The Teams role family
| Role | Can | Cannot |
|---|---|---|
| Teams Administrator | Everything Teams: policies, voice, devices, teams themselves | Licences, Entra settings |
| Teams Communications Administrator | Meetings + voice config (policies, numbers) | Teams/channels management, app policies |
| Teams Communications Support Engineer | Full call analytics for ANY user (read) | Any writes |
| Teams Communications Support Specialist | Call analytics for the SEARCHED user only | Cross-user correlation views |
| Teams Device Administrator | Device management in TAC | Everything else |
The two support roles are the underused gems: they give the service desk real call-quality triage without a single write permission.
Scoping with Administrative Units
Entra AUs restrict WHERE a role bites: put the Contoso-France users in an AU, assign Teams Administrator scoped to that AU, and the France IT team manages France. The catches that matter:
- Scoping is identity-centric. AU-scoped admins manage users in the AU; org-wide singletons (Global policy DEFINITIONS, org-wide settings, voice routing) don't partition — creating/editing policy definitions generally needs tenant-wide rights, while granting existing policies to AU users scopes fine. Design: central team owns definitions; regional admins assign.
- TAC respects AU scoping unevenly across blades — test each blade your delegates need; some show org-wide reads.
- PowerShell/Graph honour the same RBAC, but error messages for out-of-scope attempts are unhelpfully generic ("access denied", no mention of AU) — document scope for your delegates or drown in false bug reports.
What to watch (proofs)
- Who holds what: Entra > Roles & administrators > each Teams role → assignments, noting AU scope column; export quarterly (PIM if you have it: activation logs too).
- Delegation working as designed: as the scoped admin,
Grant-CsTeamsMeetingPolicyto an in-AU user (succeeds) vs out-of-AU (denied) — run both once, screenshot, that's the acceptance test. - Every admin action, attributed: unified audit log filtered to Teams admin operations — actor + target + role context; your least-privilege proof for auditors.
- Role sprawl: count of Global Admins holding Teams-only duties — each one is a candidate for demotion to Teams Administrator; the number should trend to zero.