IT Services Reference
Powered by

Block Profile Picture Updates

In 

Look up the recovered Graph settings for restricting profile-photo updates through Microsoft 365 web portals. The notes include a retired mailbox-policy method and incomplete command fragments, not a validated configuration procedure.

Source ticket: https://servicedesk.ccmschools.app/helpdesk/tickets/119490

Retired method: Exchange mailbox policy

This exchange policy has been retired and no longer works. To View Mailbox Policy Setting:

Get-OwaMailboxPolicy | FL nam, SetPhotoEnabled

Screenshot retained for review

Web photo-update settings described in the source

This is for restricting users from updating their user profile photos using M365 web portals.

These were the remaining locations where a user can update their profile picture

- myaccount.microsoft.com/organizations?ref=AccountSettings - m365.cloud.microsoft/search/overview

View Current Photo Update Restriction Settings For Your M365 Tenant

The source records the tenant settings as being in their default state at the time of capture.

In the default state everyone can manage their profile picture.

The held screenshot was described as showing those default settings.

  • source = $null
  • allowedRoles  = empty list
Connect-MgGraph

Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/admin/people/photoupdatesettings"

Screenshot of result

Screenshot retained for review

TO RESTRICT profile photoupdate

The source records this script location; the script itself is not supplied by that path in this companion:

…\Documents\powershell\R&DTempScripts\ProfilePhotoRestrictAccess\ProfilePhotoRestrictAccess.ps1

TO RESTRICT profile photo updates via the M365 website, you need to run the following patch command.

The GUIDs in the allowedRoles are for the User Administrator and Global Administrator.

Note if you don't add the GA role to the allowedRoles, GA's will not be able to update a profile picture using the web interface.

Screenshot retained for review

Role Id for

  • People Administrator: 024906de-61e5-49c8-8572-40335f1e0e10
  • User Administrator: fe930be7-5e62-47db-91af-98c3a49a38b1
  • Global Administrator: 62e90394-69f5-4237-9190-012177145e10

Role Id's are from learn.microsoft.com

MS Graph Scope Required:  PeopleSettings.ReadWrite.All

Connect-MsGraph -Scope "PeopleSettings.ReadWrite.All"

$URI = " https://graph.microsoft.com/beta/admin/people/photoupdatesettings"

$METHOD = "PATCH"
$ApiParams = @{

"source" = "cloud"

"allowedRoles" = @("024906de-61e5-49c8-8572-40335f1e0e10","fe930be7-5e62-47db-91af-98c3a49a38b1","62e90394-69f5-4237-9190-012177145e10")

}

Invoke-MgGraphRequest -Method $METHOD -Uri $URI -Body $ApiParams

TO REVERSE RESTRICTION AND ALLOW ALL USERS AGAIN:

$URI = " https://graph.microsoft.com/beta/admin/people/photoupdatesettings"

$METHOD = "PATCH"
$UndoApiParams = '{

"allowedRoles": []

}'

$Settings = Invoke-MgGraphrequest -Uri $URI -Method $METHOD -Body $UndoApiParams

===================END: RESTRICTING WEB FOR PHOTO UPDATES =============================

Photos can also be updated using powershell and admin consoles.

Users in the following roles can make photo profile changes:

  • People Administrator (New as of 6Feb2025 - office365itpros.com)
  • Directory writers
  • Intune administrator
  • User administrator

Powershell Using Ms Graph commandlets

References

Exchange Photo commandlets were retired in 2023.

More Detailed List of Command for managing user profile Photos:

Code for setting profile photo tenant wide policy update: