DEV Community

Anthony Buhnerkemper
Anthony Buhnerkemper

Posted on

Microsoft Teams with PowerShell 7: Find and Fix Orphaned Teams

#powershell #microsoft365 #azure #security

I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is for Microsoft Teams admins. It uses PowerShell 7 and the MicrosoftTeams module 6.x.

Repo: teams-powershell-toolkit

The problem it solves

Teams sprawl is real. Owners leave and teams end up with nobody in charge. Guests pile up.

A team with no owner can't approve members or manage settings. Someone has to fix it.

These scripts find the gaps and help you fix them in bulk.

Highlight scripts

Get-OrphanedTeams.ps1

Finds teams with no owner, or fewer owners than you want. The default is two.

./Get-OrphanedTeams.ps1
Enter fullscreen mode Exit fullscreen mode

Add-TeamOwnerToOrphanedTeam.ps1

Takes the CSV from the report above and adds an owner to each team.

./Add-TeamOwnerToOrphanedTeam.ps1 -CsvPath ./output/OrphanedTeams-20260101-0900.csv -Owner teams-admin@contoso.com -WhatIf
Enter fullscreen mode Exit fullscreen mode

Get-TeamsOwnerGuestAudit.ps1

Lists owners and guests for every team, one row per person. Use -GuestsOnly for a guest review.

./Get-TeamsOwnerGuestAudit.ps1 -GuestsOnly
Enter fullscreen mode Exit fullscreen mode

Other scripts cover team inventory, policy assignment from CSV, policy reports, Teams Phone basics and bulk channel creation.

How the scripts are built

  • PowerShell 7.4 or later.
  • Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
  • Reports export to CSV.
  • Change scripts support -WhatIf and -Confirm.
  • Certificate (app-only) or interactive sign-in.
  • No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a dev or test tenant first. Read each script before you run it.

My usual workflow

I start with the reports. They are read-only and safe. I open the CSV in Excel and look for anything odd.

Then I pick one fix. I run the change script with -WhatIf and read the output. If it looks right, I run it again for real.

For jobs I repeat, I use a certificate and schedule the script. That way nobody has to remember to run it.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/teams-powershell-toolkit.git
cd teams-powershell-toolkit
Enter fullscreen mode Exit fullscreen mode

Every toolkit ships the same Connect-M365Admin script. Dot-source it, then connect.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Teams -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
Connect-M365Admin -Service Teams
Enter fullscreen mode Exit fullscreen mode

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have nine more free toolkits that use the same pattern: graph-powershell7-admin-toolkit, entra-id-powershell-toolkit, exchange-online-powershell-toolkit, sharepoint-online-powershell-toolkit, onedrive-powershell-toolkit, intune-powershell-toolkit, defender-xdr-powershell-toolkit, sentinel-kql-toolkit, purview-compliance-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.

Top comments (0)