How to Configure Teams Network Connectivity Check Policies in PowerShell Using CsTeamsNetworkConnectivityCheckPolicy

To ensure optimal real-time audio, video, and screen sharing quality, Microsoft Teams clients continuously monitor local and wide-area network path conditions. By default, Teams applications perform background connectivity checks, assessing round-trip latency, packet reachability, and bandwidth availability against Microsoft 365 cloud edge endpoints and regional media relays. While this continuous probing helps diagnose performance issues and populates Call Quality Dashboard (CQD) telemetry, certain restricted enterprise networks—such as high-security government enclaves, air-gapped financial networks, or meter-billed satellite links—require granular control over automated client network probing. Through the Microsoft Teams PowerShell module, administrators can use the CsTeamsNetworkConnectivityCheckPolicy cmdlets to define, manage, and assign network connectivity check policies across their workforce.

Understanding Teams Network Connectivity Check Architecture

The Teams Network Connectivity Check subsystem operates within the desktop and web client networking stack. Key architectural functions include:

• Synthetic Health Probing: Periodically dispatches lightweight ICMP/HTTP/STUN synthetic probes toward Microsoft 365 transport relays and signaling proxies to verify firewall port clearance (UDP ports 3478 through 3481).
• Client Telemetry Reporting: Feeds real-time connectivity state into the Microsoft 365 Admin Center Network Performance portal, identifying subnets suffering from high latency, packet loss, or poor ISP peering.
• Policy Governance: Enables enterprise administrators to disable automated probing for specific users, enforce check schedules, or restrict continuous synthetic traffic on sensitive or low-bandwidth connections.
• Pre-Meeting Diagnostics: Interacts with the “Make a test call” feature, validating whether endpoints can establish bidirectional RTP streams before users join critical executive town halls.

Prerequisites and PowerShell Session Initialisation

Configuring network connectivity check policies requires the Microsoft Teams PowerShell module and appropriate administrative permissions. Ensure your administrator account holds the Teams Administrator or Global Administrator role in Microsoft Entra ID.

Install or verify the latest Microsoft Teams module version:

Get-Module -ListAvailable -Name MicrosoftTeams
Install-Module -Name MicrosoftTeams -Scope CurrentUser -Repository PSGallery -Force

Establish an authenticated remote management session:

Connect-MicrosoftTeams

Confirm the connection and verify cmdlet availability:

Get-Command *TeamsNetworkConnectivityCheckPolicy*

Inspecting Existing Network Connectivity Check Policies

Before implementing custom policies, inspect the default tenant configuration and any existing custom policies.

Retrieve all defined network connectivity check policies across the tenant:

Get-CsTeamsNetworkConnectivityCheckPolicy

Inspect the default Global policy parameters in detail:

Get-CsTeamsNetworkConnectivityCheckPolicy -Identity Global | Format-List Identity, Description, *

In the default Global policy, automated connectivity checking is typically enabled to allow Teams clients to report network quality heuristics automatically.

Creating a Custom Network Connectivity Check Policy

In scenarios involving branch offices operating over high-latency satellite connections (such as offshore maritime platforms or remote field installations), ongoing background probing consumes unnecessary bandwidth and may trigger false alerts in local intrusion detection systems. Administrators can create custom policies to suppress or customise this probing.

To create a custom policy with a clear administrative description:

New-CsTeamsNetworkConnectivityCheckPolicy -Identity "Restricted-Branch-Offices" -Description "Suppresses automated continuous network health probing on metered or air-gapped branch subnets."

Verify that the new policy object was provisioned:

Get-CsTeamsNetworkConnectivityCheckPolicy -Identity "Restricted-Branch-Offices"

Modifying Policy Attributes and Probing Controls

The Set-CsTeamsNetworkConnectivityCheckPolicy cmdlet allows administrators to update existing policy settings, adjust operational descriptions, and toggle probing behaviour.

Update policy descriptions and operational parameters:

Set-CsTeamsNetworkConnectivityCheckPolicy -Identity "Restricted-Branch-Offices" -Description "Enforces low-frequency connectivity checking for remote and maritime personnel."

Verify the committed changes in the policy settings:

Get-CsTeamsNetworkConnectivityCheckPolicy -Identity "Restricted-Branch-Offices" | Select-Object Identity, Description

Assigning Policies to Users and Groups

Once defined, assign network connectivity check policies to individual users or deploy them across enterprise units using Microsoft Entra security groups.

To assign the custom policy directly to an individual user:

Grant-CsTeamsNetworkConnectivityCheckPolicy -Identity "[email protected]" -PolicyName "Restricted-Branch-Offices"

Verify that the policy assignment is active on the user’s account:

Get-CsOnlineUser -Identity "[email protected]" | Select-Object UserPrincipalName, TeamsNetworkConnectivityCheckPolicy

To deploy the policy to an entire branch office department using Group Policy Assignment:

$GroupId = (Get-AzureADGroup -SearchString "Offshore Engineering Team").ObjectId
New-CsGroupPolicyAssignment -GroupId $GroupId -PolicyType TeamsNetworkConnectivityCheckPolicy -PolicyName "Restricted-Branch-Offices" -Rank 1

To remove a direct policy assignment so the user reverts to inheriting the Global tenant default:

Grant-CsTeamsNetworkConnectivityCheckPolicy -Identity "[email protected]" -PolicyName $null

Removing Deprecated Connectivity Policies

When custom network configurations are retired or corporate branches are migrated to terrestrial broadband links, delete obsolete policies to maintain a clean tenant directory.

Check for any users still bound to the policy before deletion:

Get-CsOnlineUser -Filter {TeamsNetworkConnectivityCheckPolicy -eq "Restricted-Branch-Offices"} | Select-Object UserPrincipalName

Delete the custom policy using Remove-CsTeamsNetworkConnectivityCheckPolicy:

Remove-CsTeamsNetworkConnectivityCheckPolicy -Identity "Restricted-Branch-Offices" -Confirm:$false

The built-in Global policy cannot be deleted and serves as the permanent fallback.

Troubleshooting Client Telemetry and Firewall Traversal

When managing Teams network policies across diverse enterprise perimeters, keep these diagnostic factors in mind:

• Client Replication Window: Policy changes typically take 2 to 4 hours to propagate through Microsoft 365 regional directory services to endpoint clients. Prompting users to log out and restart Teams accelerates policy refreshes.
• Enterprise Firewall Rules: Disabling client-side connectivity check policies does not bypass essential network requirements for active calls. Enterprise firewalls must permit outbound UDP traffic on ports 3478-3481 and TCP ports 80/443 to the published Microsoft 365 worldwide endpoint ranges.
• Call Quality Dashboard Impact: Suppressing connectivity checks may reduce the granularity of network path telemetry available in the Microsoft Teams Call Quality Dashboard (CQD) for those users. Weigh security or bandwidth requirements against administrative observability needs before broad rollout.

Using CsTeamsNetworkConnectivityCheckPolicy in PowerShell allows Microsoft 365 administrators to balance real-time network telemetry needs with security, compliance, and bandwidth constraints across enterprise environments.