Automating the Removal of Users from Microsoft Teams Shared Channels with PowerShell

Automating User Removal from Microsoft Teams Shared Channels

Managing user memberships in Microsoft Teams shared channels is an essential task for IT administrators, especially in large organizations where multiple teams and shared channels are used extensively. This PowerShell script automates the process of identifying shared channels within Teams, filtering out specific users, and removing them from the channel memberships.

---

Script Overview

This script automates the process of managing shared channel memberships across Teams. It performs the following actions:

Function	Description	Business Value
Channel Discovery	Identifies all shared channels	Complete visibility
User Filtering	Filters users by domain criteria	Targeted removal
Automated Removal	Removes filtered users	Security enforcement
Process Logging	Records all actions	Audit trail

Key Capabilities

Feature	Capability	Impact
Domain-Based Filtering	Targets specific email domains	Precise user selection
Channel Type Detection	Distinguishes hosted vs incoming channels	Comprehensive coverage
Batch Processing	Handles multiple teams simultaneously	Scalable solution
Error Handling	Logs processing issues	Troubleshooting support

---

Prerequisites and Setup

Before running the script, ensure you have:

Technical Requirements

Requirement	Description	Purpose
Microsoft Teams PowerShell Module	Installed and configured	API access
Administrative Permissions	Channel management rights	User removal capability
Shared Channels	Configured in Teams environment	Target resources

---

PowerShell Script Architecture

1. Core Function: Process_TeamChannel

The core of the script is a function called Process_TeamChannel. This function is designed to:

• Retrieve all shared channels for a given team
• Identify the type of shared channel (whether it is hosted by the team or incoming from another team)
• Filter out specific users based on their email domains
• Remove those users from the shared channel

Function Process_TeamChannel {
    param (
        [string]$TeamId,
        [string]$OutputCSV
    )

    $channels = Get-TeamAllChannel -GroupId $TeamId -MembershipType Shared

    foreach ($channel in $channels) {
        $ChannelName = $channel.DisplayName
        $HostTeamId = $channel.HostTeamId
        $SharedChannelType = if ($HostTeamId -eq $TeamId) {
            "Team hosted channel"
        } else {
            "Incoming channel"
        }
    }
}

The Get-TeamAllChannel cmdlet retrieves all shared channels associated with the team, which is identified by its TeamId.

2. Filtering Users by Domain

The script then retrieves the members of the shared channel using the Get-TeamChannelUser cmdlet. It filters out users who belong to specific email domains.

$Membership = Get-TeamChannelUser -GroupId $HostTeamId -DisplayName $ChannelName
$Membership = $Membership | Where-Object {
    ($_.User -Like "*@XXX.onmicrosoft.com") -or
    ($_.User -Like "*@XXX.onmicrosoft.com")
}

This filtering step ensures that only users from the specified domains are targeted for removal.

3. Removing Users from Shared Channels

Once the users are identified, the script removes them from the shared channel using the Remove-TeamChannelUser cmdlet.

foreach ($Member in $Membership) {
    Write-Output "Removing $($Member.User) from $($_.'Team Name') \ $ChannelName"
    Remove-TeamChannelUser -DisplayName $ChannelName -GroupId $TeamId -User $($Member.User) -Role $($Member.Role)
}

For each user, a message is logged indicating which user is being removed from which shared channel. The actual removal is handled by Remove-TeamChannelUser.

4. Processing All Teams

After defining the Process_TeamChannel function, the script applies this function to all teams within the tenant using the Get-Team cmdlet.

# Process all teams
Get-Team | ForEach-Object {
    $TeamId = $_.GroupId
    Process_TeamChannel -TeamId $TeamId
}

This loop ensures that all teams in the environment are scanned for shared channels, and the targeted users are removed from those channels.

---

Use Cases and Applications

Ideal Scenarios

This script is particularly useful in scenarios where:

Scenario	Application	Value
Domain-Based Access Control	Remove users from specific domains	Enforce access policies
Partner Management	Clean up external user access	Maintain security boundaries
Policy Enforcement	Automate compliance requirements	Reduce manual effort
Security Hardening	Remove unauthorized access	Improve security posture

Example Implementation

Imagine that you need to remove external users (from certain partner domains) who were previously invited to your organization’s shared channels. Instead of manually searching for and removing these users from each team and channel, this script automates the entire process, ensuring that your shared channels remain secure and compliant with internal policies.

---

Implementation Best Practices

Best Practice	Description	Implementation
Test Environment	Verify script functionality before production	Reduce deployment risks
Error Monitoring	Review script output logs	Ensure successful execution
Membership Backup	Export current memberships before removal	Maintain audit trail
Domain Validation	Confirm target domains are correct	Prevent accidental removals

---

Business Impact and Benefits

Why Automate Shared Channel Membership Management?

Managing user access across multiple shared channels can be time-consuming, especially if done manually.

Challenge	Manual Process	Automated Solution
Time Investment	Hours per cleanup cycle	Minutes of processing
Accuracy	Risk of missing users	Complete coverage
Consistency	Variable application	Standardized process
Auditability	Manual documentation	Automatic logging

Security and Compliance Benefits

Benefit	Description	Impact
Access Control	Enforce domain-based policies	Reduce security risks
Compliance	Meet regulatory requirements	Maintain standards
Governance	Centralized access management	Improve control
Audit Trail	Automated action logging	Support investigations

---

Processing Logic and Workflow

Channel Type Detection

The script distinguishes between two types of shared channels:

Channel Type	Description	Processing Approach
Team Hosted	Channel owned by the team	Direct processing
Incoming	Channel shared from another team	External processing

User Filtering Strategy

Filter Criteria	Target Users	Removal Logic
Domain Pattern	*@XXX.onmicrosoft.com	Pattern matching
Multiple Domains	Various partner domains	OR logic applied
Exact Match	Specific domain names	Precise targeting

---

Conclusion

Key Takeaway: This PowerShell script provides an efficient way to manage shared channel memberships in Microsoft Teams by automating the process of identifying and removing specific users. By integrating with Microsoft Teams PowerShell, the script ensures that all teams and shared channels are processed, saving time and reducing the risk of errors in large environments.

Whether you’re performing routine audits, enforcing compliance, or managing external user access, this script offers a powerful tool for keeping your Teams environment secure and well-organized. By customizing the script to match your organization’s needs, you can automate complex tasks and focus on higher-level administrative responsibilities.