Teams Shared Channel Setup Guide

# Install the module if you don't have it
# Install-Module Microsoft.Graph -Scope CurrentUser

# Connect with the required permissions
Connect-MgGraph -Scopes "Policy.Read.All","Policy.Read.ConditionalAccess"

# Check cross-tenant access settings for PressW
$presswTenantId = "6a548927-a7e8-4842-bce5-22513aee69db"
$partner = Get-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $presswTenantId

Write-Host "`n=== PressW Cross-Tenant Access Configuration ===" -ForegroundColor Cyan

# Check Inbound B2B Direct Connect
$inboundDC = $partner.B2bDirectConnectInbound
if ($null -eq $inboundDC) {
    Write-Host "[WARNING] Inbound B2B Direct Connect: Not configured (inheriting from default)" -ForegroundColor Yellow
    $default = Get-MgPolicyCrossTenantAccessPolicyDefault
    $defaultInbound = $default.B2bDirectConnectInbound
    if ($defaultInbound.UsersAndGroups.AccessType -eq "allowed") {
        Write-Host "  -> Default allows inbound B2B Direct Connect (OK)" -ForegroundColor Green
    } else {
        Write-Host "  -> Default BLOCKS inbound B2B Direct Connect (PROBLEM)" -ForegroundColor Red
    }
} else {
    if ($inboundDC.UsersAndGroups.AccessType -eq "allowed" -and $inboundDC.Applications.AccessType -eq "allowed") {
        Write-Host "[OK] Inbound B2B Direct Connect: Allowed" -ForegroundColor Green
    } else {
        Write-Host "[PROBLEM] Inbound B2B Direct Connect: Not fully allowed" -ForegroundColor Red
        Write-Host "  Users/Groups: $($inboundDC.UsersAndGroups.AccessType)"
        Write-Host "  Applications: $($inboundDC.Applications.AccessType)"
    }
}

# Check Outbound B2B Direct Connect
$outboundDC = $partner.B2bDirectConnectOutbound
if ($null -eq $outboundDC) {
    Write-Host "[WARNING] Outbound B2B Direct Connect: Not configured (inheriting from default)" -ForegroundColor Yellow
    if (-not $default) { $default = Get-MgPolicyCrossTenantAccessPolicyDefault }
    $defaultOutbound = $default.B2bDirectConnectOutbound
    if ($defaultOutbound.UsersAndGroups.AccessType -eq "allowed") {
        Write-Host "  -> Default allows outbound B2B Direct Connect (OK)" -ForegroundColor Green
    } else {
        Write-Host "  -> Default BLOCKS outbound B2B Direct Connect (PROBLEM)" -ForegroundColor Red
    }
} else {
    if ($outboundDC.UsersAndGroups.AccessType -eq "allowed" -and $outboundDC.Applications.AccessType -eq "allowed") {
        Write-Host "[OK] Outbound B2B Direct Connect: Allowed" -ForegroundColor Green
    } else {
        Write-Host "[PROBLEM] Outbound B2B Direct Connect: Not fully allowed" -ForegroundColor Red
        Write-Host "  Users/Groups: $($outboundDC.UsersAndGroups.AccessType)"
        Write-Host "  Applications: $($outboundDC.Applications.AccessType)"
    }
}

# Check Inbound B2B Collaboration
$inboundCollab = $partner.B2bCollaborationInbound
if ($null -eq $inboundCollab) {
    Write-Host "[WARNING] Inbound B2B Collaboration: Not configured (inheriting from default)" -ForegroundColor Yellow
} else {
    if ($inboundCollab.UsersAndGroups.AccessType -eq "allowed" -and $inboundCollab.Applications.AccessType -eq "allowed") {
        Write-Host "[OK] Inbound B2B Collaboration: Allowed" -ForegroundColor Green
    } else {
        Write-Host "[PROBLEM] Inbound B2B Collaboration: Not fully allowed" -ForegroundColor Red
    }
}

# Check Outbound B2B Collaboration
$outboundCollab = $partner.B2bCollaborationOutbound
if ($null -eq $outboundCollab) {
    Write-Host "[WARNING] Outbound B2B Collaboration: Not configured (inheriting from default)" -ForegroundColor Yellow
} else {
    if ($outboundCollab.UsersAndGroups.AccessType -eq "allowed" -and $outboundCollab.Applications.AccessType -eq "allowed") {
        Write-Host "[OK] Outbound B2B Collaboration: Allowed" -ForegroundColor Green
    } else {
        Write-Host "[PROBLEM] Outbound B2B Collaboration: Not fully allowed" -ForegroundColor Red
    }
}

# Check Inbound Trust Settings (for CA policy compatibility)
Write-Host "`n=== Inbound Trust Settings ===" -ForegroundColor Cyan
$trust = $partner.InboundTrust
if ($null -eq $trust) {
    Write-Host "[INFO] No inbound trust settings configured" -ForegroundColor Yellow
    Write-Host "  If you have CA policies requiring MFA or device compliance for external users,"
    Write-Host "  shared channels WILL be blocked. See Part 2 of the setup guide."
} else {
    if ($trust.IsMfaAccepted) {
        Write-Host "[OK] Trust MFA from PressW: Yes" -ForegroundColor Green
    } else {
        Write-Host "[WARNING] Trust MFA from PressW: No" -ForegroundColor Yellow
    }
    if ($trust.IsCompliantDeviceAccepted) {
        Write-Host "[OK] Trust compliant devices from PressW: Yes" -ForegroundColor Green
    } else {
        Write-Host "[WARNING] Trust compliant devices from PressW: No" -ForegroundColor Yellow
    }
    if ($trust.IsHybridAzureADJoinedDeviceAccepted) {
        Write-Host "[OK] Trust hybrid joined devices from PressW: Yes" -ForegroundColor Green
    } else {
        Write-Host "[WARNING] Trust hybrid joined devices from PressW: No" -ForegroundColor Yellow
    }
}

# Check for Conditional Access policies that may block B2B Direct Connect
Write-Host "`n=== Conditional Access Policy Check ===" -ForegroundColor Cyan
try {
    $policies = Get-MgIdentityConditionalAccessPolicy -All
    $potentialBlockers = @()
    foreach ($policy in $policies) {
        if ($policy.State -ne "enabled") { continue }

        $targetsExternalUsers = $false
        $requiresMfaOrDevice = $false

        # Check if policy targets guest/external users or all users
        $includeUsers = $policy.Conditions.Users.IncludeUsers
        $includeGuestsOrExternal = $policy.Conditions.Users.IncludeGuestsOrExternalUsers
        if ($includeUsers -contains "All" -or $null -ne $includeGuestsOrExternal) {
            $targetsExternalUsers = $true
        }

        # Check if policy requires MFA, compliant device, or hybrid join
        $grantControls = $policy.GrantControls.BuiltInControls
        if ($grantControls -contains "mfa" -or $grantControls -contains "compliantDevice" -or $grantControls -contains "domainJoinedDevice") {
            $requiresMfaOrDevice = $true
        }
        if ($policy.GrantControls.BuiltInControls -contains "block") {
            $requiresMfaOrDevice = $true
        }

        if ($targetsExternalUsers -and $requiresMfaOrDevice) {
            $potentialBlockers += $policy
        }
    }

    if ($potentialBlockers.Count -eq 0) {
        Write-Host "[OK] No CA policies found that would block B2B Direct Connect users" -ForegroundColor Green
    } else {
        Write-Host "[WARNING] Found $($potentialBlockers.Count) CA policy(ies) that may block shared channels:" -ForegroundColor Yellow
        foreach ($p in $potentialBlockers) {
            Write-Host "  - $($p.DisplayName) (requires: $($p.GrantControls.BuiltInControls -join ', '))" -ForegroundColor Yellow
        }
        Write-Host ""
        Write-Host "  These policies will BLOCK B2B Direct Connect users unless:" -ForegroundColor Yellow
        Write-Host "    1. You configure Inbound Trust to accept MFA/device claims from PressW, OR" -ForegroundColor Yellow
        Write-Host "    2. You exclude B2B direct connect users from these policies" -ForegroundColor Yellow
    }
} catch {
    Write-Host "[SKIPPED] Could not read CA policies (requires Policy.Read.ConditionalAccess permission)" -ForegroundColor Yellow
}

Write-Host "`n=== Summary ===" -ForegroundColor Cyan
Write-Host "If any items show [PROBLEM], shared channels will NOT work."
Write-Host "If items show [WARNING], shared channels may be blocked depending"
Write-Host "on your Conditional Access configuration. See the setup guide for details."

Disconnect-MgGraph