Category Archives: Powershell

Automation, Identity, Microsoft Teams, Powershell

Locally detecting a user’s sign in to Microsoft Teams

Leave a comment

A customer wanted to see when/if users were doing their first sign in to MS Teams (on new devices), and if this was against their tenant. Mostly untested but for the world since I couldn’t google it:

function checkTeams(){
    $teamsLogPath = Join-Path $($env:LOCALAPPDATA) "packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_request_param.json"
    if((Test-Path $teamsLogPath)){
        $state = Get-Content $teamsLogPath | ConvertFrom-JSON
        if($state -and $state.tenantId -eq "YOUR TENANT GUID"){
            return $true
        }else{
            return $false
        }
    }else{
        return $false
    }    
}
EntraID, Microsoft Teams, Powershell, Security

Get-CsTeamsMeetingPolicy: Invalid credential Provide valid credential.

Leave a comment

For those googling, above error happened for us when trying to use application-based authentication for the MS Teams PowerShell commandlets.

We followed the instructions but kept getting Invalid credential Provide valid credential whenever calling a cmdlet, while the connect-microsoftteams command worked fine with the -accesstokens param.

Turns out, when you assign application level permissions to your service principal on top of the delegated permissions, the SPN is not authorized for all subsequent cmdlet calls :O

Automation, Microsoft Teams, Office 365, Powershell, Security, Sharepoint Online

Microsoft Teams permission auditing

Leave a comment

I lied, not just Teams, also Sharepoint and Onedrive!

As I am asked often how to report on specific permissions granted to individual (groups) of (internal/external) users….and Microsoft doesn’t have a good built-in solution, nor does the community seem to yet….this something was just asking to be coded!

My TeamPermissions PowerShell module will do exactly the above, a full report in XLSX, CSV or HTML format that contains ALL unique permissions for a given Team, Sharepoint site or Onedrive location for all files, folders, lists, list items etc. Example:

It uses the safe Entra Delegated Permission Flow for authentication so your credentials/tokens stay with you, but this does mean you have to run it as a Sharepoint Administrator (or Global Admin), there is no support for MI/SPN runs yet but can be added easily if there is much demand.

Since it exports to Excel in append mode, you could run it for multiple (or all) team sites and use e.g. Pivots to view all permissions for a given user.

Do note that although some work has been done on performance, it does not scan multiple locations in parallel yet, this will be added in a future version.

Example:

Install-PSResource -Name TeamPermissions -Repository PSGallery

#then get xlsx/html reports for the INT-Finance Department Team:

Get-TeamPermissions -teamName "INT-Finance Department" -ExpandGroups -OutputFormat XLSX,HTML

#Or get all permission for a Sharepoint site:

Get-TeamPermissions -TeamSiteUrl "https://tenant.sharepoint.com/sites/site" -ExpandGroups -OutputFormat Default

Notes

Required PS modules: PnP.PowerShell, ImportExcel

Running multiple times will append data if you don’t move the (xlsx, csv, html) file, turning the report into a multi-location report.

Automation, Azure, Azure Virtual Desktop, Powershell

Multi threading in ADDRS

Leave a comment

I’ve added basic multi-threading to ADDRS: https://www.powershellgallery.com/packages/ADDRS/1.1.8

This solely ensures that the most compute intensive task (caching sizes/performance) is not repeated between jobs. You’ll still have to handle running multiple jobs using your own preferred method, e.g. foreach -parallel, runspaces or start-job. Example:


$scriptBlock = {
    Param(
        $vm,
        $measurePeriodHours,
        $workspace,
        $token
    )
    import-module ADDRS -force
    Login-AzAccount -AccessToken $token.Token -AccountId $token.UserId -Tenant $token.TenantId
    set-vmRightSize -doNotCheckForRecentResize -targetVMName $vm.Name -domain "lieben.nu" -measurePeriodHours $measurePeriodHours -workspaceId $workspace.CustomerId -Verbose -maintenanceWindowStartHour 22 -maintenanceWindowLengthInHours 3 -maintenanceWindowDay 6
}