Table of Contents
New Modules Include Controls for Federated Chat
On July 19, Microsoft released V7.9 of the Microsoft Teams PowerShell module (available from the PowerShell gallery). The most notable change in this release is a transition to use the Windows Account Manager (WAM) for authentication. Other Microsoft 365 development groups have been down this path before. The Microsoft Graph PowerShell SDK added WAM support in V2.34 last December, while V3.10 of the Exchange Online management module did the same in June 2026.
As discussed below, recent versions of the Teams PowerShell module include some important changes to manage external federation.
Is WAM the Source of PowerShell Woes?
WAM is an authentication broker. Microsoft cites better security (token protection) as the reason why PowerShell modules move to WAM. I don’t know if WAM has any bearing on the current incompatibility between the Microsoft Graph PowerShell SDK and Exchange Online. However, it is notable that the long-standing assembly clash issue became much more visible after Exchange Online adopted WAM.
The Connect-MicrosoftTeams cmdlet in the new module comes with a –DisableWAM switch parameter if you don’t want to use WAM for some reason. Microsoft says that this parameter will be removed in the future.
In any case, after installing V7.9 of the Teams module, I wanted to see if the assembly clash problem had moderated. It hasn’t. If anything, the issue is worse. Figure 1 shows what happens after successfully loading the Teams module into a PowerShell V7.6.3 session. Both the Microsoft Graph PowerShell SDK and Exchange Online modules barf (a technical term) and refuse to load.
To solve the problem for the Graph SDK, run Connect-MicrosoftTeams with the DisableWAM switch. Connect-MgGraph will then load but Connect-ExchangeOnline continues to fail.
Switching order, connecting to the Microsoft Graph PowerShell SDK (V2.38.1) first works, but then neither Teams nor Exchange will load (Figure 2).
I could keep on going to test all permutations on both PowerShell Core and Windows PowerShell, but I’m not interested in doing work that the Microsoft development groups should be doing when they test modules before release.
The point is that assembly clashes are a well-known problem across the Microsoft 365 PowerShell modules that’s been ongoing for over a year. The different product groups appear to be incapable of working with each other to come up with a plan to solve the problem and allow all the modules to load into a session in any order. The issue has been bugged many times (here’s an example).
Customers depend on the Microsoft 365 modules to automate processes. Keeping old modules in use because of known problems with current software is not a long-term strategy for any tenant. Microsoft needs to move quickly to improve the situation with its modules.
Teams Controls External Federation
On a happier note, both V7.8 and V7.9 of the Teams module contain the capability to manage the “stricter external access and mutual federation policies in federated group chats” described in message center notification MC1423114 (10 July 2026). This is a good example of why tenants need to upgrade to a new version of a PowerShell module to access functionality that isn’t yet available through an admin portal.
The new external federation controls are disabled by default and manage:
- External Access Restrictions for chat participants (the EnableExternalAccessRestrictionsForChatParticipants option).
- Mutual Federation for chat participants (the EnableMutualFederationForChatParticipants option).
Both settings are updated with the Set-CsTenantFederationConfiguration cmdlet. The Get-CsTenantFederationConfiguration cmdlet reports the current state, which should be false for the two settings. You can validate the state with:
Get-CsTenantFederationConfiguration | Select-Object EnableExternalAccessRestrictionsForChatParticipants, EnableMutualFederationForChatParticipants
If you enable external access restrictions for chat participants, users assigned an external access policy (created with New-CsExternalAccessPolicy cmdlet and assigned to accounts with Grant-CsExternalAccessPolicy) has EnableFederationAccess set to false cannot be added to federated group chats that have external participants. Teams also removes these users from existing federated group chats with external participants.
An important caveat is that if you leave the setting at the default value (false), users whose external access policy has EnableFederationAccess set to false are allowed to participate in federated group chats if the chat is created by a user from their tenant who is allowed to use federation.
Set-CsTenantFederationConfiguration -EnableExternalAccessRestrictionsForChatParticipants $true
If you enable mutual federation for chat participants, the user who creates the chat and users added to the chat must have a valid federation relationship. When someone is added to a federated group chat, Teams validates that a federation relationship exists between the joining user and the chat initiator (or the user adding the participant). A federation relationship exists when the tenants involved allow federated communications and no external access policies block communication between them.
Set-CsTenantFederationConfiguration -EnableMutualFederationForChatParticipants $true
The new controls only become effective if federation is already enabled at the tenant level. They don’t override existing allow or block lists configured for external access.
The Swings and Sorrows of Cloud Life
Believe it or not, I hate sounding like a broken record when I complain about the ongoing problems with Microsoft 365 PowerShell modules. While it gives me something to write about, it’s just a terrible situation to be in. As I point out above, access to new functionality can be dependent on a new version of a module, so customers are being forced to upgrade and will then encounter new problems.
But it’s nice to see Teams add some new controls over federated chat. My preference is to run a tightly-managed access list for other tenants allowed to communicate with my tenant, but not everyone likes that approach, and these controls will help with better management over who can chat outside the tenant.
So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Microsoft 365 for IT Pros eBook to receive insights updated monthly into what happens within Microsoft 365, why it happens, and what new features and capabilities mean for your tenant.