Assign policy to groups
With the new admin portal you can only assign messaging policy to individual users. Why is this happening when the previous admin portal let us set different options to for example Faculty, Students etc? It's near impossible to manage per-user Teams settings for several thousand students who come and go. We need to be able to let group membership control these settings in Teams.
Per-Torben Sørensen
shared this idea
71 comments
-
Hasan Siddiqui
commented
It works for Teams App as well, just not documented. Try this:
New-CsGroupPolicyAssignment -PolicyType teamsappsetuppolicy -GroupId SecurityOrDistributionGROUP_ID -PolicyName Name_of_App_Policy
-
Todd Johnson
commented
I see this is available for most policy types now but not Teams App Permission Policies. Is that planned?
-
James Martin
commented
Microsoft - Thank you for looking into adding this feature. As a school District, I would like to suggest a further enhancement. Please review our scenario below to better understand our request.
Here is a summary of what we would like to have available for our teachers and children.
We have an Azure group named ‘all teachers’ and a group named ‘all students’. Currently we have disabled chat and meetings for our group ‘all students’. This prevents students from chatting with each other (and this is a desired goal) but it also prevents our students from chatting with their teacher AND their teacher from being able to chat with them.
We would like to prevent ‘all students’ from chatting or meeting with any member of the ‘all students’ group but allow ‘all students’ to chat or meet with anyone in the ‘all teacher’ group.
So group A cannot chat or meet with anyone in group A, but group A is allowed to chat or meet with anyone in group B.That is what we need for schools to allow safe and easily accessible student to teacher and teacher to student collaboration!
-
Andreas Norling
commented
Why does this even need to be a request Microsoft? Who thought it's a good idea to manage policys on a per-user basis??
-
punith
commented
Apply teams policy to each users is very difficult add option to apply policy to groups
-
Álvaro Reverte
commented
The group assignment already works but there is a problem when looking for the groups to assign it to. Only 20 groups appear in the search and the group you want does not appear in many cases. Even putting the exact name of the group sometimes does not appear.
-
Tom Basham
commented
Adding this functionality for the App Permissions policy would make the testing of custom apps much easier to manage.
-
Fuad Mansour
commented
How can i add policy to a group ,
The Group assignment tab is missing in Microsoft 365 A1. how can i view it -
Barbara Drake
commented
It surprises me that Microsoft would even consider Policy Packages without group membership. Who has the time to maintain this manually. We need this fix asap.
-
Anonymous
commented
How to Remove the user from TeamsAppPolicy
-
Ben Mottram
commented
In a school it would be very handy indeed (actually with respect to safeguarding - essential) to have policies applied at an AAD group level - managing policies on a per user basis is fundamentally broken (a bit like having to install the Teams app for every user and to have that user be a member of the administrators group.... or relax the exe prevention policy neither of which are going to happen)
Sadly in the current state Teams is unmanageable (safely) in an Educational environment (and probably in a large corporate as well, if you are going to use anythng other than the default Org policy) -
Gil Escamilla
commented
What happens when the message policy assignment is required for a constantly changing user profile (providers, service agents, call center operators)? Administration becomes too complicated!
Assignment through a group (security / dynamic / O365) would make things much easier!
Regards!
-
JJJ
commented
"Bulk policy assignment" is different than assigning a policy to a group. Yes, I can use Powershell to assign all group members a particular policy. But if a user is added to that group later, nothing happens. I have still have to go in and add the new group member to the policy manually. The added administrative and reporting overhead is a productivity drain and creates a potential blind spot for reporting on Teams users' access levels.
-
shabs jaleel
commented
you can edit a policy package to your needs.
Admin -> Teams -> Policy packages -> select policy package -> select policy -> Edit policy -> Save each policy editedYou then can apply it to bulk users via PowerShell commands
Now that we have a list of student users in a csv file as specified below
Please note that you will need access to PowerShell & permission Administrator permission to PowerShell & Admin account.CSV FIle:
Users
user_1@domain.com
user_2@domain.com
user_3@domain.com
user_4@domain.com
user_5@domain.com#Connect to SFB
$userCredential = Get-Credential
$sfbSession = New-CsOnlineSession -Credential $userCredential
Import-PSSession $sfbSession#List Policy Package Names Available on Tenant
Get-CsPolicyPackage#Assign Policy Package (1 user)
Grant-CsUserpolicyPackage -identity user@domain -PackageName Policy_Package_Name#Assign Policy Package (csv file)
$csv = import-csv filename.csv
foreach ($line in $csv){
$Auser = $line.users;
echo $Auser;
Grant-CsUserpolicyPackage -identity $Auser -PackageName Policy_Package_Name; -
shabs jaleel
commented
Thanks @RoVar, your script works well, i have also attached script for some users who may want to apply policy package to their users. please test with one user before applying to all users in csv
thank you
-
RoVar
commented
PowerShell commands to assign any policy to bulk users.
Install Teams : https://www.powershellgallery.com/packages/MicrosoftTeams/1.0.5
Install SkypeOnlineConnector : https://www.microsoft.com/en-us/download/details.aspx?id=39366
Import-Module SkypeOnlineConnector
$cred = Get-Credential
$CSSession = New-CsOnlineSession -Credential $cred
Import-PSSession $CSSession -AllowClobber
Connect-MicrosoftTeamsImport-Csv -Path "<filepath>" | foreach{New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "<yourpolicyname>" -OperationName "Update messaging Policy" -user $_.email} - This is for Bulk Users , file should be in .csv format and .csv file should be as below.
email
username1@domain.com
username2@domain.com
-
-
-
username100@domain.comChecks - Get-CsOnlineUser | Format-Table UserPrincipalName, TeamsMessagingPolicy, TeamsMeetingPolicy, TeamsAppPermissionPolicy
Grant-CsTeamsMessagingPolicy -identity "usernameEmailID" -PolicyName <Policyname> - This is for Single user
Get-CsOnlineUser -Filter {Department -eq 'DepartmentName'} | Select UserPrincipalName
Get-CsOnlineUser -Filter {Department -eq 'DepartmentName'} | Grant-CsTeamsMeetingPolicy -PolicyName "<yourpolicyname>"try this, it works.
-
Scott
commented
How is this not a thing yet?
-
GaryS
commented
Issues with creating comma separated student lists that have hyphens separating surnames, so much faff for what should be a simple task assigning Packages to Groups
-
Anonymous
commented
Yet another glaring omission in O365. The current situation seems to expose these on a daily basis whether that be from the user or admin side.
'It's on the roadmap' is in danger of becoming a meme at this point.
As for this request all I wanted to do was apply the policy packages to users based upon their group membership. No feature in the console, so I'll do it via powershell I thought.Oh boy, I should have known better by now.
a) Grant-CsUserPolicyPackage is now limited to a maximum of 20 users.
b)New-CsBatchPolicyPackageAssignmentOperation doesn't support apply policy packages despite what your own online help implies.If you think I sound frustrated you'd be correct.
-
BACSTECH
commented
I discovered about a week ago that there are now Policy Packages available in the Teams Admin Center. After they have been assigned to a user(s) they are editable. Just beware that once a package has been assigned it is now part of the Tenant and cannot be removed. I am looking to see if they may be mass added to groups through PowerShell, right now they can only be added individually up to 20 at a time. I have attached a capture.
