Microsoft Teams Expands Group Policy Assignment: What It Means for Your Organization

In Microsoft ongoing commitment to meet the evolving needs of organizations, Microsoft is now extending group policy assignment support to additional policy types via the Teams PowerShell Module (TPM). This update is set to roll out by late May 2023 for all Microsoft Teams commercial licenses. What does this mean for your organization? This article will explain the benefits and the steps to take to prepare for these changes​1​.

The Benefits of Expanded Group Policy Assignment

As organizations expand, their requirements become increasingly nuanced and multifaceted. The "one size fits all" approach to policy management is no longer tenable. Hence, Microsoft's move to extend group policy assignment to additional policy types is a step in the right direction.

With this capability, your organization will be able to create new groups in Microsoft 365 admin center or use existing groups to assign custom policies for various policy types in Teams PowerShell Module. This means you can have different custom policies for various policy types assigned to user groups based on specific needs.

You will no longer have to rely on global (org-wide default) policies or direct policy assignments via manual user selections. Instead, you will be able to tailor policy assignments to meet the unique needs of different user groups within your organization.

Group policy assignment support is now extended to a wide range of policy types in TPM, including but not limited to:

• Application Access Policy
• Call Hold Policy
• Carrier Emergency Call Routing Policy
• Cortana Policy
• Dial Out Policy
• Education Assignments App Policy
• Emergency Calling Policy
• Enhanced Encryption Policy
• Events Policy
• External Access Policy
• Feedback Policy
• Files Policy
• IPPhone Policy
• Media Logging Policy
• Meeting Branding Policy
• Meeting Template Permission Policy
• Mobility Policy
• Notification And Feeds Policy
• Room Video Tele Conferencing Policy
• Synthetic Automated Call Policy
• Teams Branch Survivability Policy
• Template Permission Policy
• VDI Policy
• Video Interop Service Policy
• Voice Routing Policy
• Voicemail Policy

Admins will first have to manage groups in the Microsoft 365 Admin center and then go to the Teams PowerShell Module to perform the group policy assignment for various policy types.

How to Prepare for These Changes

To fully leverage the expanded group policy assignment support in Teams PowerShell Module, follow these steps:

1. Review how the policy assignment for users and groups works. Understanding the mechanics of policy assignment will help you make the most of this new feature.

2. Understand how policy takes effect for users due to precedence rules. This is crucial as these rules determine the order in which policies are applied to users.

3. Review the groups you have created in Microsoft 365 admin center or create new groups. This step is essential as it allows you to effectively organize users for policy assignment.

4. Based on your organization's needs, assign custom policies for these policy types to user groups via Microsoft Teams PowerShell Module.

5. If there is a need to remove a pre-existing custom direct policy assignment, use GRANT to assign a null policy. This is necessary to make way for group policy assignments to take effect, due to the precedence rules mentioned in step 2.

The expanded group policy assignment support in Teams PowerShell Module is a welcome change that will provide organizations with greater flexibility and control over policy management. By taking the time to understand these changes and prepare for them, you can ensure that your organization is ready to make the most of this new feature​2​.

The Precedence Rules and Group Assignment Ranking form two essential concepts for this update.

Precedence Rules

For a given policy type, a user's effective policy is determined according to these rules:

1. A policy directly assigned to a user takes precedence over any other policy of the same type assigned to a group. Therefore, if a user has a directly assigned policy of a certain type, you will need to remove that policy from the user before they can inherit a policy of the same type from a group.

2. If a user does not have a policy directly assigned and is a member of two or more groups, each with a policy of the same type, the user inherits the policy of the group assignment that has the highest ranking.

3. If a user is not a member of any groups assigned a policy, the global (Org-wide default) policy for that policy type applies to the user.

A user's effective policy is updated when a user is added to or removed from a group that's assigned a policy, a policy is unassigned from a group, or a directly assigned policy to the user is removed​2​.

Group Assignment Ranking

When you assign a policy to a group, you specify a ranking for the group assignment. This ranking determines which policy a user should inherit as their effective policy if the user is a member of two or more groups, each with a policy of the same type.

The group assignment ranking is relative to other group assignments of the same type. The ranking indicates which group membership is more important or more relevant concerning policy inheritance.

For instance, consider two groups - "Store Employees" and "Store Managers", both assigned a Teams calling policy. For a store manager who is a member of both groups, their role as a manager is more relevant than their role as an employee. Therefore, the calling policy assigned to the "Store Managers" group should have a higher ranking. If a ranking is not specified, the policy assignment is given the lowest ranking​3​.

This advanced control over policy assignment enables organizations to create an environment that best suits their unique needs, moving away from a "one size fits all" approach. The update is set to be available for all Microsoft Teams commercial licenses by late May 2023.

As organizations prepare for this update, it's crucial to familiarize themselves with how the policy assignment for users and groups works, the precedence rules, and how to manage groups in the Microsoft 365 Admin center. Based on the organization's needs, custom policies can then be assigned to user groups via the Microsoft Teams PowerShell Module.