使用PowerShell克隆Microsoft Teams组时遇403错误求助

我正与微软支持团队协作处理M365 Group的CreationOption值更新问题，等待解决期间，尝试将存在问题的Teams组克隆到新的启用Teams功能的M365组，但克隆过程中出现403禁止错误，希望社区提供排查建议，尤其是权限调整或设置优化方向。

克隆使用的PowerShell脚本 #

Install-Module Microsoft.Graph.Teams -Force
Import-Module Microsoft.Graph.Teams -MinimumVersion 2.15.0
Connect-MgGraph -Scopes Group.Read.All, Team.ReadBasic.All, TeamSettings.Read.All, TeamSettings.ReadWrite.All

# Get the Teams you have access to
##$teams = Get-MgTeam

# List all teams with their IDs
##$teams | Select-Object DisplayName, Id | Sort DisplayName

# Define parameters for the new team
$params = @{
    displayName = "Problem Team Copy"
    description = "Testing copy of Problem Team"
    mailNickname = "problemcopytest"
    partsToClone = "apps,tabs,settings,channels"
    visibility = "private"
}

$teamId = "8xxxxx88-xx8x-8xx8-8888-896x7x019xx4"

Copy-MgTeam -TeamId $teamId -BodyParameter $params

收到的错误信息 #

Copy-MgTeam : Unable to fetch team thread: Failed to execute Skype backend request GetThreadRequest.
Status: 403 (Forbidden)
ErrorCode: Forbidden
Date: 2024-03-06T13:28:33
Headers:
Transfer-Encoding             : chunked
Vary                          : Accept-Encoding
Strict-Transport-Security     : max-age=31536000
request-id                    : 8xx8xx8x-88xx-88x8-8x8x-514xx5x4x4x1
client-request-id             : 8x88xx88-88x8-88xx-8xxx-822x560x93x2
x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"North Central US","Slice":"E","Ring":"3","ScaleUnit":"003","RoleInstance":"CH01EPF0002DB18"}}
Date                          : Wed, 06 Mar 2024 13:28:32 GMT
At line:15 char:1
+ Copy-MgTeam -TeamId $teamId -BodyParameter $params
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ TeamId = 8xxx...ionJsonSchema }:<>f__AnonymousType3`3) [Copy-MgTeam_Clone], Exception
    + FullyQualifiedErrorId : Forbidden,Microsoft.Graph.PowerShell.Cmdlets.CopyMgTeam_Clone

排查与解决建议 #

• 补充克隆所需的核心权限：当前配置的权限集缺少创建团队和读写组的关键权限，需更新连接范围后重新登录：

  Connect-MgGraph -Scopes Group.Read.All, Group.ReadWrite.All, Team.ReadBasic.All, TeamSettings.Read.All, TeamSettings.ReadWrite.All, Team.Create
  

• 确认原团队的账号权限级别：克隆操作要求账号是原Teams组的所有者，仅成员权限无法执行克隆。可通过以下命令检查你的角色：

  $currentUserId = (Get-MgContext).Account
  Get-MgTeamMember -TeamId $teamId | Where-Object {$_.UserId -eq $currentUserId} | Select-Object Roles
  

• 缩小克隆范围排查冲突：先尝试只克隆基础结构（如设置、频道），排除应用和标签（部分第三方应用可能存在权限限制导致失败）：

  $params = @{
      displayName = "Problem Team Copy"
      description = "Testing copy of Problem Team"
      mailNickname = "problemcopytest"
      partsToClone = "settings,channels"
      visibility = "private"
  }
  

• 检查原团队状态：若原团队处于归档状态，需先取消归档再克隆。可通过以下命令确认状态：

  Get-MgTeam -TeamId $teamId | Select-Object DisplayName, Visibility, IsArchived
  

内容的提问来源于stack exchange，提问作者Bitcoin Murderous Maniac