Microsoft 365 Alert – Service Degradation – Microsoft Teams – Admins using New-CsBatchPolicyPackageAssignmentOperation cmdlet in Teams PowerShell Module may experience failures – RESOLVED

21/11/2023 09:20:00 AM

NHSMail Reference: INC39692189

Microsoft Reference: TM692007

Issue Status: RESOLVED

Issue Description: Admins using New-CsBatchPolicyPackageAssignmentOperation cmdlet in Teams PowerShell Module may experience failures.

More info: The cmdlet New-CsBatchPolicyPackageAssignmentOperation will indicate that the Package has been assigned; however, the individual policies within the package may not be successfully assigned to the users.

Admins can perform one of the following five provided workarounds based on to how many users they are attempting to apply the policy package:

1. Assign a policy package to one user in the Microsoft Teams admin center: You can use the Microsoft Teams admin center to assign a policy package to a single user. To do this, go to Users, select the user, select Policies, and then select Edit next to Policy package. Then, choose the package you want to assign and select Apply. For more details, see the page https://learn.microsoft.com/en-us/microsoftteams/assign-policy-packages#assign-a-policy-package-to-one-user

2. Assign a policy package to multiple users in the Microsoft Teams admin center for up to 20 users: You can also use the Microsoft Teams admin center to assign a policy package to multiple users at once for up to 20 users per request (<= 20 users). To do this, go to Policy packages, select the package you want to assign, and then select Manage users. Then, search for and add the users you want to assign the package. For more details, see the page https://learn.microsoft.com/en-us/microsoftteams/assign-policy-packages#assign-a-policy-package-to-multiple-users

3. Assign a policy package to a group of users in the Microsoft Teams admin center: If you have a group of users, such as a security group or a distribution list, you can assign a policy package to the group in the Microsoft Teams admin center. To do this, go to Policy packages, select Add, and then search for and add the group you want to assign the package. You can also manage the ranking of the policy assignments for the group. For more details, see the page https://learn.microsoft.com/en-us/microsoftteams/assign-policy-packages#assign-a-policy-package-to-a-group-of-users-in-the-admin-center

4. Assign a policy package to a group of users with Grant-CsGroupPolicyPackageAssignment cmdlet: If you prefer to use PowerShell, you can assign a policy package to a group of users with the Grant-CsGroupPolicyPackageAssignment cmdlet. You can specify a group by using the object ID, SIP address, or email address. You also need to specify a group assignment ranking for each policy type in the policy package. For more details, see the page https://learn.microsoft.com/en-us/microsoftteams/assign-policy-packages#assign-a-policy-package-to-a-group-of-users

5. Assign a policy package to multiple users with Grant-CsUserPolicyPackage cmdlet for up to 20 users per request: Another PowerShell option is to use the Grant-CsUserPolicyPackage cmdlet to assign a policy package to multiple users. You can specify the users by their object ID or SIP address for up to 20 users per request (<= 20 users). You can loop for each user in a list of more than 20 users. For more details, see the page https://learn.microsoft.com/en-us/powershell/module/teams/grant-csuserpolicypackage?view=teams-ps, https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/foreach-object, https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_foreach

Final Update: 01/11/2023 08:30:00 AM – Microsoft have identified a configuration issue that was preventing a portion of impacted environments from receiving the fix. They’ve resolved the configuration issue and confirmed the deployment of the fix completed as expected. Furthermore, They’ve validated with our internal monitoring and testing that the issue is resolved, and the impact is remediated. 

Scope of impact: Admins attempting to assign a Policy package to a batch of users using the cmdlet New-CsBatchPolicyPackageAssignmentOperation in the Teams PowerShell Module are impacted.

Root cause: A policy service change introduced a code issue that’s preventing Policy Packages from being applied to batches of users via cmdlet, which is resulting in impact.

Next steps: Microsoft are further reviewing the policy service update to understand how the code issue was introduced, and to understand what prevented it from being detected in our update testing and validation procedures, which will allow us to prevent similar issues in future updates.