Office 365 - Unable to block profile picture changed at this URL

[robyholmes]

Hi All,

 

Can those people how have blocked the users ability to change a user photo in Office 365, please check this URL to see if you can still do so: https://myaccount.microsoft.com/?ref=MeControl

 

It seems to bypass the OwaMailboxPolicy -SetPhotoEnabled $false as found here: https://www.codetwo.com/admins-blog/prevent-users-from-changing-profile-photos-microsoft-365/

 

Thanks,

Rob

[CHiLL]

If I remember correctly, this is a long standing issue. The only solution that I can recall was to have a scheduled task to remove the profile pictures overnight.

[robyholmes]

If I remember correctly, this is a long standing issue. The only solution that I can recall was to have a scheduled task to remove the profile pictures overnight.

 

It used to be Teams that didn't honour the policy, but now it does. This is the only place now that seems to allow it. I'll see if opening a case with Microsoft has any luck.

[CHiLL]

It used to be Teams that didn't honour the policy, but now it does. This is the only place now that seems to allow it. I'll see if opening a case with Microsoft has any luck.

We always experienced this with M365 too and couldn't prevent it, so we gave up. We just deal with any inappropriate profile pictures like any other disciplinary action.

[Brummytech]

So its managed by MS graph this annoyed me as it wasn't a obvious change(Well a google found it) We had no issues and then randomly users started changing profile pictures.

 

https://learn.microsoft.com/en-us/graph/profilephoto-configure-settings

 

For me it was eaisest to log into graph API online then set a admin role only to be able to change photos. Then only using the admin centre can they be amended

So first log into the web Graph explorer and then use the person Icon to login

So first you need to log in with a admin account, then you need to set in settings read write all. (Modify permissions)

Then follow that and get your current settings

 

GET https://graph.microsoft.com/beta/admin/people/photoupdatesettings (So GET request and the HTTP in the box)

Set either Cloud or Local using Patch

Use patch with the URL and amend the json to what you want. (I just used the provided) -

PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettingsContent-Type: application/json{ "source": "cloud", "allowedRoles": []}

 

Then add a admin role which replaces the blank allowed roles (This is default and allows anyone to amend there photo) I just used the provided user administrator as we intended to manage it via the admin centre.

PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettingsContent-Type: application/json{ "source": "cloud", "allowedRoles": ["fe930be7-5e62-47db-91af-98c3a49a38b1"]}

 

It will take 24 hours to take affect. Probably in about 6 months time MS will change this again, but this will block all 365 areas

Edited December 5, 2024 by Brummytech

[robyholmes]

So its managed by MS graph this annoyed me as it wasn't a obvious change(Well a google found it) We had no issues and then randomly users started changing profile pictures.

 

https://learn.microsoft.com/en-us/graph/profilephoto-configure-settings

 

 

Good find. I've followed that, had some issues with running the JSON. It turns out you can't copy the Microsoft code even in the code boxes as it's miss formatted. Re-typing the spacing and brackets sorted it. Fingers crossed this does it.

 

Thank you for that.

[robyholmes]

Quick Update - Yep that's done the trick perfectly! Thank you very much @Brummytech