PowerShell MicrosoftTeams and Access Denied on policy package

Question

PowerShell MicrosoftTeams and Access Denied on policy package

jelloland 51

I have a PowerShell script that uses the MicrosoftTeams module (5.1.0) in order to run Grant-CsUserPolicyPackage on certain new users based on criteria. This script authenticates with a certificate via an app registration.

When running that command, however, I just get Access Denied errors.

What permission do I need to run this command? I added Policy.ReadWrite.* to its API permissions and its service principal is a member of the Teams Administrators role, but I still can't get it it to go through without the access denied error.

Accepted answer

0 additional answers

Your answer

Answer 1

Anonymous

Hi @jelloland

According to the documentation, when assigning API permissions to an application, for *-Cs cmdlets - the Microsoft Graph API permission needed is .Organization.Read.All

**
User's image

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

jelloland 51 Reputation points

2023-07-05T16:45:07.13+00:00

<accidental duplicate>

jelloland 51

Thanks LiweiTian,

I verified I had Organization.Read.All but I tried adding Organization.ReadWrite.All but still getting access denied.

I then tried adding in all the other permissions I could see from your screenshot/link. Since my script also uses the Microsoft.Graph module (Connect-MgGraph), I paused the script while debugging and verified the scopes:

(Get-MgContext).Scopes | Sort
AppCatalog.ReadWrite.All
Channel.Delete.All
ChannelMember.ReadWrite.All
ChannelSettings.ReadWrite.All
IdentityRiskEvent.Read.All
IdentityRiskyUser.Read.All
Organization.ReadWrite.All
Policy.ReadWrite.AccessReview
Policy.ReadWrite.ApplicationConfiguration
Policy.ReadWrite.AuthenticationFlows     
Policy.ReadWrite.AuthenticationMethod
Policy.ReadWrite.Authorization
Policy.ReadWrite.ConditionalAccess
Policy.ReadWrite.ConsentRequest
Policy.ReadWrite.CrossTenantAccess
Policy.ReadWrite.ExternalIdentities
Policy.ReadWrite.FeatureRollout
Policy.ReadWrite.PermissionGrant
Policy.ReadWrite.SecurityDefaults
Policy.ReadWrite.TrustFramework
TeamSettings.ReadWrite.All
User.Read.All
User.ReadWrite.All

I assume the scopes will be the same for Connect-MicrosoftTeams but I'm not sure how to verify that. Any other thoughts of what's going on here?

Anonymous

2023-07-06T09:16:41.09+00:00

Hi @jelloland

Please make sure you have administrator permissions and .Organization.Read.All permissions, which may take 24 hours to take effect.

If the problem persists, please upgrade your administrator rights from Teams administrator to global administrator.
jelloland 51 Reputation points

2023-07-06T17:35:19.52+00:00
As you can see in the previous post, it has Organization.ReadWrite.All permissions. Isn't that a superset of Organization.Read.All or do I need both?

I might be blind but I cannot figure out a [simple] way to get a list of all my app's roles in AAD. If I'm in the AAD portal -> Enterprise Applications -> MyApp -> Roles and Administrators, it only lists Cloud Application Administrator and Reports Reader. And there is no way that I can see to add it to other roles from here.

However, if I do the reverse and go to AAD -> Roles and Admins -> Teams Administrator, I can see MyApp in there (Type: service principal). Same thing when repeated for Global Administrator.

And here's what I get when I do it using Microsoft.Graph:

$AppId = "{my-app-id-here}" $SPN = Get-MgServicePrincipal -Filter "appId eq '$AppId'" $BaseUrl = "https://graph.microsoft.com/v1.0" $UrlId = "{0}/servicePrincipals/{1}/memberOf" -f $BaseUrl, $SPN.Id (Invoke-MgGraphRequest -Method Get $UrlId).Value.DisplayName Global Administrator Teams Administrator

Side-note: I could not get Get-MgServicePrincipalMemberOf to work for whatever reason but invoking the API with Invoke-MgGraphRequest did...

Anyway, to hopefully address the last part of your post: my application is and was already a member of both Global Administrators and Team Administrators but I still get access denied (I just retried it also).
Anonymous

2023-07-07T07:29:53.3+00:00

Hi @jelloland

Please try other commands in PowerShell to see if the same error occurs.

You can also try if you can assign a group policy to the user in the Teams admin center.
jelloland 51 Reputation points

2023-07-07T23:30:19.01+00:00
I can use:

Get-CsTeamsMeetingPolicy Get-CsTeamsAppSetupPolicy Get-CsTeamsAudioConferencingPolicy Get-CsTeamsCallHoldPolicy Get-CsTeamsEventsPolicy Get-CsTeamsUpdateManagementPolicy Get-CsUserPolicyAssignment

I could not use:

Get-CsUserPolicyPackage

I tried Connect-MicrosoftTeams as myself and I was able to use that command. But I don't see myself in any other special roles besides maybe Intune Administrator. Hmm, well I'll try and look back into this on Tuesday.
Anonymous

2023-07-11T01:29:16.9166667+00:00

Hi @jelloland

If you can run other commands, it is possible that PowerShell does not currently support PolicyPackage commands.

Please try assigning policy packages to members in Teams admin center.
jelloland 51 Reputation points

2023-07-11T14:08:52.0933333+00:00

That's unfortunate. I can assign them when using my own account but the whole point was to automate this with a script that uses app authentication so that I don't have to. Hopefully future versions will enable that.
Anonymous

2023-07-12T00:56:19.88+00:00

Hi @jelloland

To get this feature more quickly, you can send a feedback directly to Microsoft to add it in future updates.

Many features of our current products are designed and upgraded based on customers’ feedback. With requirements like this increase, the problem may well be released in the future.

Thanks for your understanding and support.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

PowerShell MicrosoftTeams and Access Denied on policy package

0 additional answers

Your answer