Enabling Access to Teams for Guest Users with PowerShell

No Option to Enable

A question in the Microsoft Technical Community (MTC) raised the issue of how a tenant administrator can enable guest access for Teams if the option is unavailable in the Office 365 Admin Center.

Microsoft is in the middle of transitioning options to control Teams to the new Teams and Skype for Business Admin Center. Part of that transition is to move from a tenant-wide licensing model to a per-user licensing model. Guest accounts don’t need licenses, but their access must be enabled at multiple levels (Azure Active Directory, Office 365 Groups, SharePoint Online, and Teams) before they can work with Teams.

Microsoft disables settings in the Office 365 Admin Center as they move to the Teams and Skype for Business Online Center. As you can see from the screen shot, the setting to allow licenses to be assigned to the “Guest” category of users is grayed out.

Tenants are migrated to the new administrative framework individually. The question raised in the MTC was how to handle a situation where a new tenant wanted to enable guest access for Teams but couldn’t because the setting was grayed out. You know when your tenant is being migrated by the presence of the yellow banner under Settings by user/license type as shown above.

PowerShell to the Rescue

To cut a long story short, the setting to enable guest access for Teams can be manipulated with the Set-CsTeamsClientConfiguration cmdlet from the Teams V2.0 PowerShell module. Download the module (if you don’t have it already) and you can then run the cmdlet to enable or disable guest access. In this example, we enable guest access.

Connect-MicrosoftTeams
Set-CsTeamsClientConfiguration -AllowGuestUser $True -Identity Global

To check your configuration afterwards, run the Get-CsTeamsClientConfiguration cmdlet and make sure that AllowGuestUser is set to $True.

Because of caching, it might take Teams clients an hour or so before they pick up the new setting and allow team owners to add new guests to team membership.

Admin Center Setting Coming Soon

Once the transition finishes, the Teams and Skype for Business Online Admin Center will have a setting to control guest access for Teams. I don’t work for Microsoft, so I can’t say when that will be – but I have heard “soon.”

Why the Skype for Business Online PowerShell Connector

You might wonder why Teams uses a cmdlet from the Skype for Business Online PowerShell module instead of the Teams PowerShell module. The answer is that the administrative cmdlets deal with Skype for Business Online and Teams (we’re a year into the transition from Skype for Business Online to Teams), so the cmdlets in the Skype for Business PowerShell module give a common approach to management. Also,  the Teams PowerShell module currently focuses on functionality revealed in the Teams desktop and browser client and not on global tenant settings.

Update March 6, 2021: Microsoft has updated the Teams PowerShell module to V2.0. In general, it’s best to use the latest version of a module but test it first! This version replaces the Skype for Business Online Connector and doesn’t require using New-CsOnlineSession to connect to the management end point.

For more information about managing Teams, see Chapter 13 of the Office 365 for IT Pros eBook. Chapter 14 tells you how to manage Teams (and Office 365 Groups) with PowerShell, while Chapter 16 explains the transition from Skype for Business Online to Teams.