Teams is an identity tenant, not an identity owner
Every 'who' question in Teams is answered by Entra ID:
- Sign-in is an Entra token acquisition (the client holds tokens for Teams, Graph, SharePoint, Exchange — a constellation, not one token).
- A team's membership IS a Microsoft 365 Group's membership. Add someone via Graph to the group and Teams reflects it; the sync is one-directional truth, with minutes of propagation lag that users report as "I was added but see nothing".
- Policies target Entra objects — user assignments and group assignments both resolve through Entra, so a mis-synced user gets mis-policied.
The objects a healthy Teams tenant presupposes
| Object | Role | When it's wrong |
|---|---|---|
User with UserPrincipalName = primary SMTP ideally |
Sign-in + addressing | UPN≠SMTP mismatches produce calendar/meeting-join gremlins that look random |
| Microsoft 365 Group per team | Membership, mailbox, site | Group soft-deleted → team vanishes; restore the group, the team returns |
Teams service plan enabled on the licence |
Service entitlement | Disabled plan = user exists everywhere but Teams says no |
| Resource accounts (rooms, auto attendants, call queues) | Service identities | Disabled/password-expired resource account = silent dead room or dead queue |
| Guest objects (#EXT#) | External members | Guest blocked at Entra level while Teams settings allow → invite succeeds, access fails |
Hybrid sync: where the bodies are buried
If identities sync from AD, Teams inherits every sync sin:
- Soft-match/hard-match mistakes duplicate users; chat history splits between them.
- Attribute flow gaps (msRTCSIP-* leftovers from Skype on-prem) can leave
InterpretedUserTypein hybrid states that block voice features — the single most common cause of "can't enable Enterprise Voice" in migrated estates. - Deleting and recreating an AD user with the same UPN makes a NEW object: new chats, lost memberships. Restore, never recreate.
What to watch (proofs)
- The user as Teams sees them:
Get-CsOnlineUser <upn> | fl UserPrincipalName, SipAddress, InterpretedUserType, AccountEnabled, HostingProvider—InterpretedUserTypeshould bePureOnlineTeamsOnlyUserin a healthy cloud estate; anything mentioning Hybrid/SfB in a cloud-only org is residue to clean. - Group↔team linkage:
Get-UnifiedGroup <team> | fl ResourceProvisioningOptionsmust containTeam; missing = group exists, team half-provisioned. - Sync health: Entra admin center > Entra Connect > Sync errors; every export error there is a future Teams ticket.
- Sign-in truth: Entra sign-in logs filtered to the Teams app id — failures here explain "Teams won't load" before you touch a client log.
- Soft-deleted groups (deleted teams in their 30-day window):
Get-MgDirectoryDeletedItemAsGroup— the restore list.