Policy Enforcer

Policy Enforcer watches the Microsoft 365 groups and Teams that Teams Manager governs, detects changes that break your governance policies, and resolves them automatically or routes them to a reviewer in Microsoft Teams. It reads change events from the Microsoft Entra directory audit log through Microsoft Graph, compares them with the policies defined in Teams Manager, and — only where an administrator has configured an automatic resolution — restores the last known-good value in the customer’s tenant. All processing runs in Solutions2Share-operated Azure services in the EU.

Data Management Practices

All data is processed on behalf of the customer’s tenant and is isolated per tenant (see Architecture And Flow Diagram). Policy Enforcer is an add-on to Teams Manager: it reads policy definitions and governed spaces from Teams Manager read-only and never writes to Teams Manager. All Policy Enforcer services and data stores are hosted in Microsoft Azure data centres operated by Solutions2Share in the Germany West Central (EU) region. Sign-in, Microsoft Graph and the Azure Bot Service that delivers Teams messages are Microsoft 365 / Azure global services.

Policy Enforcer does not read chat or channel message content, e-mail, or document content.

The application accesses, processes and stores the following data types:

Governance configuration

Policy definitions and governed spaces (Microsoft 365 group ID, display name, template name and Teams Manager metadata values) read from the customer’s Teams Manager instance, plus the list of Teams Manager administrators (object ID, UPN or e-mail address) used to decide who may administer Policy Enforcer. Storage & retention: stored in Azure SQL Database as a snapshot that is refreshed every 30 minutes; retained for the duration of the subscription.

Group change events and violations

Group-management events from the directory audit log for governed spaces only: the changed property (team name, visibility, sensitivity label, owners, members), its old and new value, and the actor who made the change (UPN, or application name for app-made changes). A detected policy violation is stored together with its resolution state, the reviewer who resolved it (object ID) and an optional reviewer comment. Storage & retention: stored in Azure SQL Database for the duration of the subscription.

Known-good baselines

The last compliant value of each monitored property per governed space (for example the approved team name or sensitivity label), used to restore the value after a violation. Storage & retention: stored in Azure SQL Database for the duration of the subscription.

Planner and OneNote names

The titles of Planner plans and the names of OneNote notebooks that belong to governed groups. Plan tasks and notebook pages are not read. Storage & retention: only the changed names are stored, as part of a violation (see above).

Directory profile data (read on demand)

Display name, e-mail address, UPN and profile photo of users, and the owners and members of governed groups — read on demand to show names in the app and in notifications and to determine who must review a violation. Storage & retention: not stored; profile photos are cached in memory for at most one hour.

Microsoft Teams notification data

To send adaptive-card notifications, Policy Enforcer stores the Teams conversation reference of the Policy Enforcer bot for each recipient and a delivery record per card (recipient object ID, Teams message ID, delivery status). Storage & retention: stored in Azure SQL Database for the duration of the subscription.

Tenant and service-account data

Tenant ID and name, tenant settings and, if connected, the object ID of the service account used for delegated operations (see Microsoft Graph). The service account’s refresh token is encrypted at application level with AES-256-GCM, bound to the tenant ID; the encryption key is held in Azure Key Vault. Storage & retention: stored in Azure SQL Database for the duration of the subscription.

Diagnostic telemetry

Requests, dependency calls and errors from the web UI, API and background workers are sent to Azure Application Insights / Log Analytics in the same region. In the API and web UI telemetry, e-mail addresses, object IDs and authorization headers are redacted before they leave the process. Extended diagnostic logging of Microsoft Graph request and response bodies (capped at 16 KB, without authorization headers) is off by default and only enabled per tenant for troubleshooting. Storage & retention: 30 days.

Change detection is forward-only. Policy Enforcer starts evaluating changes from the moment a tenant is onboarded; it does not scan or report historical changes that happened before onboarding.

Microsoft Graph

Policy Enforcer uses one multi-tenant Microsoft Entra app registration. A tenant administrator grants admin consent once during onboarding. Detection and most resolutions run in the background with application permissions. A small number of operations that Microsoft Graph does not support with application permissions (changing a group’s sensitivity label, renaming a Planner plan, reading and renaming OneNote notebooks) run with delegated permissions of a dedicated service account that a tenant administrator connects during setup. Apart from installing its own Teams app for a reviewer who needs to receive a notification, Policy Enforcer only writes to the tenant to restore a governed group to its last known-good state after a policy violation — it never deletes groups, Teams, users, files or content. Scope names are the Microsoft Graph permission names, as shown on the consent screen, and are rendered as code.

Full descriptions of each permission are published in the Microsoft Graph permissions reference.

SharePoint / other workload permissions

Not applicable. Policy Enforcer accesses Microsoft 365 exclusively through Microsoft Graph. It does not use the SharePoint REST API, Exchange Online, the Office 365 Management API or any other workload API, and requests no permissions for them.

Microsoft Teams Apps Security And Compliance

Policy Enforcer is delivered as a Microsoft Teams app with a personal tab (the web UI) and a personal bot that sends adaptive-card notifications. The app manifest requests only the identity and messageTeamMembers device permissions, declares no resource-specific consent (RSC) permissions, no message extensions and no team or group-chat scopes, and lists only the Policy Enforcer host as a valid domain. Users sign in with Teams single sign-on.

The bot sends:

• Violation notifications — a 1:1 adaptive card to the owners of the affected group and/or the Policy Enforcer administrators, with a button that opens the review dialog. The card is updated in place when the violation is resolved or dismissed.
• Resolution notices — after selected violations are resolved, a notice to the affected team’s General channel, posted by the bot through the Teams channel, not through a Microsoft Graph write.
• Replies — a welcome message on installation and short help/status replies when a user writes to the bot.

The bot reads the text of messages sent to it only to recognise these commands; message text is not stored.

Architecture And Flow Diagram

Data flow: (1) a user opens the Policy Enforcer app in Microsoft Teams, which loads the web UI from App Service and calls its API; (2) the user is signed in with Teams single sign-on and every API request carries a Microsoft Entra token that the API validates (signature, issuer, audience, tenant); (3) every 30 minutes the policy definitions and governed spaces are synchronised read-only from Teams Manager, using a read-only database account whose access is restricted to the Policy Enforcer service’s network addresses; (4) every 10 minutes the Function App reads new group-management events from the directory audit log through Microsoft Graph, evaluates them against the policies over Service Bus queues, stores detected violations in Azure SQL and — where the administrator has chosen automatic resolution — restores the last known-good value through Microsoft Graph, after first checking that the value has not changed again in the meantime; (5) Policy Enforcer sends or updates an adaptive card through the Azure Bot Service, and the reviewer accepts a resolution or dismisses the violation in the review dialog. All compute emits telemetry to Application Insights and Log Analytics.

Policy Enforcer uses three deliberately separated authentication flows on one multi-tenant Microsoft Entra app registration:

1. Sign-in (delegated). Users sign in with their Microsoft work account through Teams single sign-on. The API accepts only tokens issued for the Policy Enforcer app and derives the tenant from the validated token.
2. Background processing (application). After admin consent, background workers obtain application tokens for the customer’s tenant. The app credential is stored in Azure Key Vault and is never sent to the browser; the browser never receives a Microsoft Graph token.
3. Service account (delegated, optional). For the few operations listed under Microsoft Graph, a tenant administrator connects a dedicated service account. Its refresh token is encrypted with AES-256-GCM and bound to the tenant; tokens are requested per operation with the minimum scope needed.

Per-tenant isolation is enforced by the tenant identifier carried in every token: each request is scoped to the tenant of its validated token, every tenant-owned record carries that tenant identifier, and Graph tokens are issued per tenant. Within a tenant, access is role-based: only Teams Manager administrators can configure Policy Enforcer, and group owners can review violations of the spaces they own when this is enabled. All secrets are held in Azure Key Vault and read by the services through their system-assigned managed identities; all endpoints are HTTPS-only and the database connection is encrypted.

Resource Endpoints

Domains that a customer’s network or browser must be able to reach.

Backend service egress (informational)

Outbound calls made by the Solutions2Share-operated backend. These are not customer-configurable and are listed for transparency.

Dependencies

Third-party libraries used by Policy Enforcer. Versions reflect the current release.

Server

Client Packages

Build and test tooling

Used only to build and test the app; not shipped to the browser or deployed to the server.

Policy Enforcer uses no third-party analytics or advertising trackers. The Policy Enforcer back end sends customer data only to Microsoft/Azure services and the Solutions2Share License Management Center.