New-CsApplicationAccessPolicy

Question

Hi All,

I have a requirement to create a Teams Application Access Policy and apply it to a specific group of users.I have created a mail-enabled security group in on-premises Active Directory, which is synchronized with Microsoft Entra ID.

I would like to confirm whether the following PowerShell commands are correct for creating the application access policy and assigning it to the synchronized group.

New-CsApplicationAccessPolicy -Identity "TeamsPolicy1" -AppIds "<app-client-id>" -Description "Meeting access for a group"

Grant-CsApplicationAccessPolicy -PolicyName "TeamsPolicy1" -Group "<group-object-id>"

Could someone please clarify the following?

Does Grant-CsApplicationAccessPolicy support group-based policy assignment using the -Group parameter?

Can I use a mail-enabled security group created in on-premises Active Directory and synchronized with Microsoft Entra ID for this purpose?

Is a standard AD security group sufficient, or does the group need to be mail-enabled?

Are there any additional prerequisites or limitations for applying this policy to an Entra ID-synchronized group?

Answer 1

Hi @Glenn Maxwell,

Yes. The current Grant-CsApplicationAccessPolicy cmdlet includes a GrantToGroup parameter set, so an application access policy can be assigned to a group by using -Group. The -Rank parameter is optional.

Connect-MicrosoftTeams
New-CsApplicationAccessPolicy `
    -Identity "TeamsPolicy1" `
    -AppIds "<app-client-id>" `
    -Description "Meeting access for a group"
Grant-CsApplicationAccessPolicy `
    -PolicyName "TeamsPolicy1" `
    -Group "<group-object-id>"

Can an on-premises group synchronized to Microsoft Entra ID be used?

Microsoft supports group policy assignment to Microsoft 365 groups, security groups, and distribution lists. The documentation does not identify synchronized groups as a separate unsupported category. Therefore, provided that the group has synchronized successfully and exists as a group object in Microsoft Entra ID, you should be able to use its Microsoft Entra object ID with -Group. Using the object ID also avoids ambiguity when identifying the synchronized group. For your reference: Assign policies to users and groups.

Does the security group need to be mail-enabled?

No. A security group does not need to be mail-enabled solely for Teams group policy assignment. Microsoft lists security groups and distribution lists as separate supported group types.

Are there additional prerequisites or limitations?

• Only direct members of the group receive the inherited policy. Membership through a nested group is not processed.
• Groups with HiddenGroupMembership enabled cannot be used for group policy assignment.
• A policy assigned directly to a user takes precedence over a policy inherited from a group.
• If a user belongs to multiple groups with assignments of the same policy type, the assignment with the lowest rank number has the highest priority. If -Rank is omitted, the assignment receives the lowest priority.
• The assignment is applied to the group immediately, but propagation to individual members is a background operation and can take some time.

The application must also have an applicable Microsoft Graph application permission and the required administrator consent. The application access policy controls which users the application can act on behalf of; it does not replace the required Microsoft Graph permission. Microsoft notes that policy changes can take up to 30 minutes to affect Microsoft Graph REST API calls. See Configure application access to online meetings or virtual events.

In summary, your synchronized mail-enabled security group should be usable after it has synchronized successfully to Microsoft Entra ID and can be resolved by Teams PowerShell. Mail enablement is not required, and using the group’s Microsoft Entra object ID is the clearest way to target it.

Thank you for taking the time. If you have any further questions or would like to discuss anything else, feel free to reply anytime, and I'll be happy to assist.

---

If the answer is helpful, please kindly click "Yes" button below. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 2

Your commands are valid: Grant-CsApplicationAccessPolicy supports -Group, and an on-premises security group synchronized to Microsoft Entra ID can be used without being mail-enabled, provided Teams can resolve the synchronized group and the targeted users are direct members.

Create and assign the policy

Connect to Teams PowerShell, create the policy, and pass the synchronized group’s Microsoft Entra object ID to -Group:

Connect-MicrosoftTeams

New-CsApplicationAccessPolicy `
    -Identity "TeamsPolicy1" `
    -AppIds "<app-client-id>" `
    -Description "Meeting access for a group"

Grant-CsApplicationAccessPolicy `
    -PolicyName "TeamsPolicy1" `
    -Group "<group-object-id>" `
    -Rank 1

New-CsApplicationAccessPolicy accepts one or more application client IDs, while Grant-CsApplicationAccessPolicy has a dedicated GrantToGroup parameter set with -Group, -PolicyName, and optional -Rank. The group object ID is the least ambiguous identifier to use.^1^^2^

-Rank controls precedence when a user belongs to multiple groups assigned different policies of the same type. If omitted, the assignment receives the lowest rank; rank 1 is the highest group rank. A policy assigned directly to a user takes precedence over every group assignment.^3^

Group requirements

• Mail-enabled security group: Supported, including a group synchronized from on-premises AD.
• Standard security group: Also supported; mail enablement is not required for Teams group policy assignment.
• Microsoft 365 group or distribution list: The general Teams group-policy framework supports these as well.^3^
• Nested membership: Not expanded. Only users who are direct members of the assigned group receive the policy.
• Synchronization: The group and its relevant membership must be present in Microsoft Entra ID before assignment. Use the group’s Entra object ID, not its on-premises AD objectGUID.
• Dynamic membership: The supplied official Teams references do not establish a special restriction on dynamic Entra security groups. Avoid applying Exchange Online ApplicationAccessPolicy recipient restrictions to this Teams policy; these are separate policy systems.

Mail enablement is therefore optional for this Teams command. It would be required for certain Exchange Online application access policies, but those use New-ApplicationAccessPolicy, not New-CsApplicationAccessPolicy.^4^

Verify the assignment

Check that the policy and group assignment exist:

Get-CsApplicationAccessPolicy

Get-CsGroupPolicyAssignment `
    -PolicyType ApplicationAccessPolicy

These commands list the policy and its group-policy ranking.^5^

For a direct group member, inspect the effective assignment rather than relying on Get-CsOnlineUser, because that cmdlet only exposes direct assignments:

Get-CsUserPolicyAssignment `
    -Identity "<user-object-id>" `
    -PolicyType ApplicationAccessPolicy

Get-CsUserPolicyAssignment returns policies inherited from groups as well as policies assigned directly.^6^

Prerequisites and limitations

• Use an account authorized to administer Teams policy configuration and connect through the Microsoft Teams PowerShell module.
• The application must have the required Microsoft Graph application permission for the cloud communications operation. Supported examples include OnlineMeetings.Read.All, OnlineMeetings.ReadWrite.All, and the listed meeting-artifact or virtual-event application permissions.^7^
• Only one application access policy can be effective for a user; a direct user assignment overrides group assignments.^2^
• A policy type can be assigned to at most 64 groups.
• The recommended maximum is 50,000 members per group.
• Large-group assignment or membership changes can take 24 hours or more to propagate. Application access policy changes can then take up to 30 minutes to affect Microsoft Graph REST calls.
• Teams group policy assignment is unavailable in Microsoft 365 DoD.^3^

---

References

1. New-CsApplicationAccessPolicy-Description
2. Grant-CsApplicationAccessPolicy-Syntax
3. New-CsGroupPolicyAssignment-Description
4. Creates a new application access policy in Exchange Online PowerShell to restrict an application's access to members of a specified mail-enabled security group.
5. PowerShell command to list existing application access policies in Microsoft Teams to verify policy assignments.
6. Get-CsUserPolicyAssignment-Description
7. Grants the specified application access policy to a user identified by their user ID, allowing the app IDs in the policy to access online meetings and virtual e...