How to check team member permissions in Microsoft Teams

Before you start

Use an account with the Teams Administrator role: Microsoft says Teams service admins can read teams they aren't a member of. The PowerShell example requests TeamSettings.Read.All, which reads every team's settings and needs administrator consent.

Know where the settings come from. Team owners manage them in Teams, and organisation-wide policies can limit them further: whether a person can create a private channel depends on both the team's setting and the policy assigned to them. The examples read and export; they change no team's settings.

Option 1

Check team member permissions with PowerShell

Install the modules once, then connect and export 1 row per team. The script reads each team on its own to get its settings, so a tenant with many teams takes a while.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Teams -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'TeamSettings.Read.All' -NoWelcome
try {
    $teams = @(Get-MgTeam -All)
    $report = @(foreach ($item in $teams) {
        $team = Get-MgTeam -TeamId $item.Id
        [pscustomobject]@{
            Team = $team.DisplayName
            Archived = $team.IsArchived
            MembersCreateChannels = $team.MemberSettings.AllowCreateUpdateChannels
            MembersCreatePrivateChannels = $team.MemberSettings.AllowCreatePrivateChannels
            MembersDeleteChannels = $team.MemberSettings.AllowDeleteChannels
            MembersManageApps = $team.MemberSettings.AllowAddRemoveApps
            MembersManageTabs = $team.MemberSettings.AllowCreateUpdateRemoveTabs
            MembersManageConnectors = $team.MemberSettings.AllowCreateUpdateRemoveConnectors
            GuestsCreateChannels = $team.GuestSettings.AllowCreateUpdateChannels
            GuestsDeleteChannels = $team.GuestSettings.AllowDeleteChannels
            OwnersDeleteMessages = $team.MessagingSettings.AllowOwnerDeleteMessages
            TeamMentions = $team.MessagingSettings.AllowTeamMentions
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'The tenant has no teams.'
    } else {
        $report | Sort-Object Team |
            Export-Csv -Path './team-member-permissions.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) teams exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Each setting is True when the people it names can do the thing in that team. Sort by a column, such as MembersDeleteChannels, to find the teams that differ from the rest. To add messaging settings, such as AllowUserDeleteMessages or AllowChannelMentions, add them from $team.MessagingSettings in the same way.

Option 2

Review a team's settings in the admin centre

1. Sign in to the Microsoft Teams admin centre for the correct tenant.
2. Go to Teams > Manage teams and select the team's name to open its profile.
3. Open the Settings tab.
4. Read Member permissions, Guest permissions, Mentions and the fun settings for Giphy, stickers and memes.
5. Leave the page without turning any setting on or off.

This suits checking 1 team, such as one whose owner asks why members can't add a channel. It does not suit comparing teams, since each one opens on its own.

Common questions

Why can't members create a private channel when the team allows it?

Private channels have 2 controls. Microsoft says policies decide which people in the organisation may create private channels, and team owners then turn the ability on or off for members in each team. A person needs both.

Can guests create private channels?

No. Microsoft says any team owner or member can create a private channel by default, but guests can't. A team's guest settings cover creating, updating and deleting channels.

Who are the members and guests of each team?

The settings say what each role can do, not who holds it. To list each team's owners, members and guests, see how to export team members in Microsoft Teams.