Unable to delete Teams app permissions policy

Copper Contributor

We have an app permissions policy in Teams so we can test out some add-in apps, we are unable to delete the policy because it is impossible to delete without first going through each user is has been assigned to and setting them back to the org-wide default policy. Unhelpfully, Teams does not show you which users the policies have been assigned to.

 

Does anyone know how to show which users have been assigned an app permission policy?

 

I am certain that we used to be able to delete policies and any users they were assigned to would be automatically reverted back to the org-wide default policy.

 

Many thanks

6 Replies

You can simply use PowerShell to switch policies and delete the one you need?

@Vasil Michev 

Yes but...

I have a similar case.  We have a custom policy that .. as far as I can tell... has no members.  But we can't delete it because, according to Teams, it does.    So we need to re-assign the policy to all the current members of the policy.

 

Even this command requires that we know who to apply it to: https://docs.microsoft.com/en-us/powershell/module/teams/get-csuserpolicyassignment?view=teams-ps

 

So is there a way to get a list of everyone assigned to policy X?

@PhilC42  & @Michael Davis  I have used the following to get all users with a specific app permission policy assigned 

 

 

Get-CsOnlineUser -Filter {TeamsAppPermissionPolicy -eq 'Policy Name Here'} | Select UserPrincipalName

 

 

Then you can assign another policy for those users and delete the old one.

 

Now if only someone could tell me how to remove the deleted user from the other policy I want to remove :)

@Stephen Bayliss

Good script!

 

Just ran into this today. Not sure about PowerShell, but you can reassign the App permission policy from the Teams admin center under Users > Manage users. Search for the user then under the Policies tab find your App permission policy and change it to whatever you want and Save. Says it may take a few hours to update, but it was immediate for me.

This cmdlet looks promising, but I couldn't get it to work for me (or others) as it appears there are several issues with the Teams PowerShell cmdlets in general.
Grant-CsTeamsAppPermissionPolicy (SkypeForBusiness) | Microsoft Docs

@rgrimm for anyone googling this, you can now filter by policy in the Teams Admin Center under Manage users, and export the results into .csv. Makes finding users with a specific policy assigned much easier.

 

One issue you might run into is disabled users. The users may still show in the Teams admin center as having the policy you want to delete applied, but you can't remove the policy via the admin center or PowerShell. It can be a painful wait to re-enable users just so you can remove the policy and delete it.

When I was applying a new App Setup Policy, I needed to know who was still using the old App Setup Policy. I already knew what policy to look for. If this is the case, here is how I did it. In the Teams Admin Center, go to Manage Users, on the right-hand side where you see the Export, Filter, and Edit column icons, click on Filter. Choose a filter from the drop-down list, such as the App permission policy or App Setup Policy, then choose the Operator such as = (equals) and then choose the Value from the drop-down to choose the policy you think they may be in. This will show the results.