How to Audit Channel Creations in Microsoft Teams

By default, Microsoft Teams allows any user to create or delete channels within the teams they are members of. While this feature enhances collaboration on specific topics or projects, it can lead to clutter and confusion due to the SharePoint sites of those created channels.

To address this, admins can configure Teams channel creation permissions to prevent users from creating and deleting channels in a team using the steps below:

• Navigate to Teams»Manage Team»Respective Team»Channels in the Teams admin center
• Disable the 'Add and edit channels', 'Add and edit private channels', and 'Delete channels' toggles to prevent the creation of standard channels, private channels, and the deletion of channels.
• Then, click on 'Apply'.

To block the channel creation and deletion in Microsoft Teams using the PowerShell, use the following cmdlets.

#To block users from creating channels in a team.
Set-Team -GroupId "<TeamsGroupID>" -AllowCreateUpdateChannels $false

#To restrict private channel creation in a team.
Set-Team -GroupId "<TeamsGroupID>" -AllowCreatePrivateChannels $false

#To restrict users from deleting channels in a team.
Set-Team -GroupId "<Group's object ID>" -AllowDeleteChannels $false

You can disable shared channel creation in Microsoft Teams only through an organization wide policy. This setting is particularly useful when your organization does not require any external collaboration for a specific period. You shall follow the below steps to restrict the users from creating shared channels.

• Navigate to Teams»Teams policies, then click on the 'Global (Org-wide default)' policy in the Teams admin center.
• Here, you shall disable the required options to restrict the creation of Teams shared channels and the collaboration of external users in shared channels.

Private and shared channels in Microsoft Teams are specifically designed for confidential conversations and secure external collaboration. However, unauthorized creation of these channels can lead to unmanaged conversations and potential security risks from external users.

To address this, you should audit the creation of private and shared channels. However, the audit log from the Purview portal cannot be refined to show only shared or private channel creations. To achieve this, you must apply the following filters to the results exported from the Purview portal.

• Filter the AuditData column with "ChannelType":"Shared" in the downloaded results to view only Teams shared channel creations.
• Use the "ChannelType":"Private" filter in the AuditData column to see only MS Teams private channel creation activities in the downloaded results.

To eliminate the need for complex filtration, run the AuditMSTeamsChannelCreations.ps1 script with 'PrivateChannelsOnly' parameter to get results on only private channel creations.

.\AuditMSTeamsChannelCreations.ps1 -PrivateChannelsOnly

Similarly, you can use the 'SharedChannelsOnly' parameter as mentioned below to separately review the creation of shared channels.

.\AuditMSTeamsChannelCreations.ps1 -SharedChannelsOnly

• The private channel creations report provides essential details such as the channel creation date, time, and the user who created the channel, etc.
• The shared channel creations report gives you full visibility into new shared channels and helps you to verify that all external collaborations are authorized and necessary.

Lost in navigating multiple reports? Here's a quick tip: Use the "Ctrl + Shift + F" key combination and type in a few related keywords. The reports you need will instantly be at your fingertips!

When anyone from a Team owner is organizing unused channels in Microsoft Teams, there is a risk of unintentionally deleting an active channel by mistake. Such accidental deletion of Microsoft Teams channels can result in data loss, disrupting ongoing projects and team communication.

Fortunately, Microsoft Teams gives you a 21-day recovery window to restore accidentally deleted channels and regain essential data quickly.

To recover a deleted channel in a team, the respective team owner can follow the steps below in the Microsoft Teams application.

• Navigate to the required team and click the ellipses (...) next to the team's name.
• Go to Manage team»Channels»Deleted section to find all the deleted channels with deletion date.
• Then, click on the 'Restore' associated to respective channel.

Important notes on Teams channel recovery:

• Simply select 'Deleted channel' from the Operation easy filter in 'Teams Channel Creation and Deletion' report to view all deletion events.
• Click on the alert icon (🔔) directly from the report page to set up an advanced alert policy on channel deletion activities.

Get instant alerts on channel deletions in your organization and take prompt actions against unauthorized events—even when you are in offline!