How to Configure Teams Azure Communication Services Federation in PowerShell Using CsTeamsAcsFederationPolicy

Modern enterprise organisations increasingly build bespoke customer-facing web and mobile applications using Azure Communication Services (ACS). Common scenarios include telehealth patient consult portals, mortgage advisory video chat widgets, and e-commerce client messaging. In these business-to-consumer (B2C) workflows, external customers connect via custom web applications powered by Azure Communication Services, while internal enterprise staff—such as clinicians, financial advisors, or customer service representatives—communicate directly from their familiar Microsoft Teams desktop and mobile clients. Governing which Teams users can communicate with external ACS applications requires centralized tenant security controls.

Microsoft Teams provides the CsTeamsAcsFederationPolicy cmdlets in PowerShell to manage this federation boundary. Administrators can enable or restrict 1:1 chat and audio/video interoperability, specify authorized Azure Communication Services resource endpoints, and prevent unverified consumer applications from reaching enterprise directories.

Understanding Teams and Azure Communication Services Interoperability

The interoperability framework between Microsoft Teams and Azure Communication Services connects enterprise Microsoft 365 tenants with developer-managed Azure subscriptions:

• ACS Resource Identity: Each Azure Communication Services instance possesses a distinct immutable Resource ID within an Azure subscription.
• Federation Governance: Unlike standard Microsoft Teams external access (federation between separate M365 corporate tenants), ACS federation connects non-M365 external consumers authenticated via custom identity providers (such as Azure AD B2C, Okta, or custom session tokens).
• Granular User Scoping: Policies can be applied tenant-wide (Global) or granted exclusively to dedicated customer support groups or clinical advisory staff who interact with external consumers, leaving back-office accounts isolated from external contact.

Connecting to Microsoft Teams PowerShell

To configure ACS federation policies, open an elevated PowerShell console and authenticate with Microsoft Teams Administrator privileges:

# Install or update Microsoft Teams PowerShell module
Install-Module -Name MicrosoftTeams -Force -AllowClobber

# Authenticate to the corporate Teams tenant
Connect-MicrosoftTeams

Query existing ACS federation policies to evaluate the current baseline configuration:

# Retrieve active ACS federation policies
Get-CsTeamsAcsFederationPolicy | Format-Table Identity, Description, EnableAcsFederation

By default, tenants include a Global policy where ACS federation is typically disabled until an administrator explicitly provisions and enables the integration.

Creating a Scoped ACS Federation Policy for Support Teams

To avoid exposing all internal enterprise users to external ACS web apps, create a tailored policy intended specifically for external-facing support representatives:

# Create dedicated ACS federation policy for Customer Support
New-CsTeamsAcsFederationPolicy -Identity "Customer-Support-ACS-Policy" `
                               -Description "Authorizes ACS chat and video federation for customer advisory agents" `
                               -EnableAcsFederation $True

With EnableAcsFederation $True, assigned users can accept incoming direct chat sessions, participate in 1:1 voice/video calls, and view presence updates originating from authorized Azure Communication Services applications.

Restricting ACS Federation to Specific Azure Resources

In high-compliance enterprise environments (such as banking or healthcare), organizations must ensure internal staff only communicate with verified, corporate-owned Azure Communication Services endpoints rather than arbitrary third-party ACS instances.

Inspect and bind allowed Azure Communication Services resource identifiers to the policy:

# Restrict federation exclusively to approved Azure Communication Services resource IDs
Set-CsTeamsAcsFederationPolicy -Identity "Customer-Support-ACS-Policy" `
                               -AllowedAcsResources @("a1b2c3d4-e5f6-7890-abcd-ef0123456789")

Any communication attempt originating from an unlisted Azure Communication Services resource is rejected at the Teams signaling gateway, preventing unauthorized consumer access.

Modifying and Inspecting Policy Properties

To inspect all configured parameters and active resource bindings on a policy:

# Retrieve detailed policy attributes
Get-CsTeamsAcsFederationPolicy -Identity "Customer-Support-ACS-Policy" | Format-List

To temporarily suspend ACS federation during security reviews or scheduled maintenance windows without unassigning user accounts:

# Temporarily disable ACS federation
Set-CsTeamsAcsFederationPolicy -Identity "Customer-Support-ACS-Policy" -EnableAcsFederation $False

Assigning ACS Federation Policies to Enterprise Users

Use the Grant-CsTeamsAcsFederationPolicy cmdlet to assign the policy to individual users or security groups.

Assign the policy to a specific clinical advisor:

# Grant policy to an individual user account
Grant-CsTeamsAcsFederationPolicy -Identity "[email protected]" `
                                 -PolicyName "Customer-Support-ACS-Policy"

Assign the policy across an entire department using attribute-based queries:

# Retrieve customer service staff and assign policy in bulk
$SupportAgents = Get-CsOnlineUser -Filter {Department -eq "Client-Advisory"}
$SupportAgents | ForEach-Object {
    Grant-CsTeamsAcsFederationPolicy -Identity $_.UserPrincipalName -PolicyName "Customer-Support-ACS-Policy"
}

To revoke a custom policy assignment and return a user to default Global tenant inheritance:

# Revert user to Global policy
Grant-CsTeamsAcsFederationPolicy -Identity "[email protected]" -PolicyName $Null

By configuring structured ACS federation policies with CsTeamsAcsFederationPolicy, IT security teams enable rich B2C customer engagement while maintaining complete administrative sovereignty over internal Teams directories.