Teams: Applying Education (Secondary school student) package to all students?

[kennysarmy]

Can anyone share their powershell code with me as I need to push the Education (Secondary school student) package (policies) to all my students.

 

I've edited the Education (Secondary school student) policies with a member of SMT and we've tested with a test student everything is how we want it.

 

The polices for the test student look like this:

 

 

And I want all my students to look the same as currently they are all on Global (Org-wide default) - currently this is fine as I've not given any students apart from the test student a Teams licence.

 

Thanks.

[TechMonkey]

I used this code

#Connect Teams module
Connect-MicrosoftTeams
#Connect Azure AD module
Connect-AzureAD
$group = Get-AzureADGroup -SearchString "GROUPNAME"
$members = Get-AzureADGroupMember -ObjectId $group.ObjectId -All $true | Where-Object {$_.ObjectType -eq "User"}
New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "POLICYNAME" -Identity $members.UserPrincipalName -OperationName "RANDOMDESCRIPNAME"

 

Where GROUPNAME is a group of all your pupils and POLICYNAME is one of the following:

CallingLineIdentity, OnlineVoiceRoutingPolicy, TeamsAppSetupPolicy, TeamsAppPermissionPolicy, TeamsCallingPolicy, TeamsCallParkPolicy, TeamsChannelsPolicy, TeamsEducationAssignmentsAppPolicy, TeamsEmergencyCallingPolicy, TeamsMeetingBroadcastPolicy, TeamsEmergencyCallRoutingPolicy, TeamsMeetingPolicy, TeamsMessagingPolicy, TeamsUpdateManagementPolicy, TeamsUpgradePolicy, TeamsVerticalPackagePolicy, TeamsVideoInteropServicePolicy, TenantDialPlan

 

depending on what policy you want to set.

[kennysarmy]

I used this code

#Connect Teams module
Connect-MicrosoftTeams
#Connect Azure AD module
Connect-AzureAD
$group = Get-AzureADGroup -SearchString "GROUPNAME"
$members = Get-AzureADGroupMember -ObjectId $group.ObjectId -All $true | Where-Object {$_.ObjectType -eq "User"}
New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "POLICYNAME" -Identity $members.UserPrincipalName -OperationName "RANDOMDESCRIPNAME"

 

Where GROUPNAME is a group of all your pupils and POLICYNAME is one of the following:

CallingLineIdentity, OnlineVoiceRoutingPolicy, TeamsAppSetupPolicy, TeamsAppPermissionPolicy, TeamsCallingPolicy, TeamsCallParkPolicy, TeamsChannelsPolicy, TeamsEducationAssignmentsAppPolicy, TeamsEmergencyCallingPolicy, TeamsMeetingBroadcastPolicy, TeamsEmergencyCallRoutingPolicy, TeamsMeetingPolicy, TeamsMessagingPolicy, TeamsUpdateManagementPolicy, TeamsUpgradePolicy, TeamsVerticalPackagePolicy, TeamsVideoInteropServicePolicy, TenantDialPlan

 

depending on what policy you want to set.

 

Thanks, I will test this tomorrow - my brain is frazzled for the rest of the day!

[AvaFX]

Hi both, I've just tested this script and with a few minor tweaks for my environment, it worked well! Thanks TechMonkey!

[TechMonkey]

Just been poking around for something else nad found you can assign a package. I've not run this so you will need to test it but this code:

#Connect Teams module
Connect-MicrosoftTeams
#Connect Azure AD module
Connect-AzureAD
$group = Get-AzureADGroup -SearchString "grPeoGovAccounts"
$members = Get-AzureADGroupMember -ObjectId $group.ObjectId -All $true | Where-Object {$_.ObjectType -eq "User"}
New-CsBatchPolicyPackageAssignmentOperation -Identity $members.UserPrincipalName -PackageName PACKAGENAME

 

Should do the same as before but assign the package, not the individual policies. Change PACKAGENAME to Education_teacher, or what ever package you want.

 

Just remembered what I wanted to use it for so ran it. Seems to work OK, but it isn't instant. It creates a batch job which runs at some point in the near future. To check on the job take the GUID that was displayed after the last command and use it in teh following code

Get-CsBatchPolicyAssignmentOperation -OperationId GUID | fl

Edited May 28, 2020 by TechMonkey

[mattpant]

Thanks for this...

 

I had a few weird issues with some groups that came up with errors when trying to apply these settings:-

 

Get-AzureADGroupMember : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'ObjectId'. Specified method is not supported.

At line:1 char:45

+ $members = Get-AzureADGroupMember -ObjectId $group.ObjectId -All $tru ...

+ ~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidArgument: ( [Get-AzureADGroupMember], ParameterBindingException

+ FullyQualifiedErrorId : CannotConvertArgument,Microsoft.Open.AzureAD16.PowerShell.GetGroupMembers

 

But I created new groups in AD with the same users in them and Sync'ed them back to AzureAD and they then seemed to work ok without the error.

 

Is there a command does anyone know that you can run to get a list of all users and see which policy (or policy package) has been assigned to each user to check they have the correct one's being applied?

 

Thanks

 

Matt

[snagrat]

Get-CSOnlineUser will show you the individual policies assigned to the user.

 

The usual -Identity and pipe select will allow you to filter what you are actually looking for

[kennysarmy]

I used this code

#Connect Teams module
Connect-MicrosoftTeams
#Connect Azure AD module
Connect-AzureAD
$group = Get-AzureADGroup -SearchString "GROUPNAME"
$members = Get-AzureADGroupMember -ObjectId $group.ObjectId -All $true | Where-Object {$_.ObjectType -eq "User"}
New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy -PolicyName "POLICYNAME" -Identity $members.UserPrincipalName -OperationName "RANDOMDESCRIPNAME"

 

Where GROUPNAME is a group of all your pupils and POLICYNAME is one of the following:

CallingLineIdentity, OnlineVoiceRoutingPolicy, TeamsAppSetupPolicy, TeamsAppPermissionPolicy, TeamsCallingPolicy, TeamsCallParkPolicy, TeamsChannelsPolicy, TeamsEducationAssignmentsAppPolicy, TeamsEmergencyCallingPolicy, TeamsMeetingBroadcastPolicy, TeamsEmergencyCallRoutingPolicy, TeamsMeetingPolicy, TeamsMessagingPolicy, TeamsUpdateManagementPolicy, TeamsUpgradePolicy, TeamsVerticalPackagePolicy, TeamsVideoInteropServicePolicy, TenantDialPlan

 

depending on what policy you want to set.

 

I've now had chance to try the script you kindly posted but unfortunately I get this error!

 

New-CsBatchPolicyAssignmentOperation : The term 'New-CsBatchPolicyAssignmentOperation' is not recognized as the name of a cmdlet, function,

script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

At line:5 char:1

+ New-CsBatchPolicyAssignmentOperation -PolicyType TeamsMessagingPolicy ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (New-CsBatchPolicyAssignmentOperation:String) [], CommandNotFoundException

+ FullyQualifiedErrorId : CommandNotFoundException

 

 

I replaced "GROUPNAME" with "PupilsTeams" and confirmed this group is in AzureAD.

 

I replaced "POLICYNAME" with "Education_SecondaryStudent" the standard one shown in TEAMS Admin.

 

Any thoughts?

[kennysarmy]

I tried to update MS TEAMS powershell version.

 

[kennysarmy]

[system.Net.ServicePointManager]::SecurityProtocol = [system.Net.SecurityProtocolType]::Tls12;

 

Had to run this command...

[kennysarmy]

Get-CSOnlineUser will show you the individual policies assigned to the user.

 

The usual -Identity and pipe select will allow you to filter what you are actually looking for

 

Is there anything I need to have installed to get the Get-CSOnlineUser command to be recognised?

 

PS C:\windows\system32> Get-CSOnlineUser

Get-CSOnlineUser : The term 'Get-CSOnlineUser' is not recognized as the name of a cmdlet, function, script file, or

operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try

again.

At line:1 char:1

+ Get-CSOnlineUser

+ ~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (Get-CSOnlineUser:String) [], CommandNotFoundException

+ FullyQualifiedErrorId : CommandNotFoundException

 

PS C:\windows\system32>

[AvaFX]

Is there anything I need to have installed to get the Get-CSOnlineUser command to be recognised?

 

PS C:\windows\system32> Get-CSOnlineUser

Get-CSOnlineUser : The term 'Get-CSOnlineUser' is not recognized as the name of a cmdlet, function, script file, or

operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try

again.

At line:1 char:1

+ Get-CSOnlineUser

+ ~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (Get-CSOnlineUser:String) [], CommandNotFoundException

+ FullyQualifiedErrorId : CommandNotFoundException

 

PS C:\windows\system32>

Hey Kenny, it's a tad misleading as this command actually requires the Skype for Business Module - it caught me out too.

 

Here are the steps to connect to it: https://docs.microsoft.com/en-gb/office365/enterprise/powershell/manage-skype-for-business-online-with-office-365-powershell

[kennysarmy]

 

All seems to be OK.

 

I guess I now just wait.

[kennysarmy]

Well it did n't take as long as I thought, but it's returned with 73 errors.

 

Anyone know how I troubleshoot this further?

 

[kennysarmy]

Well it did n't take as long as I thought, but it's returned with 73 errors.

 

Anyone know how I troubleshoot this further?

 

[ATTACH=CONFIG]58208[/ATTACH]

 

I think these were accounts that were in the AD group but did not have TEAMS licences or were not part of O365.

 

I've now since created staff policies and moved where necessary everyone off the Global policies where we felt there was a need to differentiate between staff and students.

[TechMonkey]

Sorry, I have been fairly absent from Edugeek for a few days so missed all this, but glad you got it all sorted.

[foofighterjim]

@TechMonkey I'd just like to give you a proper thank you, after hours on getting nowhere with the official Microsoft method: https://docs.microsoft.com/en-us/microsoftteams/batch-policy-assignment-edu (claims that -AddPackage isn't a valid command)

 

Your script worked flawlessly and all my users now have the correct permissions, thanks again!

[Sikkepitje]

Connect-AzureAD

Connect-MicrosoftTeams

 

function Waitfor-policyassignmentComplete ($opid) {

do {

$status = Get-CsBatchPolicyAssignmentOperation -id $opid

Write-Host (get-date -f "HH:mm:ss") $status.OverallStatus ", Waiting..."

Start-Sleep -Seconds 3

} while ($status.OverallStatus -ne "Completed") # wait until operation completed

$status

}

 

# assign policye Education_SecondaryStudent_PrivateCallsAllowed to BON students

$groep = Get-AzureADGroup -SearchString "Licentie.Leerling.BON"

$members = Get-AzureADGroupMember -ObjectId $groep.ObjectId -All $true

$members.count

$upns = $members | Select-Object -ExpandProperty UserPrincipalName

 

$opid = New-CsBatchPolicyAssignmentOperation -Identity $upns -PolicyName "Education_SecondaryStudent_PrivateCallsAllowed" -PolicyType "TeamsCallingPolicy"

Waitfor-policyassignmentComplete -opid $opid

[steveg]

This thread has been really useful, just applying policies now. In the Admin center under assigned policies for each user there are 2 policies that can be applied that i cannot find the name for to apply from powershell? the live events policy and one that is just called teams policy. All the others i want to apply have been fine.

[TechMonkey]

This thread has been really useful, just applying policies now. In the Admin center under assigned policies for each user there are 2 policies that can be applied that i cannot find the name for to apply from powershell? the live events policy and one that is just called teams policy. All the others i want to apply have been fine.

 

Live Events I think is TeamsMeetingBroadcastPolicy.

 

Not sure about the other one sorry.

[kennysarmy]

Damn it.

 

Just remembered I needed to run these scripts to set all our new starters since September to the right policies

[Boredguy]

you can apply the policies to Groups now so you don't need to run scripts @kennysarmy

[DaveTheTech]

It would be worth setting your default policy to be as locked down as possible.

This would stop anyone from doing what they are not meant to - plus as an added bonus you'll get a reminder to let them make calls etc

[Boredguy]

It would be worth setting your default policy to be as locked down as possible.

This would stop anyone from doing what they are not meant to - plus as an added bonus you'll get a reminder to let them make calls etc

 

Ideally you would want the default policies set to the most restrictive, then under Meetings/Live Events/Messaging and Calling policies set a Group Policy Assignment for a AD Synchronised group to assign the correct policy (be it Education_Teacher, Education_SecondaryStudent etc).

[kennysarmy]

Is it possible to switch users from "Directly" applied policies to those that get set through the new group policy assignment method?