# Block Profile Picture Updates Look up the recovered Graph settings for restricting profile-photo updates through Microsoft 365 web portals. The notes include a retired mailbox-policy method and incomplete command fragments, not a validated configuration procedure. !!!warning Source-derived reference These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting. !!! Source ticket: ## Retired method: Exchange mailbox policy This exchange policy has been retired and no longer works. To View Mailbox Policy Setting: ``` powershell Get-OwaMailboxPolicy | FL nam, SetPhotoEnabled ``` [Screenshot retained for review](../../review/Review-status.md#asset-550fd26b9b10cfdbe333) ## Web photo-update settings described in the source This is for restricting users from updating their user profile photos using M365 web portals. These were the remaining locations where a user can update their profile picture - [myaccount.microsoft.com/organizations?ref=AccountSettings](https://myaccount.microsoft.com/organizations?ref=AccountSettings) - [m365.cloud.microsoft/search/overview](https://m365.cloud.microsoft/search/overview) ### View Current Photo Update Restriction Settings For Your M365 Tenant The source records the tenant settings as being in their default state at the time of capture. In the default state everyone can manage their profile picture. The held screenshot was described as showing those default settings. - source = \$null - allowedRoles  = empty list ``` powershell Connect-MgGraph ``` Invoke-MgGraphRequest -Method GET -Uri "[https://graph.microsoft.com/beta/admin/people/photoupdatesettings"](https://graph.microsoft.com/beta/admin/people/photoupdatesettings") **Screenshot of result** [Screenshot retained for review](../../review/Review-status.md#asset-b6abb0ec9fa395e9ff60) ### TO RESTRICT profile photoupdate The source records this script location; the script itself is not supplied by that path in this companion: …\Documents\powershell\R&DTempScripts\ProfilePhotoRestrictAccess\ProfilePhotoRestrictAccess.ps1 **TO RESTRICT** profile photo updates via the M365 website, you need to run the following patch command. The GUIDs in the **allowedRoles** are for the **User Administrator** and **Global Administrator**. Note if you don't add the GA role to the allowedRoles, GA's will not be able to update a profile picture using the web interface. [Screenshot retained for review](../../review/Review-status.md#asset-1aa9be3d1921e9c76900) **Role Id for** - People Administrator: 024906de-61e5-49c8-8572-40335f1e0e10 - User Administrator: fe930be7-5e62-47db-91af-98c3a49a38b1 - Global Administrator: 62e90394-69f5-4237-9190-012177145e10 Role Id's are from [learn.microsoft.com](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference) MS Graph Scope Required:  PeopleSettings.ReadWrite.All ``` powershell Connect-MsGraph -Scope "PeopleSettings.ReadWrite.All" ``` \$URI = " ["](https://graph.microsoft.com/beta/admin/people/photoupdatesettings) ``` powershell $METHOD = "PATCH" ``` ``` powershell $ApiParams = @{ ``` "source" = "cloud" "**allowedRoles**" = @("024906de-61e5-49c8-8572-40335f1e0e10","**fe930be7-5e62-47db-91af-98c3a49a38b1**","**62e90394-69f5-4237-9190-012177145e10**") } ``` powershell Invoke-MgGraphRequest -Method $METHOD -Uri $URI -Body $ApiParams ``` **TO REVERSE RESTRICTION** AND ALLOW ALL USERS AGAIN: \$URI = " ["](https://graph.microsoft.com/beta/admin/people/photoupdatesettings) ``` powershell $METHOD = "PATCH" ``` ``` powershell $UndoApiParams = '{ ``` "allowedRoles": \[\] }' ``` powershell $Settings = Invoke-MgGraphrequest -Uri $URI -Method $METHOD -Body $UndoApiParams ``` ===================END: RESTRICTING WEB FOR PHOTO UPDATES ============================= Photos can also be updated using powershell and admin consoles. Users in the following roles can make photo profile changes: - People Administrator ([New as of 6Feb2025](https://office365itpros.com/2025/02/06/people-administrator-role/) - office365itpros.com) - Directory writers - Intune administrator - User administrator Powershell Using Ms Graph commandlets - [Change user profile photo - Microsoft 365 admin \| Microsoft Learn](https://learn.microsoft.com/en-au/microsoft-365/admin/add-users/change-user-profile-photos?view=o365-worldwide#manage-user-photos-in-microsoft-graph-powershell) - Scopes required to update - Users Only: "User.ReadWrite.All" - M365 Groups Only: "Group.ReadWrite.All" - If you need to update profile photos of groups and users then add both scopes when connect to M365 via MS Graph. ## References Exchange Photo commandlets were retired in 2023. - [Deprecation of Exchange Online PowerShell UserPhoto cmdlets \| Microsoft Community Hub](https://techcommunity.microsoft.com/blog/exchange/deprecation-of-exchange-online-powershell-userphoto-cmdlets/3955744) - Same page... [table of the replacement Graph command and required permissions.](https://techcommunity.microsoft.com/blog/exchange/deprecation-of-exchange-online-powershell-userphoto-cmdlets/3955744#:~:text=Microsoft%2520Graph%2520cmdlet%2520you%2520should%2520start%2520using) More Detailed List of Command for managing user profile Photos: - [Change user profile photo - Microsoft 365 admin \| Microsoft Learn](https://learn.microsoft.com/en-au/microsoft-365/admin/add-users/change-user-profile-photos?view=o365-worldwide#manage-user-photos-in-microsoft-graph-powershell) - M365 Role Id List:  Code for setting profile photo tenant wide policy update: - (Best Resource!) [How to control profile photo updates in Microsoft 365 via the photoUpdateSettings control - Blog](https://www.michev.info/blog/post/6196/how-to-control-profile-photo-updates-in-microsoft-365-via-the-photoupdatesettings-control) - [[www.michev.info](http://www.michev.info)](https://www.michev.info/) - [Microsoft 365 Photo Update Settings Policy](https://office365itpros.com/2024/09/16/photo-update-settings-policy/) - office365itpros.com - [How to Figure Out What Microsoft Graph Permissions You Need \| Practical365](https://practical365.com/microsoft-graph-api-permission/) - practical365.com ## Related guidance - [Topic overview](Introduction.md) - [Source review status](../../review/Review-status.md)