Export-M365DSCConfiguration for Teams having Read.All permission is not generating configuration information

[Infy-Ayusi]

Checked required permission for Teams for some of the policies using command

Get-M365DSCCompiledPermissionList -ResourceNameList @('TeamsCallingPolicy','TeamsClientConfiguration','TeamsEmergencyCallingPolicy','TeamsGuestCallingConfiguration','TeamsGuestMeetingConfiguration','TeamsGuestMessagingConfiguration','TeamsMeetingBroadcastConfiguration','TeamsMeetingBroadcastPolicy','TeamsMeetingConfiguration','TeamsMeetingPolicy','TeamsMessagingPolicy','TeamsUpgradeConfiguration') -PermissionType 'Application' -AccessType 'Read'

Generates below ReadWrite.All and Delete,All permissions along with Organization.Read.All and User.Read.All

Group.ReadWrite.All
AppCatalog.ReadWrite.All
TeamSettings.ReadWrite.All
Channel.Delete.All
ChannelSettings.ReadWrite.All
ChannelMember.ReadWrite.All

I don't intend to modify any of the configuration settings. Why ReadWrite.All and Delete.All permissions required only for executing Export-M365DSCConfiguration for Teams?

[andikrueger]

What version of M365DSC are you using? This issue was already reported in #3404 and got closed with #3636.

[Infy-Ayusi]

I am using version 1.23.809.1

[andikrueger]

Would you mind updating to the latest release? This should fix the issue

[Infy-Ayusi]

Would you mind updating to the latest release? This should fix the issue

Hello,
I have updated Microsoft36DSC to the latest version 1.23.920.2 but looks like the issue is still not resolved for Teams -

Exporting Microsoft 365 configuration for Components: TeamsCallingPolicy, TeamsClientConfiguration, TeamsEmergencyCallingPolicy, TeamsGuestCallingConfiguration, TeamsGuestMeetingConfiguration, TeamsGuestMessagingConfiguration, TeamsMeetingBroadcastConfiguration, TeamsMeetingBroadcastPolicy, TeamsMeetingConfiguration, TeamsMeetingPolicy, TeamsMessagingPolicy, TeamsUpgradeConfiguration {"code":"Forbidden","message":"Access Denied.","action":"Provide different credential or request access."}

Below are the permissions that my Azure AD app has -

Microsoft Graph Application Application.Read.All
Microsoft Graph Application DeviceManagementApps.Read.All
Microsoft Graph Application DeviceManagementConfiguration.Read.All
Microsoft Graph Application DeviceManagementManagedDevices.Read.All
Microsoft Graph Application DeviceManagementServiceConfig.Read.All
Microsoft Graph Application Directory.Read.All
Microsoft Graph Application Domain.Read.All
Microsoft Graph Application Group.Read.All
Microsoft Graph Application Policy.Read.All
Microsoft Graph Application User.Read.All
Microsoft Graph Application Organization.Read.All
Microsoft Graph Application AppCatalog.Read.All
Microsoft Graph Application TeamSettings.Read.All
Microsoft Graph Application ChannelSettings.Read.All
Microsoft Graph Application ChannelMember.Read.All
Microsoft Graph Application Policy.Read.All

[andikrueger]

Did you reset the permissions (removed the old and set the new ones) or are you re-using the previous app registration?

[Infy-Ayusi]

I already had these READ permissions added on the Azure AD App. No new additions/removal of permission done on the App.

[andikrueger]

AFAIK The cmdLet will not remove permissions. @NikCharlebois Is this even doable?

[DennisLangenberg]

Having a similar issue where all permissions are inline with compiled permission list correct. Export success on only Teams, Users and Channels. All Policies and Settings are failing to export. On the latest version currently investigating further.

[andikrueger]

There is a known issue with Teams PowerShell which is different and affects only TeamsOrgWideAppSettings: #3394 Either there was a change to the bad or this is something new.

[DennisLangenberg]

Update on my case, created a full new AppRegistration exactly the same API permissions as my DEV tenant (where it worked). Was still not working did a further look and in my Dev-Tenant i also gave the same Appregistration the Exchange Role.

For testing purposes i gave the new test-Appregistration the Teams-Admin role and now it works. The additional role apparently adds some extra permissions in the forms of a role is needed.

[andikrueger]

@DennisLangenberg Thank you for the feedback. This would align with the documentation: https://learn.microsoft.com/en-us/microsoftteams/teams-powershell-application-authentication#setup-application-based-authentication

5. Assign Azure AD roles to the application. Refer to this Assign a role procedure, but search for the application instead of a user.

We should add this to our documentation and check with the teams team, what roles are needed.

//cc @NikCharlebois

[FabienTschanz]

The Teams Administrator role is listed on the Teams resources. Closing this issue.