How to Configure Teams Work Location Detection Policies Using PowerShell CsTeamsWorkLocationDetectionPolicy

Modern hybrid workplace environments require automated coordination between physical office spaces and digital collaboration tools. Through Microsoft Places and Microsoft Teams, organizations can automatically detect whether an employee is working from home, in a specific office building, or on a designated corporate campus based on connected Wi-Fi networks and Ethernet subnets. To govern this capability and balance automated presence with employee privacy preferences, Microsoft Teams provides the CsTeamsWorkLocationDetectionPolicy PowerShell cmdlets. Administrators can configure tenant-wide baselines or assign targeted policies to regulate automatic work location updates and user prompt behaviours.

Understanding Microsoft Teams Work Location Detection Architecture

In standard Teams deployments, users can manually set their daily work location (e.g., “In the office” or “Working remotely”) from the profile card or Teams calendar. With Work Location Detection enabled:

• Network Matching: The Teams desktop client queries the physical network adapter’s default gateway, corporate Wi-Fi BSSID, and local IPv4/IPv6 subnet. It compares these identifiers against the registered Network Sites defined in the Teams Network Topology.
• Automated Location Updates: If the client connects to an office Wi-Fi network mapped to a known corporate building, Teams can automatically update the user’s presence status to reflect that they are in the office, notifying colleagues and updating room booking telemetry in Microsoft Places.
• Privacy and Consent Controls: CsTeamsWorkLocationDetectionPolicy determines whether automatic detection is enabled, whether the user receives a confirmation prompt before location updates are published, or whether detection is suppressed entirely for privacy-sensitive roles.

Connecting to Microsoft Teams PowerShell

Configuring work location policies requires the Microsoft Teams PowerShell module (version 5.0.0 or later) and Teams Administrator or Global Administrator privileges:

# Import the module and establish an administrative session
Import-Module MicrosoftTeams
Connect-MicrosoftTeams

Confirm that the work location detection cmdlets are available:

# Verify available cmdlets
Get-Command *CsTeamsWorkLocationDetectionPolicy*

Inspecting Default Work Location Detection Policies

Query the tenant to inspect the Global default policy applied to all users without a custom assignment:

# Retrieve the Global Work Location Detection Policy
Get-CsTeamsWorkLocationDetectionPolicy -Identity Global

The policy exposes critical operational flags:

• Identity: The scope or name of the policy profile (e.g., Global or a custom string identifier).
• WorkLocationDetection: Governs whether network-based location sensing is enabled (Enabled) or disabled (Disabled) for target accounts.
• PromptUser: Controls whether the client prompts the user to confirm their detected work location before updating their profile presence.

Creating Custom Work Location Detection Policies

Depending on organizational culture, facilities management requirements, and legal data privacy compliance (such as works councils in Germany or GDPR considerations), different departments require varying policy constraints.

1. Automated Detection for General Hybrid Workforce

For organizations prioritizing seamless office collaboration and desk reservation analytics, enable automated detection with confirmation prompts:

# Create policy enabling detection with user confirmation
New-CsTeamsWorkLocationDetectionPolicy -Identity "Hybrid-PromptUser" `
    -WorkLocationDetection "Enabled" `
    -PromptUser $true

When an employee docks their laptop at a headquarters desk, a subtle Teams banner prompts: “Looks like you’re at Building 4. Update your location to In the office?”

2. Privacy-Restricted Policy for Executive or Sensitive Roles

For executive leadership, legal teams, or field operatives who require location privacy, disable automated location detection completely:

# Create policy completely disabling work location detection
New-CsTeamsWorkLocationDetectionPolicy -Identity "Privacy-NoDetection" `
    -WorkLocationDetection "Disabled" `
    -PromptUser $false

Modifying Existing Policy Settings

To update the Global baseline or modify an established custom policy, execute Set-CsTeamsWorkLocationDetectionPolicy:

# Enable automatic detection globally across the tenant
Set-CsTeamsWorkLocationDetectionPolicy -Identity Global `
    -WorkLocationDetection "Enabled" `
    -PromptUser $true

# Verify updated policy attributes
Get-CsTeamsWorkLocationDetectionPolicy -Identity Global | Format-List Identity, WorkLocationDetection, PromptUser

Assigning Policies to Users and Security Groups

Custom policies can be assigned directly to specific users or mapped across Microsoft Entra ID security groups:

1. Assigning to an Individual User

# Grant privacy policy to a specific user
Grant-CsTeamsWorkLocationDetectionPolicy -Identity "[email protected]" -PolicyName "Privacy-NoDetection"

# Verify assignment on the user account
Get-CsUserPolicyAssignment -Identity "[email protected]" | Where-Object { $_.PolicyType -eq "TeamsWorkLocationDetectionPolicy" }

2. Assigning to a Microsoft Entra Security Group

# Assign hybrid detection policy to the Sales & Marketing security group
Grant-CsTeamsWorkLocationDetectionPolicy -Group "a4b2c1d3-8e7f-4901-b345-6789abcdef01" `
    -PolicyType TeamsWorkLocationDetectionPolicy `
    -PolicyName "Hybrid-PromptUser" `
    -Rank 1

Prerequisites for Corporate Network Recognition

Work location detection functions only if the corporate physical infrastructure is registered within the Teams Network Topology. Ensure that local Wi-Fi access points and IP subnets are mapped to corresponding Buildings in Microsoft Places:

# List existing tenant network sites and subnets
Get-CsTenantNetworkSite | Select-Object Identity, NetworkRegionID, Description
Get-CsTenantNetworkSubnet | Select-Object SubnetID, MaskBits, NetworkSiteID

If a remote branch or campus floor lacks mapped subnets, the Teams client will be unable to correlate the local connection to a corporate location, and detection will not trigger.

Revoking and Removing Custom Policies

When consolidating policy configurations, unbind the policy from active accounts before removing it:

# Revert user to the Global policy
Grant-CsTeamsWorkLocationDetectionPolicy -Identity "[email protected]" -PolicyName $null

# Delete the custom policy profile
Remove-CsTeamsWorkLocationDetectionPolicy -Identity "Hybrid-PromptUser" -Confirm:$false

Configuring Teams Work Location Detection Policies via PowerShell provides facility coordinators and IT administrators with accurate workplace intelligence while maintaining user privacy and trust.