How to Report Single-User Teams Online Meetings

Finding Single-User Meetings with the Microsoft Graph

In 2024, I wrote about how to generate a report about Teams meetings, including details like the duration of each meeting and the participants. The original script accesses meeting data using a mixture of Microsoft Graph PowerShell SDK cmdlets and Graph API requests, with the need for Graph requests mandated by the lack of SDK cmdlets at the time I wrote the script.

Recent versions of the Microsoft Graph PowerShell SDK include the missing cmdlets (like Get-MgUserOnlineMeetingAttendanceReport), and I wanted to update the script by replacing requests with cmdlets. As usually happens, I found a few places to improve the code too and spent far too much time playing with Teams online meeting data. I also ran into a bug with the Get-MgUserOnlineMeetingAttendanceReportAttendanceRecord (to fetch attendance records for an online meeting, which looks for a phantom parameter.) Who says life isn’t varied.

But updating a PowerShell script to switch out old code for new wasn’t the sole reason for my visit. I received an interesting message from a reader who told me that their management wanted to keep track of single-user meetings because they suspected that remote users set up one-person meetings that they could attend to appear active and busy is anyone checked. I’d never thought of such a thing; apparently, I lead a sheltered life, and this kind of subterfuge happens in the real world.

Changing the Script

I pointed my reader to the article reference above and suggested that it would make a good base for a script to search for one-user meetings where someone sets up a call to meet with themselves (maybe to check out their avatar, if people are still excited about using avatars in Teams meetings).

I didn’t think too much about the issue for a couple of weeks until I found some time to check out the script, which is when I started to update the code. But at the same time, I considered how to identify one-person meetings.

The script starts by fetching details of users to check, identified as the membership of a group. Each user is processed in turn to fetch calendar events. The calendar events are checked for online status, and if true, details of the online meeting, participants, and attendance records are fetched.

Filtering for Single-User Meetings

One way to restrict processing to single-user meetings it to apply a filter to the set of calendar events. This filter checks if just one attendee is registered for the meeting and the email address of the attendee is the user’s email address. It’s a reasonable check for single-user meetings of the type we might want to pick up.

$CalendarItems | Where-Object {$_.Attendees.emailaddress.address -eq $Organizer.additionalProperties.mail -and ($_.Attendees.emailaddress.address).count -eq 1}

But people might be clever and set up a meeting between themselves and someone else who they don’t intend to ever join the call. For example, they might have a consumer email address that they can invite.

To detect when this happens, the script needs to analyze attendance records. When a Teams online meeting begins, Teams creates an attendance record to note when participants join and leave the call. Teams closes off the attendance record when the meeting finishes. The script already reports attendance data, so it is simple to add a check for single-person meetings like this:

$SingleUserCall = $false
If ($AR.totalParticipantCount -eq 1 -and $Participant.Id -eq $Organizer.Id) {
   $SingleUserCall = $true 
}

Reporting Single-User Meetings

Once an online meeting is tagged as a single-user meeting, it’s easy to report the fact in the output report (Figure 1). If necessary, it would be easy to amend the script to generate a CSV or Excel worksheet containing details of any suspicious meetings.

The value of PowerShell is that it helps tenant administrators respond to requests that Microsoft 365 can’t be expected to deliver. Not every organization will want to check for single-user Teams meetings because this kind of monitoring can run contrary to the need to preserve employee privacy. Others will have good reasons to do so. It all depends on the country, business, and expectations for how remote employees work.

---

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!