How to Configure Teams Tag Management and Targeted Messaging Policies Using PowerShell CsTeamsTagPolicy

In Microsoft Teams, tags allow team members and leaders to categorise users based on operational roles, shifts, departments, or geographic regions without maintaining separate distribution groups. When tags are applied, users can notify an entire functional group using targeted mentions (such as @StoreManagers or @NightShift) or initiate group chats with all tagged individuals simultaneously. However, in large enterprise tenants, unrestricted tag creation can lead to tag proliferation, overlapping group definitions, and message noise. Using the Microsoft Teams PowerShell module, administrators can manage tag governance centrally via CsTeamsTagPolicy, restricting who can create, apply, or manage tags across individual teams or entire departments.

Architecture of Microsoft Teams Tag Management Policies

The tag management framework in Microsoft Teams is governed by customisable tenant-level and user-level policies. The primary policy container—CsTeamsTagPolicy—controls three fundamental permissions:

• TargetedMessagingSetting: Toggles whether users are permitted to mention tags in channel conversations (e.g. using @TagName) to alert group members.
• CustomTagsManagement: Determines who within a team can create, edit, or delete custom tags. Administrators can restrict this right exclusively to Team Owners or extend it to Team Members.
• Shift-Based Tag Overrides: Controls whether tag management integrates with the Shifts app for automated on-duty tagging.

Connecting to the Microsoft Teams PowerShell Module

To audit and configure tag management policies, establish an authenticated administrator session using the Microsoft Teams PowerShell module:

# Install Microsoft Teams module if not present
Install-Module -Name MicrosoftTeams -Scope CurrentUser -Repository PSGallery -Force

# Connect with Teams Administrator credentials
Connect-MicrosoftTeams

Ensure your account possesses the Teams Administrator or Global Administrator Entra ID role.

Auditing Existing Teams Tag Policies

To inspect the default global tag policy and any custom tenant policies currently deployed:

Get-CsTeamsTagPolicy

To inspect specific governance properties of the Global policy:

Get-CsTeamsTagPolicy -Identity Global | Select-Object Identity, Description, CustomTagsManagement, TargetedMessagingSetting

Key property values for CustomTagsManagement include:

• OwnersOnly: Only designated Team Owners have permission to create, edit, and assign tags.
• OwnersAndMembers: Any member of a team can create and manage tags freely.
• Disabled: Custom tag creation is completely disabled for targeted users.

Modifying the Global Tag Governance Policy

In many enterprise organisations, restricting tag creation to team owners prevents clutter and duplicate roles across departmental channels. To restrict tag creation globally to Team Owners whilst keeping targeted @tag messaging enabled:

Set-CsTeamsTagPolicy -Identity Global `
    -CustomTagsManagement OwnersOnly `
    -TargetedMessagingSetting Enabled `
    -Description "Global policy restricting tag creation to Team Owners."

To completely disable custom tag creation globally whilst retaining existing tags:

Set-CsTeamsTagPolicy -Identity Global -CustomTagsManagement Disabled

Creating and Assigning Custom Tag Policies

Rather than enforcing a single rule across the entire tenant, administrators often define tailored policies for specific departments—such as permitting agile developer squads to self-manage tags whilst locking down sales and support channels.

To create a new custom tag policy permitting full owner and member collaboration:

New-CsTeamsTagPolicy -Identity "TagPolicy-Engineering" `
    -CustomTagsManagement OwnersAndMembers `
    -TargetedMessagingSetting Enabled `
    -Description "Permits engineering team members to create and edit custom tags."

To create a restrictive policy for temporary or vendor accounts where targeted messaging and tag creation are disabled:

New-CsTeamsTagPolicy -Identity "TagPolicy-Contractors" `
    -CustomTagsManagement Disabled `
    -TargetedMessagingSetting Disabled `
    -Description "Disables tag creation and targeted tag mentions for contractors."

Assigning Tag Policies to Users and Groups

Once created, custom tag policies can be assigned directly to individual users or mapped dynamically via Entra ID security groups.

To assign a policy to a single user:

Grant-CsTeamsTagPolicy -Identity "[email protected]" -PolicyName "TagPolicy-Engineering"

To assign a tag policy to all members of an Entra ID security group using group policy assignment:

New-CsGroupPolicyAssignment -GroupId "b2a6f874-9d51-4c22-8344-998811223344" `
    -PolicyType TeamsTagPolicy `
    -PolicyName "TagPolicy-Engineering" `
    -Rank 1

To verify the effective tag policy assigned to a user:

Get-CsUserPolicyAssignment -Identity "[email protected]" | Where-Object { $_.PolicyType -eq "TeamsTagPolicy" }

Monitoring and Removing Tag Policies

To revert a user back to the tenant-wide Global policy, remove their explicit policy grant:

Grant-CsTeamsTagPolicy -Identity "[email protected]" -PolicyName $null

To delete a custom policy that is no longer required (ensure no users remain assigned before deletion):

Remove-CsTeamsTagPolicy -Identity "TagPolicy-Contractors"

Deploying structured tag policies through CsTeamsTagPolicy establishes organised communication channels, empowers team leaders with governance, and prevents communication sprawl in Microsoft Teams.