Edu access fix

[svrooij]

Microsoft made this announcement back in March 2025, in short you'll need special app access if you want to keep using Assignments and class notebooks. If you provision your Education teams using our regular tools, we will do this for you. Otherwise you have to adapt.

Fast-forward to last Wednesday, we discovered that these features were no longer working for Teams that were created through Graph, we missed the announcement completely. With the release of v0.2.3 the BetterGraph module supports fixing these issues.

Use PowerShell 7 because this module is only supported in PowerShell 7, and will not install in the old powershell or PowerShell ISE

Note

You'll need v0.2.3, with these new scopes, because Microsoft requires you to be a Group Owner before you can change the site permissions. The commands below are adjusted to the new situation. Mind the new scopes and the -ModifyOwners parameter.

Process

1. Add current user as group owner (needs User.Read and Group.ReadWrite.All)
2. Load site id for group (needs Group.Read.All or Group.ReadWrite.All)
3. Load permissions for site id (needs Sites.FullControll.App)
4. Validate permissions for site id
5. Add extra permissions for site id (needs Sites.FullControll.App)
6. Remove current user as owner (needs Group.ReadWrite.All)

Sample code

# Install the module if you haven't already (you'll need v0.2.3 or higher)
Install-Module -Name Svrooij.BetterGraph

# Adjust username to your Global Admin (or sharepoint admin + group admin I presume)
# and open an egde tab with that profile (it will be used for auth)
Connect-BgGraph -NoBroker -Scopes User.Read,Group.ReadWrite.All,Sites.FullControl.All -Username "youradmin@svrooij.io"

# Try filter
Get-BgGroup -Top 10 -Select Id,DisplayName -Filter "startsWith(displayName, 'xyz')" | Format-table -Property Id,DisplayName

# Execute command on all groups
Get-BgGroup -All -Top 50 -Select Id,DisplayName -Filter "startsWith(displayName, 'xyz')" | Restore-BgEduGroupAccess -ModifyOwners
# This command uses async paging to capture the results in an async fashion and do something with the results.

More resources

• Async Paging
• Get-BgGroup source
• Restore-BgEduGroupAccess source

Permissions

These apps get full control of the site, through this command:

BetterGraph-PowerShell/Svrooij.BetterGraph/Commands/Teams/RestoreBgEduGroupAccess.cs

Lines 30 to 37 in 97d4e92

	private readonly Dictionary<string, string> neededAccess = new Dictionary<string, string>
	{
	{ "8f348934-64be-4bb2-bc16-c54c96789f43", "EDU Assignments" },
	{ "22d27567-b3f0-4dc2-9ec2-46ed368ba538", "Reading Assignments" },
	{ "2d4d3d8e-2be3-4bef-9f87-7875a61c29de","OneNote" },
	{ "c9a559d2-7aab-4f13-a6ed-e7e9c52aec87","Microsoft Forms" },
	{ "13291f5a-59ac-4c59-b0fa-d1632e8f3292","EDU OneNote" }
	};