Teams Permissions and Roles

Analogy categoryAnalogies

The Teams Role Hierarchy

Permissions in Microsoft Teams operate on three nested levels: tenant-level admin roles (Teams Administrator, Global Administrator) that govern policy across the whole organization; Team-level roles (Owner and Member) that govern a specific Team; and channel-level roles that apply only within private and shared channels, since standard channels inherit permissions directly from Team membership. A Teams Administrator assigned in the Microsoft 365 admin center can manage Teams policies, meeting settings, and phone system configuration tenant-wide, but that role alone does not automatically make someone an Owner of every individual Team — Team ownership is a separate, per-Team assignment.

🏏

Cricket analogy: A tenant admin is like the cricket board setting national selection policy, a Team Owner is like a franchise's team manager who picks the actual squad, and a channel member is like a specific bowler on the roster who trains within that squad's system.

Owners vs Members at the Team Level

A Team Owner can add or remove members and guests, change Team settings (such as whether members can create standard channels or delete their own messages), archive or delete the entire Team, and manage app permissions for that Team; a Team can have multiple Owners, and Microsoft recommends at least two so administrative access doesn't depend on a single person. Regular Members can post in channels, create channels themselves if the Owner's policy allows it, and participate in meetings and files, but cannot change Team-wide settings, cannot remove other members, and cannot delete the Team — attempting any of those actions from a Member account simply won't surface the relevant menu options in the client.

🏏

Cricket analogy: A Team Owner deciding whether members can create new channels is like a captain deciding whether senior players can call their own net sessions, while a regular squad member simply attends the sessions scheduled for them.

Private Channel Owners and Guest Access Nuances

Private channels introduce their own, separate Owner/Member layer that does not inherit from the parent Team — being a Team Owner does not automatically make you a private channel Owner if you weren't added to that specific channel, which is intentional, since private channels exist precisely to restrict visibility even from some Team Owners. Guest access, meanwhile, is governed by a combination of Azure AD guest invitation settings at the tenant level and per-Team decisions about which guests are added; guests can be full Team members with most of the same posting and file capabilities as internal Members, but they can never be Team Owners, cannot create private channels, and are subject to a shorter list of allowed features that admins configure through the Teams guest access policy.

🏏

Cricket analogy: A private channel having its own Owner separate from the Team is like a franchise's leadership group having a closed strategy session that even some senior coaching staff aren't invited into, despite their seniority on the main squad.

powershell

# Microsoft Teams PowerShell - add a Team Owner and check current role
Connect-MicrosoftTeams

Add-TeamUser -GroupId $teamId -User "alex.morgan@contoso.com" -Role Owner

Get-TeamUser -GroupId $teamId | Where-Object { $_.Role -eq "Owner" } |
    Select-Object Name, User, Role

Microsoft recommends every Team have at least two Owners. If a Team has only one Owner and that person leaves the organization or loses access, a Global Administrator or Teams Administrator must intervene via the admin center to reassign ownership — regular Members cannot promote themselves.

Guests can never be private channel owners and, depending on tenant guest access policy, may be blocked entirely from being added to private or shared channels even when they're already a Member of the parent Team — always check the tenant's guest access policy before assuming a guest can be looped into a sensitive sub-channel.

Permissions nest across three levels: tenant admin roles, Team-level Owner/Member roles, and channel-level roles for private/shared channels.
Team Owners can manage membership, settings, apps, and can archive or delete the Team; Members cannot.
Microsoft recommends at least two Owners per Team to avoid a single point of administrative failure.
Private channels have their own independent Owner/Member layer that does not inherit from the parent Team.
Being a Team Owner does not automatically grant private channel ownership or visibility.
Guests can be full Team Members but can never be Team Owners or private channel Owners.
Tenant-level guest access policy can further restrict what guests are allowed to do, including private/shared channel participation.