Hiding Office 365 Groups Created by Teams from Exchange Clients

Excel with List of Office 365 Groups

Microsoft issued Office 365 Message Center update MC133135 on March 30 to inform tenants that Office 365 will hide groups created by Teams from Outlook by default. This is to end the potential confusion that can occur when a group used by Teams also appears in Outlook and OWA. Users then have the choice of collaborating through Outlook-based conversations or Teams. It’s possible that a team member might then make a mistake and post important information in the wrong place.

Hiding the Office 365 Groups used by Teams to manage membership and for access to resources like the group calendar and SharePoint team site cleans up the situation and focuses collaboration on Teams, which is what you’d expect when Teams creates a new group.

Two Important Flags

This change is only rolling out now and needs updates in both the back-end and clients. After it is effective in a tenant, when Teams creates a new group, Office 365 sets the HiddenFromExchangeClients property for the group to $True, meaning that Outlook clients ignore the existence of these groups. In addition, Office 365 sets the HiddenFromAddressListsEnabled property to $True so that the groups do not show up in Exchange’s Global Address List or Offline Address Book (OAB).

Some Clean-Up Required

All of this is goodness and it will lead to a cleaner situation in the future. However, some clean-up is necessary because many Office 365 Groups have been created by Teams since its preview started in November 2016. Office 365 will not retrospectively set the HiddenFromExchangeClients property, so if you look at Office 365 Groups in a tenant today, you will see that every group created before the change is effective have this property set to $False.

That’s the way it should be. The only people who can decide about hiding groups from user view when team-enabled groups have been in use for up to eighteen months are those who understand how people use the groups. If you want to hide team-enabled groups from Outlook, you must first find what groups Teams use. In a small tenant, you might be able to scan your Office 365 groups and decide to hide two or three obvious candidates by running the Set-UnifiedGroup cmdlet:

Set-UnifiedGroup -Identity Team1 -HiddenFromExchangeClientsEnabled:$True

The task becomes more difficult as the number of groups mount, and that’s where a PowerShell script comes to the rescue.

Figuring Out What Groups to Hide

Before we write any code, let’s review how we can find groups that are good candidates to hide from Outlook. The trick is to figure out a mechanism that is a good indicator that a group is in active use by Teams, and the problem is complicated by the fact that PowerShell has no property available for a group to show that it is team-enabled.

One obvious approach is to examine group mailboxes for the presence of Teams compliance records. These are copies of messages posted to channels in the team held in a folder called Team Chat (in English), a sub-folder of the Conversation History folder used to record Skype for Business IM conversations. The single Team Chat folder holds compliance records for all channels in a team. The existence of some compliance records in the Team Chat folder shows that the group is team-enabled, and some activity has happened inside a channel. That should be enough to highlight the group as a candidate for hiding.

Sometimes a group mailbox does not have a Conversation History folder. This doesn’t matter for our check because if a group mailbox does not have a Conversation History folder, it cannot have a Team Chat sub-folder, which is good evidence that the group has never been team-enabled and we can ignore these groups.

Code to Find Groups to Hide

Now that we know how to attack the problem, it’s time to write some code. Here’s a simple script to find groups with some Teams compliance records and output the data in a CSV file.

$Groups = Get-UnifiedGroup -ResultSize Unlimited | Select DisplayName, Alias, PrimarySmtpAddress, HiddenFromExchangeClientsEnabled 
Write-Host "Processing" $Groups.Count "groups"
$Report = @()
$TeamsGroups = 0
$NoConvHistory = 0
ForEach ($G in $Groups) {
   Write-Host "Processing" $G.DisplayName 
   If ($G.HiddenFromExchangeClientsEnabled -eq $False) { # Used to be HiddenFromExchangeClients
      $ChatCheck = $Null
      $ChatCheck = (Get-MailboxFolderStatistics -Identity $G.Alias -FolderScope ConversationHistory -IncludeOldestAndNewestItems)
      If ($ChatCheck -eq $Null) { $NoConvHistory++ }
      # Check that we have a Teams compliance folder and some items are present      
      ElseIf ($ChatCheck.FolderType[1] -eq "TeamChat" -and $ChatCheck.ItemsInFolder[1] -gt 0) {
         $TeamsGroups++
         Write-Host $G.DisplayName "has" $ChatCheck.ItemsInFolder[1] "compliance records - so it's active for Teams"
         $DateLastItem = $ChatCheck.NewestItemReceivedDate[1]
         $ReportLine = [PSCustomObject][Ordered]@{
            GroupName = $G.DisplayName
            Alias     = $G.Alias
            Email     = $G.PrimarySmtpAddress
            Chats     = $ChatCheck.ItemsInFolder[1]
            LastAdded = $DateLastItem
            Hidden    = $G.HiddenFromExchangeClients }        
         $Report += $ReportLine   }
    }
}
Write-Host $TeamsGroups "groups are used by Teams and could be hidden from Exchange Clients"
$Report | Sort Chats -Descending | Select GroupName, Chats, LastAdded
$Report | Export-csv -Path c:\temp\HiddenGroups.csv -NoTypeInformation -Encoding Ascii

Figure 1 shows what happened when I ran the script on my tenant.

Office 365 Groups PowerShell
Figure 1: Output from the PowerShell script (image credit: Tony Redmond)

Analyzing the Results

Among the information reported for each group is the number of compliance records found and a timestamp to tell us the last recorded compliance record. These should help us decide whether a team-enabled group is active.

Now we have a list of candidate groups output to a CSV file, someone who knows how Teams and Groups are used inside the tenant can review the list. Excel is a good choice for this kind of review. If they find a group to hide, they can update the Hidden field to True.

Updating Groups to Hide them from Outlook

When the review is complete, we should have a CSV file with some groups marked for processing. Some PowerShell can open the CSV file, load its contents, and process any group marked for hiding, Here’s the code:

$GroupList = Import-CSV "c:\temp\HiddenGroups.csv"
ForEach ($G in $GroupList) {
     If ($G.Hidden -eq "True") {
        Write-Host "Hiding" $G.GroupName "from Exchange Clients"
        Set-UnifiedGroup -Identity $G.Alias -HiddenFromExchangeClientsEnabled:$True }
 }

Before rushing to hide all teams from Exchange clients, remember that the groups underlying teams can be used as distribution lists. Sometimes it is more effective and functional to send a message via team than to post it in Teams, especially if you need to protect the content with encryption or get information to guest members fast. If the group is visible to Exchange, users can easily send email to the group and the members who subscribe to the group will receive copies in email.

You can hide a group from Exchange and still send email to it using its SMTP address, but only administrators will be able to retrieve that address easily. The potential use of a group as a distribution list is just another factor to consider in your decision making process.

Groups All Tidied Up

Our task is complete, Groups that should be hidden from Outlook are now exclusively available through Teams. Once again, it’s amazing how a few lines of PowerShell can automate a task that might take hours to do manually.

Follow Tony on Twitter @12Knocksinna.

Want to know more about how to manage Office 365? Find what you need to know in “Office 365 for IT Pros”, the most comprehensive eBook covering all aspects of Office 365. Available in PDF and EPUB formats (suitable for iBooks) or for Amazon Kindle.