As Microsoft enhances its security posture across all products and services, there have been changes to API functionality that may impact customers who previously relied on app-only permissions to provision Class Notebooks and Class Teams using APIs.
Note: In most cases, we recommend using School Data Sync (SDS), a free service that helps to automate the process of synchronizing user and roster data from Student Information or Management Systems with Microsoft 365. SDS helps you manage your educational organization, users, classes, and roles, syncing your data with Microsoft Entra ID and Microsoft 365, so you can use Microsoft Teams, Intune for Education, Exchange Online, SharePoint Online, OneNote Class notebooks, and enable third-party apps with Single Sign On integration.
You can still provision classes and notebooks at scale using PowerShell and Microsoft Graph by following supported methods. This article outlines the steps and provides links to relevant documentation.
Important:Â If you are working with a third party partner on at-scale provisioning of classes, please share this article with them before taking steps on your own.
Provisioning new classes
Option 1 (recommended): Using the Teams PowerShell
Warning:Â Before August 21st, 2025, a prior version of this documentation recommended provisioning via Teams PowerShell before required updated had been made. These updates are now complete, and you can proceed with this approach at this time. Thank you for your patience.
It's simple to provision new classes using Teams PowerShell, which will include all necessary setup for classes and notebooks. Simply customize the desired display name in the following script and run it as an administrator.
Sample script
# Using the Teams PowerShell SDK
Install-Module -MicrosoftTeams -Force -AllowClobber
New-Team -DisplayName 'Test Class 20251208.4' -Template 'EDU_Class'
|
Option 2: Using Microsoft Graph PowerShell
If you do not have access to Teams PowerShell, you may want to explore provisioning classes at scale using the Microsoft Graph. Edit the parameters at the top of the following script as appropriate, and then run the script as an administrator to provision classes and notebooks at scale:
Sample script
# Using the MS Graph API
Install-Module Microsoft.Graph -AllowClobber -Force
# PARAMETERS
$Name = "Test Class 20251208.3"
$Description = "A Test Class"
$Mail = Â $Name -replace '[^a-zA-Z0-9\s]|[ ]', '' # Replace this mail alias with a preferred generation method
$OwnerId = "000-000-00000-000000-000" # Replace this with the Owner's GUID
# ------------
# Create a new M365 Group
$CreateGroupBody = @"
{
 "description": "$Name",
 "displayName": "$Description",
 "groupTypes": [
  "Unified"
 ],
 "mailEnabled": false,
 "mailNickname": "$Mail",
 "securityEnabled": false,
 "members@odata.bind": [
  "https://graph.microsoft.com/v1.0/users/$OwnerId"
 ],Â
 "owners@odata.bind": [
  "https://graph.microsoft.com/v1.0/users/$OwnerId"
 ],
 "visibility": "HiddenMembership",
 "creationOptions": [
  "ExchangeProvisioningFlags:461",
  "classAssignments"
 ],
 "extension_fe2174665583431c953114ff7268b7b3_Education_ObjectType": "Section",
 "resourceBehaviorOptions": [
  "appRoleForSite:22d27567-b3f0-4dc2-9ec2-46ed368ba538:fullcontrol",
  "appRoleForSite:c9a559d2-7aab-4f13-a6ed-e7e9c52aec87:fullcontrol",
  "appRoleForSite:13291f5a-59ac-4c59-b0fa-d1632e8f3292:fullcontrol",
  "appRoleForSite:2d4d3d8e-2be3-4bef-9f87-7875a61c29de:fullcontrol",
  "appRoleForSite:8f348934-64be-4bb2-bc16-c54c96789f43:fullcontrol"
 ]
}
"@
$NewGroup = Invoke-MgGraphRequest -uri 'https://graph.microsoft.com/v1.0/groups/' -Body $CreateGroupBody -Method POST -ContentType "application/json"
# Create Teams Class Team from group
$CreateTeamBody = @{
   "template@odata.bind" = "https://graph.microsoft.com/v1.0/teamsTemplates('educationClass')"
   "group@odata.bind" = "https://graph.microsoft.com/v1.0/groups('$($NewGroup.Id)')"
}
New-MgTeam -BodyParameter $CreateTeamBody​​​​​​​ |
Troubleshoot: granting permissions to existing class sites
Note:Â This approach will also require that the person running the script is a site admin, as described here. The script below includes a step to add the currently logged in user as a site admin for the sites requiring troubleshooting.
If you have already provisioned classes and are observing failures or permission issues with Class Notebook or Teams Assignments, you can update site permissions for your classes using the following script, replacing the rawGroups parameter with the groupIDs of the affected classes:
Sample script
#You will need to connect to SharePoint, Exchange Online, and Graph with the following -Scopes Sites.FullControl.All, as well as collect the groupIDs of Class Teams affected
$rawGroups =@("b0a5905d-09ae-4605-8e12-94da93ecbe92","e0eec729-24ef-451e-b079-56d0baf4dfc9")
# Convert to array of objects with .groupid
$groups = $rawGroups | ForEach-Object { Get-UnifiedGroup -Identity $_ }
$step = 0
#get the currently logged in user's account to add as a site admin
$CUA = (get-mgcontext).account
foreach ($group in $groups) {
 $step = $step + 1
 Set-SPOUser -Site $group.SharePointSiteUrl -LoginName $CUA -IsSiteCollectionAdmin $true
 Write-Host "SiteCollectionAdmin added on $step of $($Groups.Count) Class Sites"
}
#Pause for 5 minutes before tiggering the General Folder creation
Write-Host "Pausing for 5 Minutes before adding perms to allow SiteCollectionAdmin to propagate"
Start-Sleep -Seconds 300
Write-Host "Working on $($Groups.Count) Classes"
foreach ($group in $groups) {
 #$step = $step + 1
 $Site = Get-MgGroupSite -GroupId $group.ExternalDirectoryObjectId -SiteId "root"
 $SiteId = $Site.Id
 Write-Host "Processing permissions on $step of $($Groups.Count) Classes"
 # These are the AppIds for common Microsoft EDU Apps
 $AppIds = @{
 "8f348934-64be-4bb2-bc16-c54c96789f43"="EDU Assignments";
 "22d27567-b3f0-4dc2-9ec2-46ed368ba538"="Reading Assignments";
 "2d4d3d8e-2be3-4bef-9f87-7875a61c29de"="OneNote";
 "c9a559d2-7aab-4f13-a6ed-e7e9c52aec87"="Microsoft Forms";
 "13291f5a-59ac-4c59-b0fa-d1632e8f3292"="EDU OneNote";
 }
# Apply the permissions to the group site
$AppIds.Keys | %{
 $AppId = $_
 $Name = $AppIds[$_]
 $Body = @"
 {Â
   "roles": ["fullcontrol"],Â
   "grantedToIdentities": [{Â
    "application": {Â
     "id": "$AppId",
     "displayName": "$Name"
    }
   }]Â
 }
"@
 Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/sites/$SiteId/permissions" -Body $Body -ContentType "application/json"
}
}
Write-Host "Processed $($Groups.Count) Classes, removing sitecollectionadmin"
$step = 0
foreach ($group in $groups) {
 $step = $step + 1
 Set-SPOUser -Site $group.SharePointSiteUrl -LoginName $CUA -IsSiteCollectionAdmin $false
 Write-Host "SiteCollectionAdmin removed on $step of $($Groups.Count) Class Sites"
} |
