Backgrounds

Like everything in IT, many solutions are available. Here's mine in case it's of any help for someone else.

What it does:

Download images from Azure Blob directly to New Teams Upload folder

How it does:

checks for New Teams to be installed and for Blob URL to be reacheable

Creates "Upload" folder if doesn't exist and bittransfer all files contained in a Blob folder into New Teams user folder using Intune Win32 app deploy

How it checks:

Detection is a dynamic script which check for each file in Azure Blob folder to exist in New Teams folder. If one or more files are missing, it will trigger a new deploy therefore Azure Blob folder can have pictures removed or added and it will dynamically reflects on clients devices

It's a Win32 app that needs to be packed with intunewinapputil

Main Script:

# hide windows terminal console
# https://stackoverflow.com/questions/74968665/hide-the-windows-terminal-console-window-with-powershell
function Hide-ConsoleWindow() {
    $ShowWindowAsyncCode = '[DllImport("user32.dll")] public static extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow);'
    $ShowWindowAsync = Add-Type -MemberDefinition $ShowWindowAsyncCode -name Win32ShowWindowAsync -namespace Win32Functions -PassThru
  
    $hwnd = (Get-Process -PID $pid).MainWindowHandle
    if ($hwnd -ne [System.IntPtr]::Zero) {
      # When you got HWND of the console window:
      # (It would appear that Windows Console Host is the default terminal application)
      $ShowWindowAsync::ShowWindowAsync($hwnd, 0)
    } else {
      # When you failed to get HWND of the console window:
      # (It would appear that Windows Terminal is the default terminal application)
  
      # Mark the current console window with a unique string.
      $UniqueWindowTitle = New-Guid
      $Host.UI.RawUI.WindowTitle = $UniqueWindowTitle
      $StringBuilder = New-Object System.Text.StringBuilder 1024
  
      # Search the process that has the window title generated above.
      $TerminalProcess = (Get-Process | Where-Object { $_.MainWindowTitle -eq $UniqueWindowTitle })
      # Get the window handle of the terminal process.
      # Note that GetConsoleWindow() in Win32 API returns the HWND of
      # powershell.exe itself rather than the terminal process.
      # When you call ShowWindowAsync(HWND, 0) with the HWND from GetConsoleWindow(),
      # the Windows Terminal window will be just minimized rather than hidden.
      $hwnd = $TerminalProcess.MainWindowHandle
      if ($hwnd -ne [System.IntPtr]::Zero) {
        $ShowWindowAsync::ShowWindowAsync($hwnd, 0)
      } else {
        Write-Host "Failed to hide the console window."
      }
    }
  }

Hide-ConsoleWindow
## Set variables
$name = "NewTeams_backgrounds"
$ver = "1.0"
$type = "APP"
$logname = "$type-$name.log"
$logPath = "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\"
$LogFile = Join-Path $logPath $logname

# Checking permissions
Write-Output "checking permissions on $logPath"
$acl = Get-Acl -Path $logPath
$aclcheck = $acl.Access | Where-Object { $_.IsInherited -eq $false -and $_.FileSystemRights -match 'Modify'}
if ($null -eq $aclcheck) {
  try {
    # Changing permissions to Logs folder
Write-Output "adding Modify permissions on builtin\users group"
$rights = 'Modify' 
$inheritance = 'ContainerInherit, ObjectInherit' 
$propagation = 'None' 
$type = 'Allow'
$SID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
$ACE = New-Object System.Security.AccessControl.FileSystemAccessRule($SID, $rights, $inheritance, $propagation, $type)
$acl = Get-Acl -Path $logPath
$acl.SetAccessRule($ACE)
$acl | Set-Acl -Path $logPath
Write-Output "permissions modified on $logPath"
}
catch {
  Write-Output "Error setting up permissions for $logPath. The error is below:"
  Write-Output $_
}
  }
Write-Output "permissions are fine"

# Function to write log entries
function Write-Log {
  param(
      [string]$Message
  )

  $Timestamp = Get-Date -Format "dd-MM-yyyy HH:mm:ss"
  $LogEntry = "$Timestamp - $Message"
  $LogEntry | Out-File -FilePath $LogFile -Append
}

# Main script
try {
Write-Log "Installing $name version $ver"

Write-Log "checking New Teams folders"

$NewTeams_background = "$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Backgrounds"
$NewTeams_Uploads = "$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Backgrounds\Uploads"
if (!(Test-Path -path $NewTeams_background)) { 
    Write-Log "creating folder $NewTeams_background"
    New-Item $NewTeams_background -itemtype directory -force};
if (!(Test-Path -path $NewTeams_Uploads)) { 
    Write-Log "creating folder $NewTeams_Uploads"
    New-Item $NewTeams_Uploads -itemtype directory -force};

$URL = "YOUR_BLOB_URL_WITH_SAS"
$uri = "https://yourcompanyblobname.blob.core.windows.net/yourcompanyfolder/NewTeams_Background"
$body = Invoke-RestMethod -uri $URL
$xml = [xml]$body.Substring($body.IndexOf('<'))
$files = $xml.ChildNodes.Blobs.Blob.Name | where-Object {$_ -like "NewTeams_Background/*"}
$files = $files -replace "NewTeams_Background/",""
Write-Log "following files are on Azure Blob: $files"
$files | ForEach-Object {
$downloadpath = $NewTeams_Uploads + "/" + $_
if (!(Test-Path -Path $downloadpath)){
$URL = "$($uri)/$_"
Write-Log "Downloading $_"
#Invoke-WebRequest -Uri $URL -OutFile "$NewTeams_Uploads\$_" -TimeoutSec 30 -UseBasicParsing:$true -ErrorAction SilentlyContinue
Start-BitsTransfer -Source $URL -Destination "$NewTeams_Uploads\$_" -Priority Normal -ErrorAction SilentlyContinue
}
}

Write-Log "Installation of $name completed"
}
catch {
Write-Log "Error running $name install. The error is below:"
Write-Log $_
}

you'd need to change $uri and $URL accordingly

Pictures need to be uploaded into $uri location

It has a function to hide the powershell and terminal window since it's installed under User environment

It saves log into the default Intune log folder and since it runs as user, it checks for log folder correct permissions

Detection script:

$NewTeams_Uploads = "$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Backgrounds\Uploads"
$URL = "YOUR_COMPANY_BLOB_URL_WITH_SAS"
$missing = 0
$body = Invoke-RestMethod -uri $URL
$xml = [xml]$body.Substring($body.IndexOf('<'))
$files = $xml.ChildNodes.Blobs.Blob.Name | where-Object {$_ -like "NewTeams_Background/*"}
$files = $files -replace "NewTeams_Background/",""
$files | ForEach-Object {
$download_path = $NewTeams_Uploads + "/" + $_
if (!(Test-Path -Path $download_path)){
$missing++
}
}
if ($missing -eq "0"){
    Write-Host "New Teams backgrounds pictures installed"
}

Then you have simple requirements script, one for Blob URL to be reacheable:

$url = "YOUR_COMPANY_BLOB_URL_WITH_SAS"
$client = New-Object System.Net.WebClient
$client.DownloadString($url) | Out-Null
Write-Host "The URL is reachable"

and one for New Teams folder to exist (to be checked with logged on credentials):

# runs with logged on creds
$NewTeams_path = "$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe"
if (Test-Path $NewTeams_path)
{
Write-Host "New Teams installed"
}

Enjoy