PowerShell & Graph Automation
When you manage 50,000 users, clicking through the admin center isn't an option. Learn the Teams PowerShell module cmdlets and Microsoft Graph API calls the exam tests.
Automation for Teams admins
Imagine you’re a school administrator who needs to update the lunch menu for 500 classrooms.
You could walk into each classroom and change the poster. Or you could send one email to all classroom displays that updates automatically.
PowerShell is that email — you type a command, and it changes settings for thousands of users at once. Microsoft Graph is the postal service behind it — the API that connects to Teams, Exchange, SharePoint, and everything else. Both let you automate what would take hours in the admin center.
Teams PowerShell module
Getting started
# Install the module
Install-Module -Name MicrosoftTeams -Force
# Connect to your tenant
Connect-MicrosoftTeams
# Verify connection
Get-CsTenantKey cmdlets the exam tests
The exam tests your ability to choose the right cmdlet for a scenario. Here are the most important ones:
Team management:
| Cmdlet | What It Does | Example |
|---|---|---|
New-Team | Create a new team | New-Team -DisplayName "Project Phoenix" -Visibility Private |
Get-Team | List teams or get details | Get-Team -DisplayName "Marketing" |
Set-Team | Update team settings | Set-Team -GroupId $id -Description "Updated" |
Remove-Team | Delete a team | Remove-Team -GroupId $id |
Add-TeamUser | Add member or owner | Add-TeamUser -GroupId $id -User "user@domain.com" -Role Member |
Set-TeamArchivedState | Archive/unarchive | Set-TeamArchivedState -GroupId $id -Archived $true |
Policy management (Cs prefix):
| Cmdlet | What It Does | Example |
|---|---|---|
Get-CsTeamsMeetingPolicy | List meeting policies | Get-CsTeamsMeetingPolicy -Identity "RestrictedMeetings" |
Set-CsTeamsMeetingPolicy | Modify meeting policy | Set-CsTeamsMeetingPolicy -Identity "RestrictedMeetings" -AllowRecording $false |
New-CsTeamsMeetingPolicy | Create meeting policy | New-CsTeamsMeetingPolicy -Identity "NoRecording" |
Grant-CsTeamsMeetingPolicy | Assign policy to user | Grant-CsTeamsMeetingPolicy -Identity "user@domain.com" -PolicyName "NoRecording" |
Get-CsTeamsCallingPolicy | List calling policies | Get-CsTeamsCallingPolicy |
Grant-CsTeamsCallingPolicy | Assign calling policy | Grant-CsTeamsCallingPolicy -Identity "user@domain.com" -PolicyName "AllowCalling" |
Get-CsTeamsMessagingPolicy | List messaging policies | Get-CsTeamsMessagingPolicy |
New-CsGroupPolicyAssignment | Assign policy to a group | Assign policy to all members of a security group |
Voice management:
| Cmdlet | What It Does |
|---|---|
Set-CsPhoneNumberAssignment | Assign phone number to user |
Get-CsOnlineVoiceRoutingPolicy | List voice routing policies |
New-CsAutoAttendant | Create auto attendant |
New-CsCallQueue | Create call queue |
Get-CsOnlineUser | Get user voice configuration |
Exam tip: Cs prefix and the Grant pattern
The exam loves testing the Get → Set → New → Grant pattern:
- Get-CsTeamsPolicyType = view existing policies (e.g., Get-CsTeamsMeetingPolicy)
- New-CsTeamsPolicyType = create a new policy
- Set-CsTeamsPolicyType = modify an existing policy
- Grant-CsTeamsPolicyType = assign a policy to a user or group
The Grant cmdlet is how you assign policies to users. Without Grant, creating a policy does nothing — it exists but isn’t applied to anyone.
Also: the Cs prefix comes from the Skype for Business heritage. Microsoft kept it for backward compatibility. Don’t be confused — these are Teams cmdlets despite the Cs prefix.
Scenario: Kofi's bulk operations at Harbour University
Kofi needs to assign the Education (Student) meeting policy to 50,000 students. Doing this in the admin center would take weeks.
PowerShell approach:
# Get the student security group (Microsoft Graph PowerShell)
$groupId = (Get-MgGroup -Filter "displayName eq 'All Students'").Id
# Assign meeting policy to the group
New-CsGroupPolicyAssignment `
-GroupId $groupId `
-PolicyType TeamsMeetingPolicy `
-PolicyName "Education_Student" `
-Rank 1The group policy assignment applies to all group members automatically. Kofi checks status with:
Get-CsGroupPolicyAssignment -PolicyType TeamsMeetingPolicy50,000 policy assignments handled through one group assignment instead of individual operations.
Microsoft Graph API
Graph for Teams
Microsoft Graph provides REST API access to Teams:
| Endpoint | What It Does | HTTP Method |
|---|---|---|
/teams | Create a team | POST |
/teams/team-id | Get/update/delete a team | GET / PATCH / DELETE |
/teams/team-id/members | Manage team membership | GET / POST / DELETE |
/teams/team-id/channels | List/create channels | GET / POST |
/teams/team-id/channels/channel-id/messages | Send channel message | POST |
/teams/team-id/archive | Archive a team | POST |
/teams/team-id/unarchive | Unarchive a team | POST |
PowerShell vs. Graph — when to use which
| Feature | PowerShell | Microsoft Graph |
|---|---|---|
| Best for | Admin policy management, bulk operations, voice configuration | Application integrations, custom apps, automation workflows |
| Authentication | Interactive (Connect-MicrosoftTeams) or certificate-based | OAuth 2.0 (app registration in Entra ID) |
| Policy management | Full support — Get/Set/New/Grant for all policy types | Limited — some policies not exposed via Graph |
| Voice features | Full support — phone numbers, routing, auto attendants | Limited voice support |
| Team/channel operations | Supported (New-Team, Add-TeamUser, etc.) | Full support with richer options |
| Automation platform | Azure Automation, scheduled tasks, scripts | Power Automate, Logic Apps, Azure Functions, custom apps |
Graph permissions
Graph API calls require application permissions or delegated permissions configured in an Entra ID app registration:
| Permission | Type | Use Case |
|---|---|---|
Team.ReadBasic.All | Application | Read team properties |
TeamMember.ReadWrite.All | Application | Manage team membership |
Channel.Create | Delegated | Create channels on behalf of a user |
TeamsActivity.Send | Application | Send activity feed notifications |
Exam tip: Application permissions run without a user context (daemon/background). Delegated permissions run on behalf of a signed-in user. The exam may test which permission type is appropriate for a scenario.
🎬 Video walkthrough
🎬 Video coming soon
PowerShell & Graph Automation — MS-700 Module 13
PowerShell & Graph Automation — MS-700 Module 13
~10 minFlashcards
Knowledge Check
Kofi needs to create a PowerShell script that assigns the 'NoRecording' meeting policy to all members of the 'Students' security group. Which cmdlet sequence is correct?
A developer at Pinnacle Corp wants to build a custom app that automatically creates a team when a new project is approved in their project management system. Which approach should they use?
You’ve completed Domain 1! 🎉 All 13 modules covering Teams environment configuration and management.
Next up: Teams Rollout & Creation — Domain 2 begins with planning your Teams rollout and creating teams from templates, Groups, and SharePoint sites.