MC1338817 High
Microsoft Teams PowerShell: Web Account Manager (WAM) becomes the default authentication broker
Summary AI-generated
Teams PowerShell module will use Web Account Manager (WAM) as the default authentication broker for Windows sign-in, improving security and consistency.
Suggested actions AI-generated
- Review scripts using Teams PowerShell module for WAM compatibility
- Update scripts if needed to support WAM authentication
- Use -DisableWAM parameter temporarily if necessary
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1248389 (Updated) Retirement of -Credential parameter when connecting to Exchange Online PowerShell
- MC1188595 (Updated) App-only certificate-based authentication now available in SharePoint Online Management Shell
- MC1404315 Microsoft Teams for the web will respect Microsoft Entra “Keep Me Signed In” (KMSI) settings
- MC1454390 Retiring Teams Shifts Connection cmdlets from Teams PowerShell Module
- MC1213770 (Updated) Microsoft Purview | Data lifecycle Management cmdlet connectivity change
- MC1192252 External authentication methods (EAM) – Public preview update
Original post from Microsoft
[What and Why]
We are updating the Microsoft Teams PowerShell module to use Web Account Manager (WAM) as the default authentication broker for sign-in. This change improves security and provides a more consistent authentication experience on Windows.
A new temporary parameter, -DisableWAM, is available in the Connect-MicrosoftTeams cmdlet, allowing admins to bypass WAM for a single connection if it is not supported in their environment.
This change is available starting with preview version 7.8.1 of the Teams PowerShell module.
[Rollout Schedule]
General Availability (Worldwide, GCC, GCCH, DoD): Rollout will begin in late June 2026 and is expected to complete in late June 2026.
[Impact on Your Organization]
Who is affected
- Admins using the Microsoft Teams PowerShell module on Windows
Platforms/Services
- Microsoft Teams PowerShell module
- Windows
What will happen
- Sign-in for the following scenarios will use WAM as the authentication broker:
- Interactive sign-in using Connect-MicrosoftTeams
- Connect-MicrosoftTeams with credential (-Credential)
- Connect-MicrosoftTeams with AccountId (-AccountId, Integrated Windows Authentication)
- The following sign-in methods are not affected:
- Service principal with certificate
- Managed identity
- Pre-acquired access tokens
- A temporary -DisableWAM parameter is available to bypass WAM for a single connection.
- The -DisableWAM parameter will be removed in a future release.
Known limitations:
- On macOS, Linux, and Windows versions earlier than Windows 10 or Windows Server 2019, existing authentication behavior remains unchanged.
- WAM requires an interactive Windows session with UI access.
- WAM will not work in non-interactive scenarios such as Windows services, scheduled tasks without a logged-in user, or scenarios that run under impersonation.
[Action Required / Recommendations]
- Review any scripts that use the Teams PowerShell module, especially those running in non-interactive environments.
- Update scripts if needed to support WAM authentication.
- Use the -DisableWAM parameter as a temporary workaround if required.
Learn more: Connect-MicrosoftTeams | Microsoft Teams | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Microsoft Teams PowerShell module will use Web Account Manager (WAM) as the default authentication broker on Windows starting late June 2026 (version 7.8.1). A temporary -DisableWAM parameter allows bypassing WAM. Non-interactive and older Windows versions are unaffected. Admins should review and update scripts accordingly.