Microsoft Teams - Assign Teams Policies to Users with Powershell

Policies can be created within Microsoft Teams to manage permissions and restrictions on sets of users. In a school environment for example, you may wish to prevent the ability of students to call other users directly, but allow it for staff.

There are four (4) different types of policies that can be configured/applied to users in Teams;

1. Calling Policies
2. Meeting Policies
3. Channels Policies
4. Messaging Policies

The policies can be created/configured within the Teams web admin interface.

Calling Policies are configured under Voice > Calling Policies

Meeting Policies are configured under Meetings > Meeting Policies

Channels Policies are configured under Teams > Teams Policies

Messaging Policies are configured under Messaging Policies

Once they're created and configured, they can be applied to users via powershell which can be quicker than doing it manually via the web admin interface - especially if you need to apply it to a large batch of users.

The cmdlet we'll be using for this is New-CsBatchPolicyAssignmentOperation

Be sure to update the PolicyName and Identity arguments to match your policy and user

Apply Teams Calling Policy to Users

New-CSBatchPolicyAssignmentOperation -PolicyType TeamsCallingPolicy -PolicyName "Name" -identity "user@domain.com"

Apply Teams Meeting Policy to Users

New-CSBatchPolicyAssignmentOperation -PolicyType TeamsMeetingPolicy -PolicyName "Name" -identity "user@domain.com"

Apply Teams Channel Policy to Users

New-CSBatchPolicyAssignmentOperation -PolicyType TeamsChannelsPolicy -PolicyName "Name" -identity "user@domain.com"

Apply teams Messaging Policy to Users

New-CSBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "Name" -identity "user@domain.com"

Checking

You can then check what policies are applied to a user by using the cmdlet below

Get-CsUserPolicyAssignment -identity "user@domain.com" 

This command will return a table displaying all the different policies that are applied to the user specified

Microsoft Teams - Add Additional Team Owner using Powershell

When a user is added to a Microsoft Team, they are added as either a "member" or an "owner". Adding them as an "owner" gives them additional privileges/rights within the team - such as being able to add other members, delete chat messages etc.

If you add a user to a team using the "add-teamuser" powershell cmdlet, it will by default add them as a member. You can use a switch within the command to add them as an owner instead.

Here's an example;

add-teamuser -groupid "abc123" -user "user@domain.com" -role owner

As you can see, the "-role owner" switch is what adds them as an owner to the team, instead of adding them as a member.

If the "-role" switch isn't specified, the user will be added as a member by default. You can alternatively include the "-role" switch and specify "member" as well - like the example below

add-teamuser -groupid "abc123" -user "user@domain.com" -role member

This could be useful if you're using some kind of loop and want to add some users as members and some as owners and have the owner/member specified in a variable.

Microsoft Teams - Copy Users Team Memberships to Another User

Microsoft Teams doesn't have any easy facility to export all the teams a particular user is a member of which can be useful if you want to copy the team memberships from one user to another.

Thankfully there is a way to do it though - since Microsoft Teams are actually O365 groups behind the scenes, we can utilise some O365 powershell cmdlet magic to accomplish this.

First, we need to connect to our O365 environment then import the session so we can access the cmdlets

$ex = New-PSSession -ConfigurationName Microsoft.Exchange -Credential user@domain.com -ConnectionUri https://outlook.office365.com/powershell -Authentication basic -AllowRedirection

import-pssession $ex

Next, let's get a list of all groups of the user we want to copy from - ie. the source user (be sure to adjust the source user variable to use your own target users email address)

$sourceuser = "user1@domain.com"

$Office365GroupsMember = Get-UnifiedGroup | where { (Get-UnifiedGroupLinks $_.Alias -LinkType Members | foreach {$_.primarysmtpaddress}) -contains $sourceuser}

You can then look at the $Office365GroupsMember variable to see a list of all the O365 groups that the source user is a member of

If you have a mixture of O365 groups AND MSTeams and want to isolate the MS Teams - you can filter the results further by using the command beloww

$o365teamsgroups = $office365GroupsMember | where {$_.serviceendpointuris -like "*MicrosoftTeams*"}

Now that we have our list of Teams, we can go through the list and add our target user to each team. But to do this we need the unique Group ID for each team which is included in the script below. Be sure to update the $targetuser variable with the email address of the user you wish to add to the groups.

Connect-MicrosoftTeams

$targetuser = "user2@domain.com"

foreach ($o365team in $o365teamgroups)

    {

    $teamprops = get-team -displayname $($o365team.displayname)

    write-host "Adding $targetuser to $($teamprops.displayname) team"

    add-teamuser -groupid $($teamprops) -user $targetuser

    }

Microsoft Teams - Powershell Administration Commands

 Microsoft Teams has a powershell module available that allows you to perform just about all Teams management tasks using a script. This is very convenient for bulk operations, like creating lots of teams and keeping team memberships up to date - especially since the Teams web admin interface can be quite slow and cumbersome.

Here's a quick guide on some of the most common commands and uses

Install Microsoft Teams Powershell Module

Use the command below to install the Microsoft Teams powershell cmdlets

install-module -name MicrosoftTeams -force

Create a Team

I like to create new teams by using a variable ($newteam) - this makes additional tasks easier since you can reference the unique group ID for the new team directly from the $newteam variable.

$newteam = new-team -displayname "Test Team" -mailnickname "Test-Team" -owner "user@domain.com"

Update the properties for the display name, mailnickname (can't have spaces) and the team owner

Add a User/Member to a Team

If you've created the team like I have above and used a variable like $newteam, you can then use the properties for this variable for other tasks like this

add-teamuser -groupid $newteam.groupid -user "user@domain.com"

Add an additional Owner to a Team

add-teamuser -groupid $newteam.groupid -user "user@domain.com" -role owner

Remove User/Member from a Team

remove-teamuser -groupid $newteam.groupid -user "user@domain.com"

Active Directory User Account Audit including Status with Powershell

Here is a script I have created that searches for all users within an Active Directory domain and provides a report (.csv file) showing all account names and their status. The status is determined from the useraccountcontrol property contained within each account.

The useraccountcontrol property is stored as a number/integer - the most common numbers/values I've translated to their meanings as part of this script - eg. Enabled, Disabled, Password Expired etc.

You only need to change the value for $outfile variable if required - the script should work in it's current form on any windows/active directory domain

$report = @()
$outfile = "C:\temp\UserAudit.csv"

$searcher = New-Object DirectoryServices.DirectorySearcher 
$searcher.filter = "(&(objectCategory=person)(objectClass=user))"

$userlist =  $searcher.FindAll()

foreach ($user in $userlist)
    {
    $name = $($user.properties.displayname)
    $dn = $($user.properties.distinguishedname)
    $status = $($user.properties.useraccountcontrol)
        if ($status -eq "66050"){$status = "Disabled, password never expires"}
        elseif ($status -eq "66048"){$status = "Enabled, password never expires"}
        elseif ($status -eq "512"){$status = "Enabled Account"}
        elseif ($status -eq "514"){$status = "Disabled Account"}
        elseif ($status -eq "66080"){$status = "Enabled, password never expires, user cannot change password"}
    
    $report += new-object psobject -property @{Name=$name;DN=$dn;Status=$status}
    }
    
$report | select Name, Status, DN | export-csv -path $outfile -notype

The script could be further customized to include other values/properties from the account as required. In it's current form it includes the users display name, distinguished name and status.

How to easily view/find the distinguished name for an Active Directory user account

The distinguished name for a user account is often required for scripting or other management/administrative tasks when working with Active Directory. It represents the unique identifier for every user account so is one of the best ways to work with user accounts (as opposed to just working off first name, last name etc).

They are difficult to remember, and nearly impossible to type using the correct format/syntax - so here's some simple instructions on how to quickly/easily obtain the distinguished name for a user account from Active Directory Users & Computers;

1. Open Active Directory Users & Computers
2. Ensure "Advanced Features" are enabled (go to View > Advanced Features)
3. Open the Active Directroy User object you wish to view the DN for
4. Select the Attribute Editor tab
5. Scroll down to the locate the Distinguished Name value
6. You can double click the entry then copy it to the clipboard from the "Value" field as per the screenshot below