Microsoft Teams Employee Monitoring: A Top Secret Guide (2022)

Today, I want to show you all the different ways that Microsoft teams employee monitoring works. How you use Microsoft teams so what do I mean by that? Well, any time you click on something, any time you launch an app, any time you join a meeting and any time you send a message and the contents within that message, all of that is tracked and stored so someone could go back later on and they can retrieve all of that information.

You better hope that you didn’t say something malicious because that could come to light to a public audience. I used to work as a program manager and we instrumented everything within all the different experiences that we were building. I worked on Exchange Online but also within Microsoft teams, everything gets instrumented. Any time there’s a click, all of that information is available later on. Let’s say you work for a company or an organization or maybe you go to a school that organization or that school, they can find out what you were doing and they could even see the contents of what you were writing.

Before you freak out and you say, I was gossiping about one of my coworkers, I really don’t want this to come to light. Well, you don’t have to worry because it’s not really practical to get it on just everyday cases. In fact, if your manager or your boss wanted to get access to some of this information, well, they’d have to work through it. They’d have to work with an HR and they’d probably need really good justification in place to gain access to this type of data.

Now, the types of cases where you can see this coming up is, well, maybe there was harassment or maybe someone sold the secret recipe to the Luke Cookie Company. Those are the types of cases where you might want to go back, have some discovery to be able to retrieve this type of information.

Microsoft teams employee monitoring

• Let’s look at what type of information can be tracked by Microsoft teams. We need to access a few of the different admin centers and to get there, sign into the office portal to be able to access this type of information, you need to be an admin and for some of it, you even need higher privileges than that.
• If you are an admin, click into the admin center within the admin center, click on show all so we could see all the different options. Let’s click into compliance.

• We’re going to start in the Microsoft 365 Compliance Center. If that just sends a shiver down your spine, I know the last thing you ever want to hear at work is that you’re non-compliant within the compliance center.
• We can search through everything in Microsoft teams. That includes things like private channels and even direct messages that you send to others and it’s not just limited to Microsoft teams. We can also search across email, basically any product that’s part of Microsoft 365.
• Now remember, typically only a legal or compliance team member will have access to this type of information. You don’t have to worry about your manager snooping around your teams messages to get started.
• On the left hand side. Let’s click on the option that says show all. Next, click on the one that says content search.

• With this, I can search across all the content that’s within my Microsoft 365 tenant. Now, we’ve recently had an employee (Advance Vance) and she didn’t leave on the best of terms. I want to find all communications from Adele Vance to see what was going on.
• Right up here in the top left hand corner. I can kick off a new search by clicking here.

• This drops me on a page where I can compose my search query. I can search for specific keywords. I could also click to add additional conditions. When I click on this and opens up on the right hand side and there are a whole bunch of different conditions that I can add.

• Now, once again, I want to find all content from Adele Vance so select an option that says Sender/Author and click on Add. Now over on the left hand side for my search query, I see a new field for the sender or author here. I will type in Adel’s email address.

• I don’t want to search for any specific keywords. I have all the conditions selected and write down here. I can also choose if I want to search across specific locations. Do I just want to search on teams or do I also want to include exchange emails?

• I can specify what all of those different locations are. I want to simply search across everything so all select all locations right down here, all of that checkbox checked and then click on Save and Run. Next, I can save my search and I will call this the Adell Vance investigation. I have now typed in my details so all click on Save.

• I have now finished running my query and I can double click on it and this will show me a top level summary. I can review what the query was and down below I can see the status. It looks like it found 182 different items involving Adele Vance.

• Now right up here, I can export the results or I can view them directly using view results. The view results drops me back into the content search view and I can now view all the content within my tenant that matches this criteria. Over here, I can see any piece of content that involves Adele Vance.

• Here I can see items from her calendar. If I jump forward, I could also see email messages that Adele sent and I could also see any teams messages that she sends. I could see the details of the message. I could see who sent it, who she sent it to the subject, the date and I could also see the specific content of the message.
• I went through all the different messages and I didn’t find anything where Adele sold the secret recipe of the Luke Cookie Company. I still have my suspicions but she didn’t leave any traces behind or at least no digital traces.
• Over on the left hand side, there’s also something called e-discovery. This, too, also allows you to search across all the content within your tenant, but it also allows you to preserve content.

• Let’s say there’s an investigation and process or maybe there’s a lawsuit and you need to make sure you retain the data. You can use e-discovery to do that. For more information about eDiscovery, check this article.
• Back now within the Microsoft 365 admin center. Let’s see what’s tracked in the Microsoft teams admin center.
• To get there, over on the left hand side. At the very bottom, let’s click into teams

• Within the teams admin center, over on the left hand side, click on analytics and reports and then click on usage reports.

• This drops us into the report view. There are several different types of reports that I can run. We’re going to take a quick look to see what these reports are.

• Let’s start at the top with app usage here. I could select the report type and select the date range. Let’s go with the last 90 days and then run the report. The first report shows me what apps are being used in my organization so I can see a full list with all these different reports.

• Up in the top right hand corner, I have a few different options. I could export the report to Excel so I could analyze it there. I could also filter the report.
• Let’s say I want to filter by a specific app name right back here. I could also view it full screen. If I click on the settings gear, I can edit the columns that show up in the report. Once again, I have access to these same controls and all the different report views back over on reports.

• I now have a set of three additional reports and they all have to do with PSTN. What is this? Well, that stands for public switch to network telephone. Basically, if you can make traditional phone calls from teams, you can view analytics on it. You will be able to see things like call minutes or how many SMS were sent.

• There’s also a report on teams device usage. Let’s click on this and run the report.
• This shows me what devices users in my organization are using to connect to Microsoft teams. I can see that many of my users are using Windows. I also have some users on iOS and then I have a bunch of users connecting on the Web so this gives me per user information on what device they’re using to connect to teams. I could also see when their last activity was back within the report list.

• There’s also a report for teams live events. If you host live events, you can see analytics on that.

• Next, let’s click into the one called teams usage and then run the report.
• Teams usage will show me engagement on the team level. Here I can see for all of my different teams, how many active users are there, how many posts, how many replies. You can see the types of information that you can see here. I could get a sense for what the most active teams in my organization are back on top.

• Within the report dropdown, let’s click into the one called Teams User Activity.
• This is an interesting one here. When I click on View report or run report here, I can see how all the different users in my organization are engaging with Microsoft teams.
• I will take myself as an example here. I can see how many channel messages I posted, how many replies, how many chat messages. I can also see how everyone’s engaging with Microsoft teams. As I go over some other interesting information, I can see how much time I have spent in audio calls, how much time I have been on video and how much time I have spent on screen sharing. I could also see when my last activity was.

• The last report within this list is called Diagnostics, and this will tell you the quality of your different calls.
• Along with all the analytics and reports that we have here. We also have some additional user level information.
• Over on the left hand side on Teams admin center, click on users.

• This will display all the different users in my organization. I will click on myself as an example. Up here, you can see things like the call quality how many meetings and how many calls I have had over the last seven days.

• Right down here I can view a call history that show all the different calls that I had and how long they were for.

• If I click into it, I can even see who the organizer was, different participants on the call was, session type, duration of the call and audio quality of the call.

• Back within the Microsoft 365 admin center there are some higher level reports that Microsoft teams feeds. Over on the left hand side, let’s click on the option that says reports. Let’s start with the one called the productivity score.

• The productivity score rates your organization based on how much you’re leveraging the different tools that come with Microsoft 365. Here I can see how much we’re communicating, how many meetings we’re having and how much we’re collaborating on content.

• In the past, Microsoft had an individual productivity score that measured individuals on similar metrics and yeah that got quite a bit of backlash and Microsoft quickly retreated on it the idea of being rated based on the apps you’re using just didn’t sit that well with end users.
• Over on the left hand side, the next report is called usage.
• With usage, you can view on how different users are engaging with apps and services within your organization. If I hover over Microsoft teams, I can see in aggregate on how many active users teams has.
• This is especially helpful if say maybe you’re trying to roll out teams in your organization and you want to see what the uptick is, you can view that right here.

• Also down below, you can see across all of your different services usage looks like. You can also view Microsoft teams activity so you can see channel messages or chats and how many users are engaging here.

• Let’s click on view more within the Microsoft teams usage report. This has a lot of similar information to what we saw in the teams admin center.

• I can see overall information and down below I can see overall information for my individual users. I can also choose the columns and get similar columns to what I had in the teams admin center.
• Now so far we’ve been looking at all the different information that Microsoft teams tracks from within the admin center but what if you don’t have access to the admin center. Can you still track some of this information.
• If you’re in education, you have access to something called insights.
• I have already added it here on the left hand side if you don’t have it. You can click on the ellipsis and search for insights and this drops me into insights.

• By default, in the dashboard view, I can select what types of activities I want to view and have a few different options.
• For now, I will stick with all activities. I could also choose the date range and see on how many daily active users I have had. This gives me aggregate data and I can also see it by hour of day.

• Right up above, click and generate reports. Within reports, I can generate a report that shows me the engagement on a user level for all the different activities. I can choose my date range and I have already selected the last 28 days. Once I’m ready to run the report, I will click on export to CSV.

• I can see see how much time they spent in meetings and how many meetings they joined on a day-to-day basis.

• Let’s say that you have a student and you have one class every day, you can use this in a sense as an attendance tracker and you can see on how much time that student spent in meetings every day and how many meetings they ended up joining.
• Now, we’ve looked at a lot of different ways that teams can track your usage and most of these are only available to the admin or if you’re a teacher within an education account but there is one additional way that you can track users and this is available to anyone who hosts a meeting.
• When you’re within a meeting in Microsoft teams and you open up the participants view in the top right hand corner there’s an ellipsis and you can download an attendance list.

• This will download into csv format and you can see who joined your meeting, when they left your meeting, if they rejoined and how long they were part of your meeting so this is available to any meeting organizer.

That’s how Microsoft teams employee monitoring works.