Managing Private Channel Site Permissions in Microsoft Teams using PnP PowerShell

Microsoft Teams Private Channels create dedicated collaboration spaces within a team that restrict access to specific members. Each private channel has a separate SharePoint site, and managing permissions for these sites using PnP PowerShell ensures secure and efficient access control.

Key Objectives:

✔ Understand how private channels work in Teams
✔ Manage SharePoint site permissions for private channels
✔ Automate permission updates and audits

Step 1: Install and Connect PnP PowerShell

Ensure that you have PnP PowerShell installed and updated:

Install-Module -Name PnP.PowerShell -Force -AllowClobber
Update-Module -Name PnP.PowerShell

Connect to Microsoft Teams and SharePoint Online

# Connect to Microsoft Teams
Connect-MicrosoftTeams

# Connect to SharePoint Online
Connect-PnPOnline -Url "https://yourtenant-admin.sharepoint.com" -Interactive

✔ Authenticates your session to manage Teams and SharePoint sites.

Step 2: Get Private Channel SharePoint Sites

Each private channel in Microsoft Teams has a separate SharePoint site. To list all private channel sites:

$privateChannelSites = Get-PnPTenantSite -Template "TEAMCHANNEL#0"

$privateChannelSites | Select-Object Url, Title, Owner

✔ Filters out only private channel sites.

Step 3: Get Private Channel Site Members

To check who has access to a private channel site:

$siteUrl = "https://yourtenant.sharepoint.com/sites/PrivateChannelSite"

# Connect to the private channel site
Connect-PnPOnline -Url $siteUrl -Interactive

# Get all site users
$users = Get-PnPUser
$users | Select-Object Title, Email, LoginName

✔ Retrieves all users with access to the private channel site.

Step 4: Add a User to a Private Channel Site

To grant a new user access to a private channel site:

$siteUrl = "https://yourtenant.sharepoint.com/sites/PrivateChannelSite"
$newUser = "user@yourdomain.com"

Connect-PnPOnline -Url $siteUrl -Interactive

# Add user to the Members group
Add-PnPUserToGroup -LoginName $newUser -Group "Private Channel Members"
Write-Host "User $newUser added to the private channel site."

✔ Ensures controlled access to the private channel site.

Step 5: Remove a User from a Private Channel Site

To revoke access from a private channel site:

$siteUrl = "https://yourtenant.sharepoint.com/sites/PrivateChannelSite"
$removeUser = "user@yourdomain.com"

Connect-PnPOnline -Url $siteUrl -Interactive

# Remove the user from the private channel site
Remove-PnPUser -LoginName $removeUser

Write-Host "User $removeUser removed from the private channel site."

✔ Prevents unauthorized access.

Step 6: Change a User’s Role in a Private Channel Site

To upgrade or downgrade user roles:

$siteUrl = "https://yourtenant.sharepoint.com/sites/PrivateChannelSite"
$user = "user@yourdomain.com"

Connect-PnPOnline -Url $siteUrl -Interactive

# Remove from Members and add to Owners
Remove-PnPUserFromGroup -LoginName $user -Group "Private Channel Members"
Add-PnPUserToGroup -LoginName $user -Group "Private Channel Owners"

Write-Host "User $user is now an Owner."

✔ Modifies roles for better access control.

Step 7: Audit Private Channel Permissions

To generate a report of all private channel permissions:

$reportPath = "C:\Reports\PrivateChannelPermissions.csv"
$channelSites = Get-PnPTenantSite -Template "TEAMCHANNEL#0"

$results = @()

foreach ($site in $channelSites) {
    Connect-PnPOnline -Url $site.Url -Interactive
    $users = Get-PnPUser

    foreach ($user in $users) {
        $results += [PSCustomObject]@{
            SiteName = $site.Title
            SiteURL = $site.Url
            User = $user.Title
            Email = $user.Email
        }
    }
}

$results | Export-Csv -Path $reportPath -NoTypeInformation
Write-Host "Private Channel Permissions Report saved to $reportPath"

✔ Helps track and audit user access.