“Teams PowerShell: New-CsApplicationAccessPolicy fails with ‘You must call Connect-MicrosoftTeams’ despite successful connection”

Question

• Windows PowerShell 5.1 (PSVersion 5.1.22621.6133)

• MicrosoftTeams module versions: 7.6.0 (user scope) and 6.2.0 (global); 7.6.0 is imported.

• Connect-MicrosoftTeams succeeds and returns my account/tenant: Admin@[Moderator note: personal info removed], tenant [Moderator note: personal info removed].

• Immediately afterward, New-CsApplicationAccessPolicy fails with:

You must call the Connect-MicrosoftTeams cmdlet before calling any other cmdlets.

FullyQualifiedErrorId : System.UnauthorizedAccessException, Microsoft.Teams.ConfigApi.Cmdlets.NewCsApplicationAccessPolicy

• This is after clean reinstall of MicrosoftTeams 7.6.0 and multiple tests.

Please investigate why the ConfigAPI / application access policy cmdlets in my tenant are not recognizing the existing Teams connection.

Answer 1

Hi Admin EMI,

Thank you for posting your question in the Microsoft Q&A forum.

Please note that our forum is a public platform, and we will modify your question to hide your request IDs in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

It looks like Although Connect-MicrosoftTeams reports a successful sign-in, the subsequent error is being raised by the Teams Config API layer (Microsoft.Teams.ConfigApi.Cmdlets.NewCsApplicationAccessPolicy) and indicates that the session context required by those cmdlets is not being recognized. In order to narrow this down, please run a basic tenant-level cmdlet immediately after connecting (for example, Get-CsTenant). If Get-CsTenant (or other Teams cmdlets) fails with the same “run Connect-MicrosoftTeams” style error, then the problem is likely broader than New-CsApplicationAccessPolicy and may relate to the PowerShell module/session state rather than the specific policy cmdlet. In that case, given that multiple MicrosoftTeams module versions can coexist on a machine (as in your environment where different versions appear to be installed in different scopes), it is advisable to uninstall all installed MicrosoftTeams module versions and reinstall a single version, then retest; you may also compare behavior by installing a version prior to 7.6.0 or testing a newer preview build to determine whether the issue is version-specific.

However, this is a user-to-user support forum. Moderators, contributors, and external Microsoft employees participating here do not have access to backend systems or the ability to intervene directly in Microsoft product features. Our role is limited to offering technical guidance and sharing best practices based on reported issues, requests, or ideas.

In this situation, if Get-CsTenant and other Teams cmdlets execute successfully and only New-CsApplicationAccessPolicy continues to fail, you should submit a support ticket directly to Microsoft via Admin Center so the issue can be investigated by Microsoft Support for potential backend/Config API causes.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello Admin EMI,
Although Connect-MicrosoftTeams succeeds and returns your account and tenant, the ConfigAPI-backed cmdlets like New-CsApplicationAccessPolicy fail because the Teams PowerShell module is not properly establishing the required Config API session. This is not an authentication issue but a module and backend behavior problem. The most common cause is mixed MicrosoftTeams module versions (for example, 6.2.0 in AllUsers and 7.6.0 in CurrentUser), which leads to assembly conflicts where authentication binds to one version while ConfigAPI components partially resolve against another, resulting in an UnauthorizedAccessException.
Running on Windows PowerShell 5.1 further increases the likelihood due to older .NET and stricter assembly binding. The recommended fix is to completely remove all MicrosoftTeams module versions from both scopes, reinstall a single version (AllUsers only), and run everything in PowerShell 7, then initialize ConfigAPI with a read-only Cs cmdlet before creating policies. If the issue persists after a clean setup, it is likely tenant-side (such as missing PolicyAdmin consent, legacy tenant configuration, or backend policy service issues).
Reference Document-https://learn.microsoft.com/en-us/powershell/module/microsoftteams/connect-microsoftteams?view=teams-ps