Alpine Ski House is setting up Microsoft Teams for their operations department. The admin has created a team called 'Operations' and needs to ensure that only department managers (team owners) can create new channels and add external guests. Regular team members should be able to post messages but not modify team structure. What is the correct way to enforce this configuration?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of team settings like the rules posted in a staff kitchen — they apply to that specific room, not the whole building. To restrict channel creation to owners only, you go into the 'Operations' team's own settings and toggle off the member permission to create channels. That's it — no need to rebuild the team or call in Azure AD.
Full explanation below image
![A 2048x1536 portrait-orientation infographic titled 'Microsoft Teams: Team Permission Levels' in white text on a deep Teams purple (#6264A7) header banner. The layout has three horizontal sections. Top section: A Teams icon with the 'Operations' team name and two role badges side by side — an 'Owner' badge with a gold crown icon and a 'Member' badge with a blue person silhouette icon. A connecting line shows they are both in the same team. Middle section: Two tall columns with rounded rectangle borders. Left column (gold border, labeled 'Owners CAN') lists with green checkmark icons: 'Create channels,' 'Add external guests,' 'Modify team settings,' 'Delete the team.' Right column (blue border, labeled 'Members CAN / CANNOT') shows two sub-sections: green checkmarks for 'Post messages' and 'Join channels and meetings,' and red X icons for 'Create or update channels' and 'Add external guests.' Bottom section: A navigation breadcrumb path on a light gray background showing 'Teams Admin Center → Manage Teams → Operations → Settings → Member Permissions → [toggle OFF] Allow members to create and update channels.' Use Teams purple (#6264A7) as the primary color, gold (#F9A400) for owner elements, and clean white icons with drop shadows. Modern flat design with subtle rounded corners throughout.](/media/microsoft/ab-650/AB-650-e1-q009-infographic.webp)
Full Explanation
Microsoft Teams has a two-layer permission model: tenant-wide policies (set in the Teams admin center) and per-team settings (configured by team owners or admins). For this scenario, the correct approach is to configure per-team Member permissions. In the Teams desktop app, a team owner can go to the team's Settings tab and under 'Member permissions,' uncheck 'Allow members to create and update channels.' Admins can also manage this from Teams admin center > Teams > Manage teams, selecting the team and adjusting its settings. Guest access can be controlled both at the tenant level (Teams admin center > Org-wide settings > Guest access) and at the individual team level.
Option A (separate teams with cross-team permissions via Azure AD groups) is incorrect because Teams does not support cross-team permission inheritance in the way described. Creating separate teams would fragment the operations department into multiple workspaces, which defeats the purpose of having a single 'Operations' team where everyone collaborates. Permissions for channel creation are configured within a single team, not across teams.
Option C (Microsoft 365 admin center > Org settings > Microsoft Teams > Channel permissions) is incorrect because the Microsoft 365 admin center's Org settings for Teams controls global defaults that affect all teams across the tenant — not per-team granular settings. To restrict channel creation in just the 'Operations' team without affecting all other teams in the organization, you must use per-team settings in the Teams admin center or the Teams client.
Option D (Conditional Access policy in Microsoft Entra ID) is incorrect because Conditional Access is designed to control access to applications and resources based on conditions like device compliance, location, or sign-in risk. It cannot target granular in-app features like 'channel creation' within Microsoft Teams. Conditional Access operates at the authentication and authorization layer, not the application feature layer.
Exam Tip: On the AB-650 exam, when a question asks about restricting a feature for specific members within a single Microsoft Teams team, the answer almost always involves per-team Member permissions — not tenant-wide policies or Conditional Access. Know the difference between tenant-level Teams policies (affect all teams) versus individual team settings (affect one team).