Microsoft 365 services over standard outbound ports (like 443). Assigning a public IP address directly to the console would expose the device to unnecessary security threats from the internet.

An Microsoft Entra ID P2 license for every room.

Why it fails: While Microsoft Entra ID Premium features can enhance security through Conditional Access, they are not a mandatory requirement for the basic functionality of a Teams Room. The core capabilities of joining meetings and receiving calls are provided by the Teams Room license and the correctly configured resource account identity.

Average jitter

Why it fails: Average jitter is a technical network performance metric. While critical for troubleshooting audio quality, it is found in the Call Quality Dashboard or Call Analytics, not in the Teams Usage report, which focuses on user behavior and adoption volume rather than technical stream telemetry.

Round-trip time (RTT)

Why it fails: Round-trip time measures the latency between a client and the Microsoft network. This is a technical performance metric used for troubleshooting connectivity and call quality. It is never included in usage reports, as usage reports are strictly for tracking feature adoption and user engagement levels.

Enable 'Guests can access Microsoft Teams' in Guest access settings.

Why it fails: Guest access is a separate feature from External Access (federation). Guest access allows users to be added to teams as members, while external access allows for chat and calls with users in their own tenants. Enabling guest access does not configure the domain-level chat restrictions required here.

Set the 'External access' option to 'Block all external domains'.

Why it fails: Blocking all external domains would prevent communication with even the trusted partners at Contoso and Fabrikam. This setting overrides any allowed list and completely isolates the tenant from external chat and calls, making it impossible to meet the requirement of allowing communication with the two specific partners.

Create a new Teams App Permission policy for the domains.

Why it fails: App permission policies control which applications are available to users within the Teams client. They have no relationship with network-level federation or the ability to communicate with users in external Microsoft 365 tenants, and therefore cannot be used to manage domain-level allow-lists for chat and calling.

Create a dial plan and assign it to the user.

Why it fails: While dial plans are important for number normalization, they are not strictly required to enable outbound PSTN calling if numbers are already in E.164 format or if the SBC can handle the dialed digits. The question states that the voice route, PSTN usage, and voice policy are already created. Dial plans help with dialing habits, but they are not a mandatory step for basic outbound calling. The essential steps are enabling Enterprise Voice and assigning the voice policy.

Assign a Calling Plan license to the user.

Why it fails: Calling Plan licenses are for Microsoft-provided PSTN connectivity, not Direct Routing. In a Direct Routing deployment, the user does not need a Calling Plan license; they need a Teams Phone license and possibly a Phone System license. Assigning a Calling Plan license would be incorrect and unnecessary. The organization uses Direct Routing, so PSTN connectivity is via the SBC, not Microsoft Calling Plans.

Configure the SBC to allow all outbound calls.

Why it fails: SBC configuration is necessary for calls to flow, but the question implies the SBC is already created and presumably configured. The specific actions to enable the user are not about SBC settings but about user-level configuration. While SBC rules matter, they are part of the voice route setup, which is already done. The user-level steps are enabling Enterprise Voice and assigning the voice policy.

Assign a Calling Plan license to all users.

Why it fails: Calling Plans are Microsoft-provided PSTN calling services, not part of Direct Routing. They do not integrate with your SBC and would not provide redundancy for your Direct Routing setup. Additionally, adding Calling Plans would not address the failure of your SBC; it would be a separate PSTN connectivity method. Thus, it does not meet the requirement.

Implement a Session Border Controller (SBC) that supports media bypass.

Why it fails: Media bypass optimizes media flow by keeping it between the client and SBC, but it does not provide redundancy if the SBC fails. If the only SBC is down, media bypass does not help because there is no alternate path. Media bypass is about efficiency, not survivability. Therefore, it does not address the requirement for high availability.

Enable cloud voicemail for all users.

Why it fails: Cloud voicemail handles voicemail messages but does not provide PSTN call routing or redundancy. If the SBC fails, voicemail alone cannot route calls. While voicemail is a useful feature, it does not ensure high availability for live calls. Therefore, it does not satisfy the need for a highly available and survivable Direct Routing solution.

Check the Microsoft 365 Service Health dashboard for Teams incidents

Why it fails: The Service Health dashboard shows broad service incidents affecting many users, not individual call quality issues. While it is important to rule out a service outage, it does not provide the granular data needed to diagnose per-user network or device problems. Therefore, it is not one of the two actions to perform for this specific investigation.

Run the Teams Network Planner for the affected users' locations

Why it fails: Network Planner is a planning tool used to estimate bandwidth requirements for Teams. It does not provide real-time diagnostics or troubleshooting for existing call quality issues. It would not help identify whether the problem is network or device related in this scenario.

Review Teams usage reports for the affected users

Why it fails: Teams usage reports provide aggregate activity data, such as number of calls and meetings, but do not include quality metrics or network performance. They cannot help identify the cause of poor call quality, whether network or device. Thus, this action is not appropriate for the investigation.

Assign a Microsoft 365 E5 license to the Resource Account.

Why it fails: While an E5 license would technically work, it is an expensive and unnecessary use of a full user license. Microsoft provides the 'Virtual User' license specifically for Resource Accounts used by Auto Attendants and Call Queues at no additional cost for organizations with existing Phone System licenses.

Create a team specifically for the Auto Attendant to store call logs.

Why it fails: Auto Attendants do not require a dedicated team to store logs; call data is managed centrally within the Teams usage reports and Call Quality Dashboard. Creating a team would not provide any functional benefit to the setup or operation of the Auto Attendant itself.

Enable 'Allow guest access' in the Teams admin center.

Why it fails: Guest access settings control whether external users can be added as members of a team and have no impact on the functionality of Auto Attendants. Auto Attendants handle incoming PSTN or federated calls, which is an entirely different communication flow than managing guest identities in a team.

The ability to record meetings within the team

Why it fails: Meeting recording is a feature controlled by Teams Meeting Policies assigned to users. Sensitivity labels currently focus on the 'container' (the team/site) and its membership/access rules, rather than the specific functional features of the Teams meetings that occur within those containers.

The maximum number of members allowed in the team

Why it fails: The maximum capacity of a team is a service-wide limit defined by Microsoft and cannot be adjusted through sensitivity labels. Labels are designed for security and compliance governance, not for managing the resource scale or technical membership quotas of individual teams or groups.

Allow users to create private channels

Why it fails: Private channel creation is governed by Teams policies, not messaging policies. Messaging policies focus on the content and delivery of communication rather than the structural creation of team workspaces. Confusing these two policy types can lead to incorrect configuration of organizational governance requirements.

Restrict access to third-party apps

Why it fails: Application access is strictly managed through App permission policies. Messaging policies do not have any controls over whether third-party applications are enabled or disabled for users. Administrators must use the correct policy pane to effectively manage the application landscape for their users.

Configure meeting lobby settings

Why it fails: Meeting lobby settings are defined within Meeting policies. These policies control how participants enter and wait for meetings, which is distinct from the messaging features that occur within persistent chat threads. Mixing these settings up will result in failed management of the virtual meeting experience.

In Guest access, set 'Allow guest access in Teams' to Off.

Why it fails: Guest access and External access are two different features. Turning off guest access would prevent external users from being invited as members into your teams, but it does not control the federated chat and calling capabilities that are managed under the External access (federation) settings.

In External access, set the domain access to 'Block all external domains'.

Why it fails: Setting the policy to 'Block all external domains' would prevent communication with every external organization, including contoso.com. This setting overrides any allowed list and completely disables federation, making it impossible for users to collaborate with the partner domain specified in the requirements.

In the Microsoft 365 admin center, disable 'External sharing' for SharePoint.

Why it fails: SharePoint external sharing settings control how files and folders are shared with people outside the organization. While related to collaboration, these settings do not govern the ability of Teams users to engage in federated chat or calls with users from other domains.

Tenant-wide user activity trends

Why it fails: User activity trends track how many users are active or how many chats were sent, which is helpful for adoption metrics but does not provide diagnostic insight into why audio quality is failing across specific network segments or geographic regions of the organization.

Individual user chat logs

Why it fails: Chat logs do not contain media-related telemetry and are irrelevant for troubleshooting call quality. These logs are primarily used for compliance or investigations into workplace conduct and do not assist in identifying network bottlenecks or media-stream performance degradation in Teams environments.

Client software version adoption

Why it fails: While client versioning can impact performance, it is generally secondary to network infrastructure issues when investigating a sudden, organization-wide spike in poor quality. Focusing on network-centric data in CQD provides more immediate actionable intelligence regarding infrastructure bottlenecks and potential routing failures.

Disable the 'Allow third-party apps' toggle in the Org-wide app settings.

Why it fails: Changing the Org-wide settings would affect every user in the entire tenant. This would exceed the requirement of only restricting a 'specific group' of users. Org-wide settings are a global kill-switch and lack the granularity needed for targeted policy application across different departments or roles.

Delete all third-party apps from the 'Manage apps' list.

Why it fails: Deleting apps from the 'Manage apps' list removes them from the entire tenant's catalog. This would prevent any user in the organization from using those apps, which is not what was requested. The goal is to restrict access for some users while presumably allowing others to continue using them.

Modify the Global (Org-wide default) App Permission Policy.

Why it fails: Modifying the Global policy would change the experience for all users who do not have a custom policy assigned. To isolate the change to a specific group, it is best practice to create a new custom policy rather than altering the default behavior for the entire organization.

Using the Microsoft Purview compliance center

Why it fails: The Purview compliance center is for data governance, retention, and legal compliance. It is not an interface for creating teams. Confusing compliance tools with provisioning tools is a common error and demonstrates a need for further study of the M365 administrative interfaces and their functions.

Using the Microsoft Entra Conditional Access portal

Why it fails: Conditional access is used to secure access to resources and does not provide functionality for creating or managing the structure of teams. Providing this as a method for team creation is incorrect and indicates a lack of understanding of the purpose of security and identity policies.

Using the Microsoft 365 Security Center

Why it fails: The Security Center is for managing threat protection and security policies. It does not provide the capability to create new teams, as this is a functional task that belongs to the Teams application or its administrative portal, not the security configuration environment of the tenant.

Assign the Teams Communications Administrator role to all HR department members.

Why it fails: The Teams Communications Administrator role focuses on managing calling and meeting features, not the creation of teams or underlying groups. Assigning this administrative role would grant unnecessary permissions for managing phone numbers and call quality, without actually providing the specific rights needed to create teams or groups.

Modify the Teams Messaging Policy to disable the 'Create channels' option.

Why it fails: Messaging policies control user-level features within a team, such as deleting messages or using GIFs. They do not control the creation of the Teams themselves. Disabling channel creation would only prevent users from adding channels to existing teams they already belong to, failing to address the primary goal.

Enable the 'Scoped directory search' in the Teams admin center.

Why it fails: Scoped directory search is used to limit which users can see each other in the directory, typically for privacy in multi-tenant environments. It has no technical impact on the permissions required to provision new Microsoft 365 Groups or Teams, and therefore does not assist in restricting team creation.