Install-Module MicrosoftTeams -Force
Connect-MicrosoftTeams

# Export all teams in the tenant
Get-Team | Select-Object DisplayName,Description,Visibility,MailNickName,Archived,GroupId |
  Export-Csv -Path "AllTeams.csv" -NoTypeInformation

# Find all public teams (potential oversharing risk)
Get-Team -Visibility Public |
  Select-Object DisplayName,Visibility,MailNickName |
  Format-Table -AutoSize

# Find teams with no owners (governance gap)
Get-Team | ForEach-Object {
  $Owners = Get-TeamMember -GroupId $_.GroupId | Where-Object {$_.Role -eq "Owner"}
  if ($Owners.Count -eq 0) {
    Write-Host "NO OWNER: $($_.DisplayName)" -ForegroundColor Red
  }
}

# Create a new Private team
$NewTeam = New-Team -DisplayName "Project Phoenix" -Description "Project Phoenix workspace" -Visibility Private
Write-Host "Team created: $($NewTeam.GroupId)"

# Add a member and an owner
Add-TeamMember -GroupId $NewTeam.GroupId -User "john.doe@contoso.com"
Add-TeamMember -GroupId $NewTeam.GroupId -User "jane.smith@contoso.com" -Role Owner

# Get all channels and create a Private channel
Get-TeamChannel -GroupId $NewTeam.GroupId | Select-Object DisplayName,MembershipType | Format-Table -AutoSize
New-TeamChannel -GroupId $NewTeam.GroupId -DisplayName "Leadership Only" -MembershipType Private

# Archive an inactive team (makes it read-only, preserves content)
Set-TeamArchivedState -GroupId "team-groupid-here" -Archived $true

Connect-MicrosoftTeams

# Get all Teams channel policies
Get-CsTeamsChannelsPolicy | Select-Object Identity,AllowPrivateChannelCreation,AllowSharedChannelCreation | Format-Table -AutoSize

# Create a restricted Teams channels policy
New-CsTeamsChannelsPolicy -Identity "RestrictedChannels" `
  -AllowPrivateChannelCreation $false `
  -AllowSharedChannelCreation $false

# Assign the policy to a specific user
Grant-CsTeamsChannelsPolicy -Identity "user@contoso.com" -PolicyName "RestrictedChannels"

# Batch assign policy to multiple users at once
New-CsBatchPolicyAssignmentOperation `
  -PolicyType TeamsChannelsPolicy `
  -PolicyName "RestrictedChannels" `
  -Identity @("user1@contoso.com","user2@contoso.com","user3@contoso.com") `
  -OperationName "Restrict channel creation for contractors"

# Set Teams update channel for IT pilot group
New-CsTeamsUpdateManagementPolicy -Identity "ITPilotRing" -UseNewTeamsClient MicrosoftChoice -AllowPreview $true
Grant-CsTeamsUpdateManagementPolicy -Identity "itadmin@contoso.com" -PolicyName "ITPilotRing"

Connect-MicrosoftTeams

# Get current guest access configurations
Get-CsTeamsGuestCallingConfiguration
Get-CsTeamsGuestMeetingConfiguration
Get-CsTeamsGuestMessagingConfiguration

# Configure guest calling capabilities
Set-CsTeamsGuestCallingConfiguration -AllowPrivateCalling $true

# Configure guest meeting capabilities
Set-CsTeamsGuestMeetingConfiguration `
  -AllowIPVideo $true `
  -AllowMeetNow $false `
  -LiveCaptionsEnabledType Disabled

# Configure guest messaging capabilities (disable Giphy and memes)
Set-CsTeamsGuestMessagingConfiguration `
  -AllowUserChat $true `
  -AllowGiphy $false `
  -AllowMemes $false

# Enable open federation (communicate with all external tenants)
Set-CsExternalAccessPolicy -Identity Global -EnableFederationAccess $true

# Block a specific domain from federating with your tenant
$BlockList = New-CsEdgeBlockList -BlockedDomain (New-CsEdgeDomainPattern -Domain "blocked-org.com")
Set-CsTenantFederationConfiguration -BlockedDomains $BlockList

Connect-MicrosoftTeams

# Get all meeting policies
Get-CsTeamsMeetingPolicy | Select-Object Identity,AllowAnonymousUsersToJoinMeeting,AutoAdmittedUsers,AllowCloudRecording,AllowTranscription | Format-Table -AutoSize

# Create a secure internal meeting policy
New-CsTeamsMeetingPolicy -Identity "SecureInternalMeetings" `
  -AllowAnonymousUsersToJoinMeeting $false `
  -AutoAdmittedUsers "EveryoneInCompanyExcludingGuests" `
  -AllowCloudRecording $true `
  -AllowTranscription $true `
  -AllowIPVideo $true `
  -AllowScreenSharing "EntireScreen"

# Create an external-facing meeting policy (lobby-first for all)
New-CsTeamsMeetingPolicy -Identity "ExternalMeetings" `
  -AllowAnonymousUsersToJoinMeeting $true `
  -AutoAdmittedUsers "OrganizerOnly" `
  -AllowCloudRecording $false `
  -AllowTranscription $false

# Assign meeting policy to a user
Grant-CsTeamsMeetingPolicy -Identity "user@contoso.com" -PolicyName "SecureInternalMeetings"

# Get audio conferencing bridge numbers
Get-CsOnlineDialInConferencingServiceNumber | Select-Object Number,City,CountryOrRegion,IsDefault | Format-Table -AutoSize

# Get all users with audio conferencing assigned
Get-CsOnlineDialInConferencingUser -ResultSize Unlimited |
  Select-Object Identity,ConferenceId,TollNumber,TollFreeNumber |
  Format-Table -AutoSize

Connect-MicrosoftTeams

# Get current events policy
Get-CsTeamsEventsPolicy | Select-Object Identity,AllowWebinars,AllowTownhalls,EventExpiryDays | Format-Table -AutoSize

# Create a full events policy (webinars + town halls)
New-CsTeamsEventsPolicy -Identity "FullEventsAccess" `
  -AllowWebinars Enabled `
  -AllowTownhalls Enabled `
  -EventExpiryDays 90

# Create a restricted policy (webinars only)
New-CsTeamsEventsPolicy -Identity "WebinarOnly" `
  -AllowWebinars Enabled `
  -AllowTownhalls Disabled

# Grant policy to a group (batch group assignment)
New-CsBatchGroupPolicyAssignmentOperation `
  -PolicyType TeamsEventsPolicy `
  -PolicyName "FullEventsAccess" `
  -GroupIds @("group-id-here") `
  -OperationName "Assign events policy to All Staff"

Connect-MicrosoftTeams

# Get all unassigned phone numbers in the tenant
Get-CsPhoneNumberAssignment -CapabilitiesContain UserAssignment -PstnAssignmentStatus Unassigned |
  Select-Object TelephoneNumber,NumberType,CapabilitiesName |
  Format-Table -AutoSize

# Assign a Calling Plan number to a user
Set-CsPhoneNumberAssignment `
  -Identity "user@contoso.com" `
  -PhoneNumber "+14255551234" `
  -PhoneNumberType CallingPlan

# Enable the user for Enterprise Voice (Teams Phone)
Set-CsPhoneNumberAssignment `
  -Identity "user@contoso.com" `
  -EnterpriseVoiceEnabled $true

# Export all Teams Phone-enabled users
Get-CsOnlineUser -Filter {EnterpriseVoiceEnabled -eq $true} |
  Select-Object DisplayName,SipAddress,LineUri,EnterpriseVoiceEnabled |
  Export-Csv -Path "TeamsPhoneUsers.csv" -NoTypeInformation

# Create a restricted calling policy (block external forwarding)
New-CsTeamsCallingPolicy -Identity "NoExternalForwarding" `
  -AllowPrivateCalling $true `
  -AllowCallForwardingToUser $true `
  -AllowCallForwardingToPhone $false `
  -AllowVoicemail AlwaysEnabled

# Get voicemail policies
Get-CsOnlineVoicemailPolicy | Select-Object Identity,EnableTranscription,MaximumRecordingLength | Format-Table -AutoSize

Connect-MicrosoftTeams

# Step 1: Create a Resource Account for the Call Queue
New-CsOnlineApplicationInstance `
  -UserPrincipalName "cq-itsupport@contoso.com" `
  -DisplayName "IT Support Queue" `
  -ApplicationId "11cd3e2e-fccb-42ad-ad00-878b93575e07"  # Call Queue App ID

Sync-CsOnlineApplicationInstance -ObjectId (Get-CsOnlineApplicationInstance -Identity "cq-itsupport@contoso.com").ObjectId

# Step 2: Assign a phone number to the resource account
Set-CsPhoneNumberAssignment `
  -Identity "cq-itsupport@contoso.com" `
  -PhoneNumber "+14255559876" `
  -PhoneNumberType CallingPlan

# Step 3: Create the Call Queue with round-robin routing
$Agents = @(
  (Get-CsOnlineUser -Identity "agent1@contoso.com").Identity,
  (Get-CsOnlineUser -Identity "agent2@contoso.com").Identity
)

New-CsCallQueue `
  -Name "IT Support Queue" `
  -UseDefaultMusicOnHold $true `
  -DistributionMethod RoundRobin `
  -AgentAlertTime 30 `
  -OverflowThreshold 50 `
  -TimeoutThreshold 600 `
  -Users $Agents

# Get all call queues and auto attendants
Get-CsCallQueue | Select-Object Name,DistributionMethod,AgentAlertTime,OverflowThreshold | Format-Table -AutoSize
Get-CsAutoAttendant | Select-Object Name,LanguageId,TimeZoneId | Format-Table -AutoSize
Get-CsOnlineApplicationInstance | Select-Object DisplayName,UserPrincipalName,PhoneNumber | Format-Table -AutoSize

Connect-MicrosoftTeams

# Get all messaging policies
Get-CsTeamsMessagingPolicy | Select-Object Identity,AllowGiphy,AllowMemes,AllowUserDeleteMessage,AllowOwnerDeleteMessage,ReadReceiptsEnabledType | Format-Table -AutoSize

# Create a compliant messaging policy for regulated users
New-CsTeamsMessagingPolicy -Identity "RegulatedUserPolicy" `
  -AllowGiphy $false `
  -AllowMemes $false `
  -AllowStickers $false `
  -AllowUserEditMessage $true `
  -AllowUserDeleteMessage $false `
  -AllowOwnerDeleteMessage $false `
  -AllowPriorityMessages $false `
  -ReadReceiptsEnabledType UserPreference

# Create a standard policy for general staff
New-CsTeamsMessagingPolicy -Identity "StandardPolicy" `
  -AllowGiphy $true `
  -GiphyRatingType Moderate `
  -AllowMemes $true `
  -AllowUserDeleteMessage $true `
  -AllowPriorityMessages $true

# Assign a messaging policy to a user
Grant-CsTeamsMessagingPolicy -Identity "user@contoso.com" -PolicyName "RegulatedUserPolicy"

# Remove custom assignment (revert to Global policy)
Grant-CsTeamsMessagingPolicy -Identity "user@contoso.com" -PolicyName $null

Connect-MicrosoftTeams

# Get all apps in the Teams app catalogue
Get-CsTeamsApp | Select-Object Id,DisplayName,DistributionMethod,ExternalId |
  Sort-Object DistributionMethod,DisplayName |
  Format-Table -AutoSize

# Get all app permission policies
Get-CsTeamsAppPermissionPolicy |
  Select-Object Identity,DefaultCatalogApps,GlobalCatalogApps,PrivateCatalogApps |
  Format-Table -AutoSize

# Block all third-party apps (only allow Microsoft + custom apps)
New-CsTeamsAppPermissionPolicy -Identity "BlockThirdPartyApps" `
  -DefaultCatalogApps AllowedAppList `
  -GlobalCatalogApps BlockedAppList `
  -PrivateCatalogApps AllowedAppList

# Get all app setup policies
Get-CsTeamsAppSetupPolicy | Select-Object Identity,AllowUserPinning,AllowSideloading | Format-Table -AutoSize

# Assign an app setup policy to a user
Grant-CsTeamsAppSetupPolicy -Identity "frontlineworker@contoso.com" -PolicyName "FrontlineWorkers"

Connect-MgGraph -Scopes "Reports.Read.All"

# Export Teams user activity report (last 30 days)
Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/reports/getTeamsUserActivityUserDetail(period='D30')" `
  -OutputFilePath "TeamsUserActivity30Days.csv"
Write-Host "Teams user activity report exported."

# Export Teams device usage report
Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/reports/getTeamsDeviceUsageUserDetail(period='D30')" `
  -OutputFilePath "TeamsDeviceUsage30Days.csv"

# Get Teams activity summary counts
$Summary = Invoke-MgGraphRequest -Method GET `
  "https://graph.microsoft.com/v1.0/reports/getTeamsUserActivityCounts(period='D30')"
$Summary.value | Format-Table

# Get all Teams-mode users for governance review
Connect-MicrosoftTeams
Get-CsOnlineUser -ResultSize Unlimited |
  Where-Object {$_.TeamsUpgradeEffectiveMode -eq "TeamsOnly"} |
  Select-Object DisplayName,SipAddress,WhenChanged |
  Export-Csv -Path "AllTeamsUsers.csv" -NoTypeInformation