How To Undo Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false

Question

How To Undo Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false

BearsBeetsBattlestar 0

This appears to be a tenant wide command and no global admin account seems to be capable of undoing it with Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $true. They all get access denied as one once expect given the $false setting, but we do need to undo this.

risolis 8,741 Reputation points

2023-06-20T05:17:58.8866667+00:00

Hello @BearsBeetsBattlestar

Thank you for posting this concern on this community.

I would like to share the following article down below:

https://learn.microsoft.com/en-us/powershell/module/msonline/set-msolcompanysettings?view=azureadps-1.0

See this image:

I hope that can be useful for you.

Looking forward to hearing from you

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
BearsBeetsBattlestar 0 Reputation points

2023-06-20T14:20:07.85+00:00

Thanks for your response, but this didn't help. The issue is, we cannot undo Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false. If we issue Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $true, we get access denied. No GA can undo this command. If you have access to a lab environment, you can confirm this. Issue the command, Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false, you will then find that all msol commands are denied and no admin can reverse this for the tenant.
risolis 8,741 Reputation points

2023-06-21T03:23:55.6133333+00:00

Hello @BearsBeetsBattlestar

Many thanks for your response.

Read this below:

https://learn.microsoft.com/en-us/answers/questions/625265/how-to-restrict-access-to-azure-ad-administration

Cheers!
BearsBeetsBattlestar 0 Reputation points

2023-06-21T14:34:21.31+00:00

That article describes the reasoning behind why we did the command, but offers no solution on how to reverse it.
risolis 8,741 Reputation points

2023-06-22T06:58:47.5733333+00:00

May I please have the following output from PS terminal?

Get-MsolCompanyInformation | Select UsersPermissionToReadOtherUsersEnabled

Get-MsolCompanyInformation

Regards!
BearsBeetsBattlestar 0 Reputation points

2023-06-22T14:21:55.6466667+00:00

Access denied
BearsBeetsBattlestar 0 Reputation points

2023-06-22T14:22:20.7133333+00:00

Access denied
risolis 8,741 Reputation points

2023-06-22T21:04:54.59+00:00

Thanks!

Let me review it and get back to you shortly.

Regards!
Marilee Turscak-MSFT 37,196 Reputation points Microsoft Employee Moderator

2023-06-23T17:41:23.3466667+00:00

Hi @BearsBeetsBattlestar ,

Thank you for confirming that you were able to resolve the issue. If the answer provided by @risolis helped you, please remember to Accept It so that others in the community facing similar issues can more easily locate a solution.

Otherwise let us know if you have further questions!
LoudCloudDragon_caseyDB 191 Reputation points

2024-11-02T00:58:59.97+00:00

Guys stop being stupid! Its not going to block their access to Azure AD powershell and all those articles telling you it a security concern are retarded. How to you think in Teams, or outlook; that you are able to see who is active, what is the name of people you are chatting with (teams).

If you turn this to false you will be very VERY sorry. Because any and all and I mean ALL collaboration and communication between users WILL FAIL! How long, depends on the auth token, could take a few days, could take up to 90... you've been warned.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

4 answers

Your answer

risolis 8,741 Reputation points

2023-06-20T05:17:58.8866667+00:00

Hello @BearsBeetsBattlestar

Thank you for posting this concern on this community.

I would like to share the following article down below:

https://learn.microsoft.com/en-us/powershell/module/msonline/set-msolcompanysettings?view=azureadps-1.0

See this image:

I hope that can be useful for you.

Looking forward to hearing from you

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
BearsBeetsBattlestar 0 Reputation points

2023-06-20T14:20:07.85+00:00

Thanks for your response, but this didn't help. The issue is, we cannot undo Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false. If we issue Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $true, we get access denied. No GA can undo this command. If you have access to a lab environment, you can confirm this. Issue the command, Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false, you will then find that all msol commands are denied and no admin can reverse this for the tenant.
risolis 8,741 Reputation points

2023-06-21T03:23:55.6133333+00:00

Hello @BearsBeetsBattlestar

Many thanks for your response.

Read this below:

https://learn.microsoft.com/en-us/answers/questions/625265/how-to-restrict-access-to-azure-ad-administration

Cheers!
BearsBeetsBattlestar 0 Reputation points

2023-06-21T14:34:21.31+00:00

That article describes the reasoning behind why we did the command, but offers no solution on how to reverse it.
risolis 8,741 Reputation points

2023-06-22T06:58:47.5733333+00:00

May I please have the following output from PS terminal?

Get-MsolCompanyInformation | Select UsersPermissionToReadOtherUsersEnabled

Get-MsolCompanyInformation

Regards!
BearsBeetsBattlestar 0 Reputation points

2023-06-22T14:21:55.6466667+00:00

Access denied
BearsBeetsBattlestar 0 Reputation points

2023-06-22T14:22:20.7133333+00:00

Access denied
risolis 8,741 Reputation points

2023-06-22T21:04:54.59+00:00

Thanks!

Let me review it and get back to you shortly.

Regards!
Marilee Turscak-MSFT 37,196 Reputation points Microsoft Employee Moderator

2023-06-23T17:41:23.3466667+00:00

Hi @BearsBeetsBattlestar ,

Thank you for confirming that you were able to resolve the issue. If the answer provided by @risolis helped you, please remember to Accept It so that others in the community facing similar issues can more easily locate a solution.

Otherwise let us know if you have further questions!
LoudCloudDragon_caseyDB 191 Reputation points

2024-11-02T00:58:59.97+00:00

Guys stop being stupid! Its not going to block their access to Azure AD powershell and all those articles telling you it a security concern are retarded. How to you think in Teams, or outlook; that you are able to see who is active, what is the name of people you are chatting with (teams).

If you turn this to false you will be very VERY sorry. Because any and all and I mean ALL collaboration and communication between users WILL FAIL! How long, depends on the auth token, could take a few days, could take up to 90... you've been warned.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

risolis 8,741

Many thanks for holding me on this.

I would like to ask you if it is possible to check as well as adjust the following settings at the portal level and give it another try please.

See it below:

User's image

Looking forward to your feedback.

Regards!

BearsBeetsBattlestar 0 Reputation points

2023-06-23T01:18:29.7133333+00:00

thanks for sticking with this. settings match up to screen shot, but I still get access denied on any msol command
risolis 8,741 Reputation points

2023-06-23T01:58:16.2+00:00

Hi

I just made the lab replication.
risolis 8,741 Reputation points

2023-06-23T02:00:20.5533333+00:00

Now see this:
risolis 8,741 Reputation points

2023-06-23T02:01:31.4866667+00:00

Before those 2 pictures I got the same error as shown below:
BearsBeetsBattlestar 0 Reputation points

2023-06-23T02:17:33.68+00:00

sorry but when i run the get-msolrolemember command i get access denied. i also get access denied for set-msolcompany settings. this is true for each GA account

Answer 2

risolis 8,741

Hello @BearsBeetsBattlestar

There you have the fix for your problem.

I hope that can be useful for you.

Looking forward to hearing from you

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

BearsBeetsBattlestar 0 Reputation points

2023-06-23T02:18:59.85+00:00

sorry but when i run the get-msolrolemember command you showed i get access denied. same goes for set-msolcompanysetting. access denied. that's for all GA accounts in our tenant
BearsBeetsBattlestar 0 Reputation points

2023-06-23T02:19:42.2066667+00:00

sorry but when i run the get-msolrolemember command you showed i get access denied. same goes for set-msolcompanysetting. access denied. that's for all GA accounts in our tenant
risolis 8,741 Reputation points

2023-06-23T02:35:49.87+00:00

Are you using the Owner account for the same?
BearsBeetsBattlestar 0 Reputation points

2023-06-23T02:37:28.02+00:00

yes i am using owner acct
risolis 8,741 Reputation points

2023-06-23T02:42:46.1433333+00:00

is there any way to get into a remote session? If it is ok
risolis 8,741 Reputation points

2023-06-23T02:54:32.4+00:00

Just in case you want to check the release version used.
BearsBeetsBattlestar 0 Reputation points

2023-06-23T16:42:54.57+00:00

Thanks for all the help you provided, I have fixed the issue.

From powershell I installed aadinternals module and imported it. Then I used Get-AADIntAccessTokenForMSGraph -SaveToCache. Then I used Enable-AADIntTenantMsolAccess

This fixed the issue. You really helped me out by testing in your lab environment.
risolis 8,741 Reputation points

2023-06-23T22:04:23.8266667+00:00

Great job!

I am happy to know this, and I would like to thank you for letting me assist you as well.

Cheers!

Answer 3

Hello @BearsBeetsBattlestar and thanks for sharing your workaround. As a general rule we suggest to move to Microsoft Graph PowerShell SDK as a replacement for MSOnline since the latter has entered deprecation phase. Also, setting UsersPermissionToReadOtherUsersEnabled to false should only affect standard but not admin users. The error mesage and workaround signals access to the MSOnline module was disabled. Enable-AADIntTenantMsolAccess turned it on again calling the Update authorizationPolicy endpoint.

To retrieve the authorization policy

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgPolicyAuthorizationPolicy

To disable users reading other users profiles:

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToReadOtherUsers = $false}

To re-enable MSOnline PowerShell module:

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
Update-MgPolicyAuthorizationPolicy -BlockMsolPowerShell $false

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

Answer 4

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

How To Undo Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false

4 answers

To retrieve the authorization policy

To disable users reading other users profiles:

To re-enable MSOnline PowerShell module:

Your answer