Security Roles, Alerts & Defender
Teams security starts with the right admin roles, alert policies, and Defender XDR threat protection. Learn which roles can do what, how to set up alerts, and how Defender protects Teams.
Security foundations for Teams
Think of Teams security like running a building.
You need security guards (admin roles — different guards have different keys), alarm systems (alert policies that notify you when something suspicious happens), and a security company (Microsoft Defender XDR that actively hunts threats).
Not every guard needs every key. The receptionist doesn’t need access to the vault. Same with Teams admin roles — give people only the access they need.
Teams administrator roles
Microsoft provides several admin roles specifically for Teams management. The exam tests your ability to choose the least-privileged role for each scenario.
| Feature | What They Can Do | What They Cannot Do | Typical Scenario |
|---|---|---|---|
| Teams Administrator | Full control over Teams service — policies, settings, users, teams, channels, apps, phone, devices | Cannot manage Exchange, SharePoint, or Entra ID settings | Primary Teams admin — Tara at Pinnacle Corp |
| Teams Communications Administrator | Manage meetings, calling policies, phone numbers, conferencing bridges, voice routing | Cannot manage teams, channels, apps, or org-wide settings | Voice/phone specialist — manages call queues and auto attendants |
| Teams Communications Support Engineer | View call analytics for ALL users (full call records) | Cannot change any settings or policies | Network engineer investigating quality issues across the org |
| Teams Communications Support Specialist | View call analytics for specific users (anonymised for others) | Cannot see full call records for all users, cannot change settings | Helpdesk agent like Jaylen troubleshooting a specific user's issue |
| Teams Devices Administrator | Manage Teams devices — configuration profiles, firmware, device health | Cannot manage policies, users, voice, or meetings | Tara's colleague who manages 200+ Teams Rooms devices |
| Global Administrator | Everything — all Microsoft 365 services | N/A (full access) | Emergency only — never use for daily Teams admin work |
Exam principle: Always choose the least-privileged role that can complete the task. If someone only needs to manage phone numbers and calling policies, assign Teams Communications Administrator — not Teams Administrator.
Scenario: Nadia requests the right roles at Sterling Financial
Sterling Financial has strict role separation requirements. Nadia needs to assign Teams admin roles to her team:
- Nadia herself: Manages compliance settings (DLP, retention, IB) → She needs Compliance Administrator (not a Teams role — compliance is managed in Purview)
- IT Operations lead: Manages all Teams policies and settings → Teams Administrator
- Voice engineer: Manages phone numbers, call queues, auto attendants → Teams Communications Administrator
- Helpdesk team (3 agents): Troubleshoot individual user call quality → Teams Communications Support Specialist (anonymised data for other users)
- Network engineer: Investigate org-wide call quality patterns → Teams Communications Support Engineer (full call records)
- Device technician: Manages conference room devices → Teams Devices Administrator
This follows least-privilege: no one gets more access than their job requires.
Licensing for security features
Not all security features are available with every licence:
| Security Feature | Required Licence | Notes |
|---|---|---|
| Alert policies | Microsoft Purview / Microsoft 365 licensing dependent | Built-in alerts for suspicious sign-ins, malware |
| Custom alert policies | E5, E5 Compliance, or A5 | Create alerts for specific Teams activities |
| Safe Attachments for Teams | Defender for Office 365 P1/P2 or E5 | Scans files shared in Teams channels and chats |
| Safe Links for Teams | Defender for Office 365 P1/P2 or E5 | Checks URLs in Teams messages at click-time |
| Defender for Cloud Apps | E5 or Defender for Cloud Apps add-on | Monitors Teams sessions, detects anomalous behaviour |
| Information barriers | E5, E5 Compliance, or IB add-on | Prevents communication between specific groups |
| Communication compliance | E5, E5 Compliance, or Insider Risk add-on | Monitors messages for policy violations |
Exam tip: When a question says “at minimum cost,” look for the cheapest licence that includes the required feature. E5 includes everything, but if you only need Safe Attachments, Defender for Office 365 Plan 1 is cheaper.
Alert policies for Teams
Alert policies notify admins when specific events occur. They’re configured in the Microsoft Purview compliance portal (compliance.microsoft.com) or Microsoft Defender portal (security.microsoft.com).
Built-in alert policies (available to all):
- Unusual volume of external file sharing
- Suspicious email forwarding activity
- Malware detected in files
Custom alert policies (E5 required) let you create alerts for Teams-specific events:
- User shared a file externally from Teams
- Guest added to a sensitive team
- Teams policy changed by a non-standard admin
- Unusual spike in Teams meetings created
Creating a custom alert policy
- Go to Microsoft Purview compliance portal → Policies → Alert policies
- Click New alert policy
- Configure: name, severity (low/medium/high), category, activity trigger
- Set threshold: single event or activity above a count within a time window
- Choose notification recipients (email addresses)
- Review and create
Exam tip: Alert policy vs. DLP policy
Don’t confuse alert policies with DLP policies:
- Alert policies = “notify me when something happens” (reactive monitoring)
- DLP policies = “block or warn when sensitive data is shared” (proactive prevention)
Both can be triggered by Teams activity, but they serve different purposes. An alert policy tells you after the fact. A DLP policy prevents the action (or warns the user) before it happens.
Microsoft Defender XDR for Teams
Microsoft Defender XDR provides advanced threat protection that extends to Teams:
Safe Attachments for Teams
When enabled, files shared in Teams channels and chats are scanned in a sandbox (detonation chamber) before users can open them. If a file is malicious, it’s quarantined.
Configuration: Microsoft Defender portal → Policies & rules → Threat policies → Safe Attachments → Enable for SharePoint, OneDrive, and Teams.
Files in Teams are stored in SharePoint (channel files) or OneDrive (chat files), so Safe Attachments for “SharePoint, OneDrive, and Teams” is a single toggle.
Safe Links for Teams
When enabled, URLs in Teams messages are checked at click-time. If a link is malicious, the user sees a warning page instead of the dangerous site.
Configuration: Microsoft Defender portal → Policies & rules → Threat policies → Safe Links → Create or edit a policy → ensure Teams is included.
Defender for Cloud Apps
Monitors Teams usage patterns and can detect:
- Impossible travel (user active in Teams from two countries simultaneously)
- Mass file downloads from Teams channels
- Unusual guest activity patterns
- Session anomalies
Scenario: Nadia configures Defender for Sterling Financial
Sterling Financial handles sensitive financial data. Nadia configures three layers of Defender protection:
- Safe Attachments: Enabled for SharePoint/OneDrive/Teams — scans every file shared in Teams before anyone can open it
- Safe Links: Custom policy for all users — URLs in Teams messages are rewritten and checked at click-time
- Defender for Cloud Apps: Alert when a guest user downloads more than 50 files in an hour from any Teams channel
When a phishing link is shared in a Teams chat, Safe Links blocks it at click-time. When a contractor uploads a macro-enabled Excel file, Safe Attachments detonates it in a sandbox and quarantines it before anyone can open it.
🎬 Video walkthrough
🎬 Video coming soon
Security Roles, Alerts & Defender — MS-700 Module 2
Security Roles, Alerts & Defender — MS-700 Module 2
~12 minFlashcards
Knowledge Check
Sterling Financial's helpdesk agent needs to investigate why a specific user is experiencing poor call quality. The agent should NOT be able to see full call records for other users. Which role should Nadia assign?
Nadia wants to be alerted when a guest user downloads more than 50 files in one hour from any Teams channel at Sterling Financial. What should she configure?
A Teams admin needs to protect users from malicious links shared in Teams chat messages. The organisation has Microsoft 365 E3 licences. What is the MINIMUM additional licence needed?
Next up: Retention & Sensitivity Labels — how to configure retention policies and sensitivity labels specifically for Teams messages, meetings, and channels.