Skip to content

Commit d28cef1

Browse files
shivaniosloshivanioslo
committed
new page on profile photo settings
1 parent bbedf73 commit d28cef1

File tree

1 file changed

+286
-0
lines changed

1 file changed

+286
-0
lines changed

‎concepts/profilephoto-configure-settings.md

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
---
2+
title: "Manage user profile photo settings in Microsoft 365 using Microsoft Graph"
3+
description: "How admins can set where photos can be changed by the user"
4+
ms.author: "shivansingh"
5+
ms.date: 04/24/2024
6+
---
7+
8+
# Manage user profile photo settings in Microsoft 365 using Microsoft Graph
9+
10+
Using the Microsoft Graph API, Global Administrators can get and
11+
configure photo update settings in an organization. This includes
12+
controlling the environment where user profile photos can be updated
13+
within the organization and which roles are required to update profile
14+
user photos within the organization.
15+
16+
This setting is only available to tenants that have a hybrid identity. Hybrid identity uses accounts that originate in an on-premises AD DS and have a copy in the Microsoft Entra tenant of a Microsoft 365 subscription. To determine whether this applies to you see [here](https://learn.microsoft.com/en-us/microsoft-365/enterprise/deploy-identity-solution-identity-model?view=o365-worldwide). For such hybrid tenants, Global Administrators can configure whether user profile photo updates from on-premises should take effect
17+
within the cloud or whether user profile photo updates within the
18+
organization are to be made from the cloud only.
19+
20+
## Steps for admins
21+
22+
1. Configure your chosen User Profile Photos environment
23+
1. Cloud
24+
2. On-premises
25+
26+
2. Migrate existing User Profile Photo actions to the chosen environment
27+
1. On-premises to cloud
28+
2. Cloud to on-premises
29+
30+
3. Clean-up User Profile Photos in the non-supported environment
31+
1. On-premises
32+
2. Cloud
33+
34+
## Configure the User Profile Photo environment 
35+
36+
For tenants that have a hybrid identity, user accounts can be synced
37+
from on-premises Active Directory to the cloud via [Directory
38+
Sync](https://learn.microsoft.com/en-us/azure/active-directory/architecture/sync-directory).
39+
For such hybrid tenants, Global Administrators can configure whether
40+
such user profile photo updates from on-premises should take effect
41+
within the cloud or whether user profile photo updates within the
42+
organization are to be made from the cloud only.
43+
44+
Configuration of user profile photo updates does not impact other user
45+
account properties.  Also, configuring of the environment where new
46+
updates can be performed does not affect existing user profile photos
47+
(neither cloud nor on-premises user profile photos). 
48+
49+
### Cloud 
50+
51+
Hybrid tenants that select cloud as their user profile photo master will
52+
not have on-premises user profile photos synced to the cloud. User
53+
profile photos can be updated through Entra ID or Microsoft Graph, as
54+
described in
55+
[this](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos)
56+
document. For tenants that select this configuration, an additional
57+
option to disable user profile photo updates is available. 
58+
59+
*Note: Configuring this option does not remove the on-premises photos
60+
stored in Active Directory or sync the cloud photos to on-premises. Once
61+
this option has been selected, tenant admins are advised to remove the
62+
Active Directory user profile photos using Exchange PowerShell cmdlets,
63+
as described in
64+
[this](https://learn.microsoft.com/en-us/powershell/module/exchange/remove-userphoto)
65+
document. * 
66+
67+
 
68+
69+
### On-premises  
70+
71+
Hybrid tenants that select on-premises as their user profile photo
72+
master will continue to have user profile photos synced from on-premises
73+
to the cloud, such that user profile photo updates will be visible
74+
across Microsoft 365 products. Updates through cloud services will be
75+
disabled for both admins and users. The option of disabling user profile
76+
options is not available for this option since user profile photos
77+
on-premises 
78+
79+
**Important**
80+
81+
When you update photo update settings, it can take up to 24 hours for
82+
the changes to reflect throughout Microsoft 365. For example, if you
83+
block cloud user profile photo updates, it can take up to 24 hours
84+
before the users are blocked from making updates.
85+
86+
## Retrieve the current photo update settings
87+
88+
To get photo update settings configuration for an organization, use the
89+
following command:
90+
```http
91+
GET https://graph.microsoft.com/beta/admin/people/photoupdatesettings
92+
```
93+
If successful, the response returns a 200 OK response code and
94+
a photoUpdateSettings object in the response body.
95+
96+
```http
97+
HTTP/1.1 200 OK
98+
99+
Content-Type: application/json
100+
101+
{
102+
103+
    \"source\": \"cloud\",
104+
105+
    \"allowedRoles\": null
106+
107+
}
108+
```
109+
110+
## Configure Cloud User Profile Photo Environment
111+
112+
Use the update operation to configure the cloud user profile environment
113+
in your organization. With the following operation, all users within the
114+
organization are enabled to update the user profile photo in the cloud
115+
environment.
116+
```http
117+
PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettings
118+
Content-Type: application/json
119+
120+
{
121+
122+
    \"source\": \"cloud\",
123+
124+
    \"allowedRoles\": null
125+
126+
}
127+
```
128+
129+
If successful, the response returns a 200 OK response code and
130+
a photoUpdateSettings object in the response body.
131+
```http
132+
HTTP/1.1 200 OK
133+
134+
Content-Type: application/json
135+
136+
{
137+
138+
    \"source\": \"cloud\",
139+
140+
    \"allowedRoles\": null
141+
142+
}
143+
```
144+
## Block Users from changing their user profile photos
145+
146+
For tenants that select cloud configuration, an additional option is
147+
available to set which roles are required to update profile user photos
148+
within the organization.
149+
150+
### Global Administrator
151+
152+
Use the update operation to configure Global Administrator only profile
153+
photo update support in your organization.
154+
```http
155+
PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettings
156+
157+
Content-Type: application/json
158+
159+
{
160+
161+
    \"source\": \"cloud\",
162+
163+
    \"allowedRoles\": \[\"62e90394-69f5-4237-9190-012177145e10\"\]
164+
165+
}
166+
```
167+
If successful, the response returns a `200 OK` response code and
168+
a photoUpdateSettings object in the response body.
169+
```http
170+
{
171+
172+
    \"source\": \"cloud\",
173+
174+
    \"allowedRoles\": \[\"62e90394-69f5-4237-9190-012177145e10\"\]
175+
176+
}
177+
```
178+
### User Administrator
179+
180+
Use the update operation to configure User Administrator only profile
181+
photo update support in your organization.
182+
```http
183+
PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettings
184+
185+
Content-Type: application/json
186+
187+
{
188+
189+
    \"source\": \"cloud\",
190+
191+
    \"allowedRoles\": \[\" fe930be7-5e62-47db-91af-98c3a49a38b1\"\]
192+
193+
}
194+
```
195+
If successful, the response returns a `200 OK` response code and
196+
a photoUpdateSettings object in the response body.
197+
```http
198+
{
199+
200+
    \"source\": \"cloud\",
201+
202+
    \"allowedRoles\": \[\" fe930be7-5e62-47db-91af-98c3a49a38b1\"\]
203+
204+
}
205+
```
206+
### Global Administrator and User Administrator
207+
208+
Use the update operation to configure Global Administrator and User
209+
Administrator profile photo support in your organization.
210+
```http
211+
PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettings
212+
213+
Content-Type: application/json
214+
215+
{
216+
217+
    \"source\": \"cloud\",
218+
219+
    \"allowedRoles\": \[\"62e90394-69f5-4237-9190-012177145e10\",
220+
\"fe930be7-5e62-47db-91af-98c3a49a38b1\"\]
221+
222+
}
223+
```
224+
If successful, the response returns a `200 OK` response code and
225+
a photoUpdateSettings object in the response body.
226+
```http
227+
{
228+
229+
    \"source\": \"cloud\",
230+
231+
    \"allowedRoles\": \[\"62e90394-69f5-4237-9190-012177145e10\",
232+
\"fe930be7-5e62-47db-91af-98c3a49a38b1\"\]
233+
234+
}
235+
```
236+
## Configure On-Premises User Profile Photo Environment
237+
238+
Use the update operation to configure the on-premises user profile
239+
environment in your organization.
240+
```http
241+
PATCH https://graph.microsoft.com/beta/admin/people/photoupdatesettings
242+
243+
Content-Type: application/json
244+
245+
{
246+
247+
    \"source\": \"onpremises\",
248+
249+
    \"allowedRoles\": null
250+
251+
}
252+
```
253+
If successful, the response returns a `200 OK` response code and
254+
a photoUpdateSettings object in the response body.
255+
```http
256+
{
257+
258+
    \"source\": \"onPremises\",
259+
260+
    \"allowedRoles\": null
261+
262+
}
263+
```
264+
## Clean up User Profile Photos in the non-supported environment
265+
266+
After updating the User Profile Photo Environment, it is advised that
267+
user profile photos in the non-supported environment are removed.
268+
269+
### On-premises
270+
271+
The on-premises photo can be removed from Active Directory using
272+
Exchange PowerShell, as described in
273+
[this](https://learn.microsoft.com/en-us/powershell/module/exchange/remove-userphoto)
274+
document.
275+
276+
### Cloud
277+
278+
The cloud user profile photo can be removed using the Microsoft Graph,
279+
as described in
280+
[this](https://learn.microsoft.com/en-us/graph/api/profilephoto-delete?view=graph-rest-1.0&tabs=http)
281+
document.
282+
283+
## How the introduction of admin controls impacts existing photos stored in the cloud and on-premises 
284+
285+
There is no impact on existing photos stored in the cloud and
286+
on-premises.  

0 commit comments

Comments
 (0)