MC1134747 - Security Update: New Authentication Requirements for integration with Microsoft Teams PowerShell Module
Service
Published
Tag
Act by
Summary
Microsoft Teams PowerShell Module requires updated application permissions—RoleManagement.Read.Directory and GroupMember.Read.All—for Entra app authentication starting September 15, 2025. Organizations must review and update these permissions in Entra ID to avoid service disruption. No changes needed for delegated permissions.
More information
Introduction
We are reaching out to inform you of an important security and authentication update that may impact your integration with the Microsoft Teams PowerShell Module. As part of our ongoing commitment to strengthening security across Microsoft 365 services, we are updating the authentication requirements for application-based authentication in the Teams PowerShell Module.
These changes are designed to ensure that Entra applications used for backend access to Teams PowerShell are properly scoped and secured. If your organization uses Entra applications to automate or manage Teams via PowerShell, action is required to avoid service disruption.
When will this happen
This change will take effect on Monday, September 15, 2025.
How this affects your organization
If your organization uses Entra applications to authenticate against the Microsoft Teams PowerShell Module, you must update the Application permissions to avoid disruption.
Specifically:
- RoleManagement.Read.Directory: Required for all Entra applications to verify association with an Administrative Unit.
- GroupMember.Read.All: Required if your application uses the following cmdlets:
*-CsGroupPolicyAssignment*-CsGroupPolicyPackageAssignment
No changes are required for delegated permissions.
What you can do to prepare
To ensure uninterrupted access:
1. Review your Entra applications:
- Go to Microsoft Entra ID > Roles and administrators.
- Check the Global Administrator, Teams Administrator, and Skype for Business Administrator roles for any Entra applications or service principals used with Teams PowerShell.
2. Update API permissions:
- Navigate to Microsoft Entra ID > App registrations.
- Locate the relevant application and add the following permissions:
GroupMember.Read.AllRoleManagement.Read.Directory
3. Test your integrations to confirm continued functionality.
Learn more: Application-based authentication in Teams PowerShell Module.
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.