Commands › Microsoft Teams
Grant-CsExternalAccessPolicy
Enables you to assign an external access policy to a user or a group of users.
Quick start script
# Grant-CsExternalAccessPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-MicrosoftTeams -CertificateThumbprint $thumb -ApplicationId $appId -TenantId $tenantId
# 2. Run and inspect
Grant-CsExternalAccessPolicy -Global <SwitchParameter> -Group <String> -Identity <UserIdParameter> | Format-List
# 3. Export for evidence / drift tracking
Grant-CsExternalAccessPolicy | Export-Clixml .\CsExternalAccessPolicy-$(Get-Date -Format yyyyMMdd).xmlSyntax — 4 parameter sets
Identity (Default)
Grant-CsExternalAccessPolicy [<CommonParameters>]GrantToUser
Grant-CsExternalAccessPolicy [-Identity] <String> [[-PolicyName] <String>] [<CommonParameters>]GrantToGroup
Grant-CsExternalAccessPolicy [[-PolicyName] <String>] [-Group] <String> [-Rank] <Int32> [<CommonParameters>]GrantToTenant
Grant-CsExternalAccessPolicy [[-PolicyName] <String>] [-Global] [-Force] [<CommonParameters>]Parameters (8)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -DomainController | Fqdn | Enables you to specify the fully qualified domain name (FQDN) of a domain controller to be contacted when assigning the new policy. If this parameter is not specified, then the Grant-CsExternalAccessPolicy cmdlet... | |
| -Global | SwitchParameter | yes | When you use this cmdlet without specifying a user identity, the policy applies to all users in your tenant. To skip a warning when you do this operation, specify "-Global". |
| -Group | String | yes | Specifies the group used for the group policy assignment. |
| -Identity | UserIdParameter | yes | Identity of the user account the policy should be assigned to. User Identities can be specified by using one of four formats: 1) the user's SIP address; 2) the user's user principal name (UPN); 3) the user's domain... |
| -PassThru | SwitchParameter | Enables you to pass a user object through the pipeline that represents the user being assigned the policy. By default, the Grant-CsExternalAccessPolicy cmdlet does not pass objects through the pipeline. | |
| -PolicyName | String | "Name" of the policy to be assigned. The PolicyName is simply the policy Identity minus the policy scope (the "tag:" prefix). For example, a policy with the Identity tag:Redmond has a PolicyName equal to Redmond; a... | |
| -Rank | Int32 | yes | The rank of the policy assignment, relative to other group policy assignments for the same policy type. |
| -Tenant | Guid | This parameter is reserved for internal Microsoft use. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.