Understanding how private Teams channels use SharePoint

Microsoft Teams relies on SharePoint for the storage of files and most people are familiar with how this is structured in SharePoint. On the creation of a Team, a SharePoint site is created and for each channel a folder exists in the default library of that site. Private channels store files a little differently in SharePoint and administrators should be aware of this. In this post, I’m going to discuss the relationship between private Teams channels and SharePoint.

So, where’s the folder?

When you create a private channel, Microsoft Teams provisions another SharePoint site specifically for your private channel. The folder where Teams stores your files for this channel exists in the default document library of this site. You can get to this site by going to the Files tab in your private channel and then clicking “Open in SharePoint”. The URL for the site will be something like this:

https://yourtenant.sharepoint.com/sites/yourteam-PrivateChannelName

Permissions

So now you know where the files exist, you’re probably wondering “but what about the permissions for the site?”. That’s a good question because again, it doesn’t follow the same setup as your Team’s default SharePoint site. SharePoint synchronises the channel members and owners to the default SharePoint owners and members group. Owners of the team will also be added as site collection administrators.

But what about my Hub site, this site isn’t connected?

This is a modern Team site, so there’s nothing stopping you connecting this to your Hub site. I can understand why administrators might want SharePoint to determine that this site should also be connected to the Hub if the Team’s default site is but it doesn’t do that currently. You’re always welcome to voice your opinion on the Microsoft Teams or SharePoint user voice.

Third party backup solutions

If you’re using a third party backup tool, then you should keep an eye on sites that appear from the creation of private channels. Since these backup tools need to have permissions to the site to backup them up, you’ll need to check that the tool is successfully finding these sites and adding their permissions to access the site. I’m not completely sure of the process but my understanding is that channel permissions are synchronised either on a schedule or when a change to the private channel members occurs. It’s quite possible that the sync will remove any permissions that the third party tool has granted itself. I’m presuming that most backup providers are aware of how these private channels work and have ensured that they programmatically check their access every time they attempt a backup.

Summary

Private channels are an interesting problem architecturally and it’s interesting to see how Microsoft addressed this problem. It’s an understandable solution, since creating a folder in the default team site and having to apply unique permissions to a folder doesn’t seem like a good solution. As Microsoft Teams utilises SharePoint further, it’s worth checking out how this all works in SharePoint so you understand the governance implications for your SharePoint environment.