Regarding the CsApplicationAccessPolicy in Teams powershell

Hi Wang, Qinjie

Thanks for reaching out to Microsoft Q&A forum support 

Based on your description, I understand that your organization has built a Teams bot app and you're trying to assign the CsApplicationAccessPolicy to a large group of users, somewhere between 20,000 to 30,000 people. You've ruled out applying the policy globally due to the risk of widespread impact if something goes wrong and assigning it individually to each user is understandably too time-consuming and hard to maintain. 

The issue arises from the limitations in how CsApplicationAccessPolicy can be assigned. While Microsoft officially supports global and per-user assignments, these options do not scale well for large user bases. Global assignment affects all users and can introduce unintended consequences, while individual assignment requires significant administrative effort and lacks flexibility for ongoing management. 

So, in this context, from my perspective view, you can try to a more manageable solution is to assign the policy to a group using PowerShell by following this instruction: 

1.Create the affective dynamic group 

Use Microsoft Entra ID (formerly Azure AD) to create a security group or Microsoft 365 group that includes the target users. 

2.Assign the Policy via PowerShell 

This is the PowerShell script on my testing environment, you can try to see if it works:

Install-Module -Name PowerShellGet -Force -AllowClobber
Install-Module -Name MicrosoftTeams -Force -AllowClobber
Connect-MicrosoftTeams
$groupName = "YourGroupName"
$policyName = "YourPolicyName"

Grant-CsApplicationAccessPolicy -Group $groupName -PolicyName $policyName
Get-CsApplicationAccessPolicy -Identity $policyName
Get-CsOnlineUser -Filter {ApplicationAccessPolicy -eq $policyName} 

Note: You have to check this syntax of your group as:
Or you can read here for more information: Grant-CsApplicationAccessPolicy (MicrosoftTeams) | Microsoft Learn 

You may try the approach mentioned above to see if it resolves the issue. However, please note that success is not guaranteed, as the script was executed in my own environment. Differences between our environments could lead to unexpected behavior. If you have any updates or need further assistance, feel free to let me know in the comments section below. 

Hope my answer will help you 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.