M365 Roundup, March 2021: Teams Meeting Controls, EOP Quarantine Changes, and Fewer Global Admins
TL;DR
- As of March 2021, Teams meeting organizers can disable attendee cameras before or during a meeting, and presenters can spotlight up to 7 participants at once.
- EOP now lets end users request release of quarantined messages directly, and admins can brand quarantine notifications, rolling out from early April through end of June 2021.
- Exchange Online's External email tag is available to enable now via PowerShell and takes 24 to 48 hours to appear after you turn it on.
- Two new least-privilege roles, Authentication policy administrator and Domain name administrator, let you cut Global Admin assignments, available now.
- Microsoft adds Power BI Premium per user and Power Automate per user with attended RPA to self-service purchase on April 19, 2021, which you can pre-empt with PowerShell.
March 2021's Microsoft 365 message-center activity leaned heavily on Teams meeting controls, but the changes that matter most to MSPs are scattered across Exchange Online Protection, admin role design, and the steady creep of self-service purchasing. Here is the digest, grouped by where the work lands.
Teams: meeting controls, spotlights, and a security flag worth noting
Prevent attendees from sharing their video feed. By default, attendees can turn their camera on or off, which is the current experience. Organizers and presenters now get three ways to manage attendee cameras. Before a meeting, the organizer can set Enable camera for attendees to Off from the Meeting Options page (on by default). During a meeting, the organizer or a presenter can reverse that so all attendees can turn cameras on, or enable and disable individual attendees. They can also toggle a specific attendee's camera by right-clicking from the meeting stage or roster. Note that disabling does not force attendees to share video. Timing: April through mid-April 2021.
Multiple spotlights. Presenters and organizers can now spotlight more participants than before, keeping the spotlight on their video or avatar until it is turned off. They can start a spotlight on multiple participants from the roster or stage, stop individual or all spotlights from the roster, and spotlight a maximum of 7 participants at once. Timing: April through mid-April 2021.
Third-party e-signatures in the Approvals app. Microsoft is adding eSignature approval alongside basic and templated approvals, for use inside or outside the organization. Once a Teams admin adds a provider such as Adobe Sign, it becomes available in Approvals when a signature is needed, and the app tracks the whole workflow in context. Adobe emails listed signers, and internal signers get a Teams notification. To prepare, you must enable user credentials before anyone in the tenant can use Adobe Sign in Approvals. Third-party signature partners appear by default; a Teams admin can disable a provider during the public preview, and disabled providers will not show when creating an approval. Timing: Mid-April.
Call Merge. End users can merge an active, unheld 1:1 call into another 1:1 or group call, for both Teams VOIP and PSTN calls. Timing: Late March, completing by mid-April.
Outgoing video in Safari. Previously some Teams web app calling and meeting features were unsupported in Safari, and users could not use their camera. macOS users can now use their camera during meetings in Safari. Timing: Late March.
Auto-claim policies for products containing Teams. An auto-claim policy lets users automatically claim a license for a product the first time they sign into an app, instead of you assigning manually or via group-based licensing. You manage which products users can auto-claim and which products the licenses come from. The feature is off by default. To enable it: in the admin center go to Billing > Licenses, select the Auto-claim policy tab, and in the center of the page select Turn on setting. Timing: GA.
Dynamic View. A redesigned, optimized meeting stage for consuming shared content and engaging with video and audio participants. These are UI updates that appear when a user is in a meeting. Timing: Mid-April (previously mid-March) through end of April (previously end of March).
Teams PowerShell Module 2.0. The release brings new features, fixes, and breaking changes. The main ones: Connect-MicrosoftTeams is now the single command to log in and manage all aspects of Teams and Skype for Business Online, so New-CsOnlineSession is no longer required to log in. New-CsOnlineSession has been replaced with Connect-MicrosoftTeams, which requires a minor update on your side. Long-running scripts are supported natively, so administrators no longer have to explicitly call Enable-CsOnlineSessionForReconnection. Available for download on the PowerShell Gallery (opens in new tab).
Teams for your personal life banners. Users will see a banner in their activity feed saying they can add a personal account to the Teams mobile app. If you previously disabled adding additional accounts, the banner will not appear. To hide the banner, submit a help ticket in the Microsoft 365 admin center to have your tenant excluded; that will not limit users' ability to add personal, work, or school accounts. To restrict adding a personal, work, or school account, separate instructions apply, and restricted users will not see the banner. The security concern here: users creating a personal account on their mobile device and then storing corporate documents in it. Without DLP or MAM policies, corporate data is at risk on these personal devices. Timing: Begins end of April, completing for all customers by end of December.
Exchange Online: granular quarantine control and the External tag
Request/release workflow for quarantined messages. EOP anti-spam, anti-phishing, anti-malware, and safe attachments now allow more granular control of recipient actions, including letting end users request the release of a quarantined message. Previously, admins could not alter end-user access for messages quarantined by default policies, and users who could preview a quarantined message had no direct way to request release; they had to ask an admin. Timing: Standard release customers early April, complete by end of June.
Customization of quarantine notifications. You will be able to brand quarantine notifications with your organization logo, custom display name, and a custom disclaimer, enabled through a new quarantine policy interface. Timing: Early April, complete by end of June.
External email tag. Outlook will display a new External tag in the message list for mail from outside your organization. In some clients the sender's address shows at the top of the reading pane or by clicking the tag. The tag is available in Outlook on the web, the new Outlook for Mac, Outlook for iOS, and Outlook for Android. It is off by default. To enable it, use the Get-ExternalInOutlook PowerShell cmdlets (opens in new tab). Within 24 to 48 hours of enabling, users start seeing the warning tag. Timing: Available to enable now.
Admin and identity: least privilege, branding, and a self-service expansion to pre-empt
Conglomerate branding for global admins. Previously you could set only one default theme for everyone. Conglomerate branding lets you create up to five custom themes, each assignable to a specific Microsoft 365 group, plus support for mobile-specific company logos and alternate logos for dark mode. Existing themes carry over as the default. Note: the navigation bar background image is being retired; saving any modification to a new custom theme permanently removes the background image. Timing: Late April, complete by mid-June 2021.
New least-privilege admin roles. Two new roles reduce Global Administrator dependency. Assign Authentication policy administrator instead of Global Administrator to configure authentication methods, tenant-wide MFA settings, and password protection. Assign Domain name administrator instead of Global Administrator to read, add, verify, update, and delete domain names. Timing: Available now.
Migrate content from Box to Microsoft 365. You will be able to migrate Box documents, data, and users to OneDrive, SharePoint, and Teams. Connecting to a Box enterprise account discovers users and files, auto-maps to individual OneDrive accounts, and lets you manually map to a specific OneDrive account, SharePoint site, or Teams channel. Timing: Public preview mid-March, complete by late March; GA tentatively late June 2021.
Self-service purchase expansion. Microsoft announced that individuals worldwide (excluding India) will be able to buy these products as early as April 19, 2021: Power BI Premium per user, and Power Automate per user with attended RPA. As an admin you can limit this per product starting today via PowerShell (opens in new tab), and you can move users from a self-service purchase to another license or cancel their subscriptions. Self-service purchase is not available for Government or Education-eligible customers. We recommend using the PowerShell cmdlets to disable these capabilities so you do not have revenue leakage from users buying direct. Timing: April 19, 2021.
Frequently asked questions
How do I stop Teams meeting attendees from sharing video?
As of March 2021, a meeting organizer can set Enable camera for attendees to Off from the Meeting Options page before a meeting. During a meeting, the organizer or a presenter can re-enable cameras for everyone or toggle an individual attendee's camera from the stage or roster. The default is on, and disabling it does not force attendees to share video.
Is the Exchange Online External email tag on by default?
No. As of March 2021 the External tag is off by default. You enable it with PowerShell using Get-ExternalInOutlook cmdlets, and within 24 to 48 hours users start seeing the tag on messages from outside the organization. It appears in Outlook on the web, the new Outlook for Mac, and Outlook for iOS and Android.
Which new admin roles reduce Global Admin dependency?
Authentication policy administrator, for configuring authentication methods, tenant-wide MFA settings, and password protection; and Domain name administrator, for managing domain names. Microsoft recommends assigning these instead of Global Administrator, and both are available now as of March 2021.
New controls mean new ways to drift
Every monthly change is a setting that can be misconfigured across a fleet of tenants. CloudCapsule checks all of them against 250+ controls in 60 seconds, so you catch the gaps before the client does.
Try a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
