How to Hide Teams-Enabled Groups from Exchange Online

Hide Teams from Exchange to Clean Up a Potential Mess

Updated 17 October 2023

In mid-2018. Microsoft updated Teams so that the Microsoft 365 Groups created for new teams were hidden from Exchange clients (like OWA) and Exchange address lists (like the GAL). This was accomplished by setting the HiddenFromExchangeClientsEnabled and HiddenFromAddressListsEnabled properties of the groups to True. The idea is that there’s no point in revealing team-enabled groups to Exchange when communications for those groups is centered around Teams messaging and meetings.

Groups Created Using Admin Interfaces

Unfortunately, the change only applied to teams created with the Teams clients (desktop, browser, and mobile) and the New-Team cmdlet from the Microsoft Teams PowerShell module. The groups for teams created using the Teams admin center (Figure 1), Azure AD admin center, Microsoft 365 admin center, New-UnifiedGroup PowerShell cmdlet, or the Microsoft Graph are not hidden from Exchange clients or address lists, with the result being that an organization can end up with some teams being visible and others not.

The logic here is that when an administrator creates a new team or group, it is assumed that they can make whatever decisions are necessary about the settings for the new group. This position is undermined by the fact that there’s no way to update the settings to hide groups available in the Teams admin center or Microsoft 365 admin center, so any adjustments must be done using PowerShell or the Graph.

The PowerShell Solution to Hide Teams from Exchange

Fortunately, the solution is reasonably easy to code in PowerShell. The steps are:

• Find the set of groups used by Teams.
• Reduce the set to the groups still visible to Exchange Online.
• Update the group settings to make them invisible to Exchange Online.

Here’s some code to do the job:

$HiddenGroups = 0
Write-Host "Finding team-enabled Microsoft 365 Groups and checking for any which are visible to Exchange clients"
[array]$Groups = Get-UnifiedGroup -Filter {ResourceProvisioningOptions -eq "Team"} -ResultSize Unlimited 
# Reduce to the set visible to Exchange clients
[array]$Groups = $Groups | Where-Object {$_.HiddenFromExchangeClientsEnabled -eq $False}

# Process the remaining groups and hide them from Exchange
If ($Groups.Count -ne 0) {
  ForEach ($Group in $Groups) { 
     Write-Host "Hiding" $Group.DisplayName
     $HiddenGroups++
     Set-UnifiedGroup -Identity $Group.ExternalDirectoryObjectId -HiddenFromExchangeClientsEnabled:$True -HiddenFromAddressListsEnabled:$True
  }
}
Else { Write-Host "No team-enabled Microsoft 365 Groups are visible to Exchange clients and address lists" }

Write-Host ("All done. {0} team-enabled groups hidden from Exchange clients" -f $HiddenGroups)

You can download the script from the Office 365 for IT Pros GitHub repository.

The Graph Method to Hide Teams from Exchange

Update: Since the original post, Microsoft updated the Graph APIs to allow the retrieval and updating of the settings controlling the display of groups to Outlook clients and visibility to Exchange Online address lists. This code is an example of how to use a combination of Microsoft Graph PowerShell SDK cmdlets and Graph API requests to find teams, check each, and update the settings if necessary.

[array]$Teams = Get-MgGroup -Filter "resourceProvisioningOptions/any(x:x eq 'Team')" | Sort-Object DisplayName
If ($Teams) {
   Write-Host ("Processing {0} teams..." -f $Teams.count)
}
# Parameters if we need to update a group
$Parameters = @{
 "HidefromOutlookClients" = "true" 
 "HidefromAddressLists" = "true" }
[int]$i = 0; [int]$Problems = 0
# Process each team, check if it's visible to Outlook clients and if so, hide it
ForEach ($Team in $Teams) {
  $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}?`$select=id,displayName,description,hideFromOutlookClients,hideFromAddressLists" -f $Team.Id)
  $Data = Invoke-MgGraphRequest -Uri $Uri -Method Get
  If ($Data.hideFromOutlookClients -eq $True) {
     Write-Host ("Team {0} is hidden from Outlook clients" -f $Team.displayName)
  } Else {
     Write-Host ("Hiding Team {0} from Outlook clients and Exchange address lists" -f $Team.displayName) -foregroundcolor Red
     $Uri = ("https://graph.microsoft.com/v1.0/groups/{0}" -f $Team.id)
     $Status = Invoke-MgGraphRequest -Uri $Uri -Method Patch -Body $Parameters
     If ($Status) {
       $i++
     } Else {
       $Problems++
     }
  }
}

Write-Host ("All done. {0} groups hidden successfuily. {1} problems." -f $i, $Problems)

Obviously, this check must occur periodically to process newly-created team-enabled groups to hide teams from Exchange Online clients and in address lists. Something like a scheduled job executing an Azure Automation runbook would do the job.

---

Learn how to exploit the Office 365 data available to tenant administrators through the Office 365 for IT Pros eBook. We love figuring out how things work.