How to prevent Microsoft 365 users from changing their photos

Users can change or add their profile photos in Microsoft apps, such as Outlook, OWA, and Teams. To keep the picture policy consistent in your organization, you can block a single, multiple, or all users from updating their profile picture. In this article, we will show you how to prevent Microsoft 365 users from changing their profile photos in Outlook, Microsoft Teams, and Microsoft Entra admin center.

Change user profile photo in Microsoft 365

By default, users can change or add a profile picture from the Microsoft 365 apps or services.

We will show you how users can change their profile picture in Microsoft:

• Outlook
• Outlook on the Web (OWA)
• Teams
• Microsoft Entra admin center

Change profile photo in Outlook and OWA

To change or add a profile picture in the Outlook app, follow these steps:

1. Go to Outlook > File
2. Click Info
3. Click on the profile picture or Change

5. It will direct you to Outlook on the Web (OWA) or go directly to OWA to change the profile picture
6. Upload a new photo or Drag your photo here

7. Click Apply

Change profile picture in Microsoft Teams

To change or add a profile picture in the new Microsoft Teams app, follow these steps:

1. Sign in to the Microsoft Teams app with your work account
2. Expand the icon or picture in the top right corner
3. Click on the icon or picture

4. Click Upload
5. Upload the picture

4. Click Save

Change user photo in Microsoft Entra admin center

Users can change their profile photo in the Microsoft Entra admin center, which will sync with all the other Microsoft 365 apps and services.

To change or add a profile picture in the Microsoft Entra admin center, follow these steps:

1. Sign in to the Microsoft Entra admin center with your work account
2. Expand Identity > Users > All users
3. Click on your display name

4. Click on the camera icon

5. Drag and drop the files or Browse for files
6. Click Save

The user successfully uploaded a new photo to the Microsoft Entra admin center.

Prevent Microsoft 365 users from changing profile photos

Some Microsoft apps don’t sync with others, which means that you need to block the users in different ways. We will show you how to prevent Microsoft 365 users from changing their profile photos in Microsoft Entra admin center and PowerShell.

Get SetPhotoEnabled status with PowerShell

To block users from updating their profile photos in Microsoft apps and services, we need to check the current OWA mailbox policy.

To be able to run PowerShell commands, you must Connect to Exchange Online PowerShell. Open Windows PowerShell as administrator, run the below cmdlet, and sign in with your admin credentials.

Connect-ExchangeOnline

We will use the Get-OwaMailboxPolicy PowerShell cmdlet to view Outlook on the Web mailbox policies in the organization.

Run the below PowerShell command.

Get-OwaMailboxPolicy | ft Name, SetPhotoEnabled

The PowerShell output shows the OWA mailbox policy Default that allows users to change their profile picture.

Name                     SetPhotoEnabled
----                     ---------------
OwaMailboxPolicy-Default            True

Prevent all Microsoft 365 users from changing photos in OWA

To configure the existing Outlook on the Web mailbox policies, we will use the Set-OwaMailboxPolicy PowerShell cmdlet.

The -SetPhotoEnabled parameter specifies whether users can add, change, and remove their sender photo in Outlook on the Web.

• $true: Users can manage their profile photos in Outlook on the Web (default value)
• $false: Users can’t manage their profile photo in Outlook on the Web

Run the below PowerShell command to block users in your organization from changing their profile picture.

Set-OwaMailboxPolicy "OwaMailboxPolicy-Default" -SetPhotoEnabled $false

By default, the users have the OwaMailboxPolicy-Default already set, and the above setting will apply. If some users have another policy, you must set the OwaMailboxPolicy-Default policy for all the mailboxes.

Run the following PowerShell command to apply the OwaMailboxPolicy-Default policy for all the users.

Get-CASMailbox -ResultSize Unlimited | Set-CASMailbox –OWAMailboxPolicy "OwaMailboxPolicy-Default"

Block single Microsoft 365 user from changing photos in OWA

To prevent a single user from changing their profile picture in Microsoft, you need to create a new OWA policy.

Run the below PowerShell command to create a new OWA policy.

New-OwaMailboxPolicy "Block users change profile photos" | Set-OwaMailboxPolicy -SetPhotoEnabled $false

Then, apply the new OWA policy to a single user. In our example, we will prevent the user (Amanda Hansen) from changing their profile photo.

Run the below PowerShell command to block a single user from changing their profile photo.

Set-CASMailbox -Identity "Amanda.Hansen@m365info.com" -OwaMailboxPolicy "Block users change profile photos"

Prevent multiple Microsoft 365 users from changing photos in OWA

To block multiple users from changing their profile photos, you need to apply the new OWA policy.

Create a CSV file with the UserPrincipalName.

1. Type UPN at the top of the list
2. List all the user principal names
3. Create the folder temp if you don’t have it already in the (C:) drive
4. Name the file Users.csv
5. Save it as CSV (Comma delimited (*.csv)

6. Specify the CSV file path in line 1
7. Type the policy name in line 2
8. Run the below PowerShell script

$UserList = Import-Csv -Path "C:\temp\Users.csv"
$PolicyName = "Block users change profile photos"

foreach ($User in $UserList) {
    $Mailbox = Get-Mailbox -Identity $User.UPN -ErrorAction SilentlyContinue
    
    if ($Mailbox) {
        $MailboxPolicy = Get-CASMailbox -Identity $Mailbox.Identity | Select-Object -ExpandProperty OwaMailboxPolicy
        
        if ($MailboxPolicy -eq "$PolicyName") {
            Write-Host "Policy already set for user '$($User.UPN)'." -ForegroundColor Yellow
        }
        else {
            Set-CASMailbox -Identity $Mailbox.Identity -OwaMailboxPolicy "$PolicyName"
            Write-Host "Policy set for user '$($User.UPN)'." -ForegroundColor Green
        }
    }
    else {
        Write-Host "User '$($User.UPN)' not found." -ForegroundColor Red
    }
}

The PowerShell output shows whether the users set the new OWA policy to block users from changing profile photos.

Policy already set for user 'Amanda.Hansen@m365info.com'.
Policy set for user 'Brenda.Smith@m365info.com'.
Policy set for user 'Diana.Baker@m365info.com'.
User 'Chris.Lucas@m365info.com' not found.
Policy set for user 'Soren.Vest@m365info.com'.
User 'Unknown@m365info.com' not found.

To prevent the users from changing their profile pictures in Microsoft Entra ID, you must restrict user access in the next step.

Restrict user access to Microsoft Entra admin center

To disable user access to the Microsoft Entra ID, follow these steps:

1. Sign into Microsoft Entra admin center as a Global Administrator
2. Expand Identity > Users > User settings
3. Enable Yes next to Restrict access to Microsoft Entra admin center
4. Click Save

You successfully updated user settings for your organization.

Now that the users are prevented from changing their profile photos, you can always, as an admin, change their user photos. Read more in the article How to manage user photos with Microsoft Graph PowerShell.

Verify Microsoft users blocked from changing profile picture

Verify the user can’t change a profile photo in Microsoft 365 apps and services.

In Outlook, the user can still go to the Account Settings and click on the Picture or on Change. It will only direct them to OWA, and there, the user won’t be able to change their profile photo.

In Outlook on the Web (OWA), users can’t change their photos anymore because it will not show them anything to update their profile picture.

Verify user can’t change profile picture in Outlook and OWA

To check which users are blocked from changing their profile photos, we need to use the Get-CasMailbox PowerShell cmdlet.

Run the below PowerShell command to view all mailbox users who are blocked or unblocked from changing their profile photo in OWA.

Get-CasMailbox | ft Name, DisplayName, OwaMailboxPolicy

The PowerShell output shows the user, shared, room, and equipment mailboxes and which OWAMailboxPolicy they have set.

Name                                 DisplayName              OwaMailboxPolicy
----                                 -----------              ----------------
41377e9c-dc47-46c0-b4a5-1d5bbdcb5cc5 Amanda Hansen            Block users change profile photos
82cd0d62-e974-4892-aca6-e0387abc62be Anna Bell                OwaMailboxPolicy-Default
5cae3874-442b-459c-8f33-3aee5b879275 Anne Butler              OwaMailboxPolicy-Default
0f38d53f-cbe0-4844-86e9-1032a45ba31b Brenda Smith             Block users change profile photos
52a6c1c7-77d2-4109-99b9-a4076167b6e2 Carl Hawk                OwaMailboxPolicy-Default
b602b148-2fcf-435a-9d34-ce72c3a8c748 Diana Baker              Block users change profile photos
29a12fd8-bbd2-440f-b457-8e304200a85d Frank Olsen              OwaMailboxPolicy-Default
19c82700-9d4b-45e5-b608-7b30403046a0 Ken Walker               OwaMailboxPolicy-Default
213a5a8b-0bcf-40cc-b114-edb1b2a423f4 Laura Terry              OwaMailboxPolicy-Default
3bb176aa-d0ba-47f7-aecc-f4837593006e Mary James               OwaMailboxPolicy-Default
Projector 8                          Projector 8              OwaMailboxPolicy-Default
8b31d6a0-6d92-4b5b-80bd-a4029e641d35 RoomMailboxTest          OwaMailboxPolicy-Default
e5c3a5e8-eeae-4829-94dc-fb7228bcf8da Ryan Walker              OwaMailboxPolicy-Default
1e367b85-f0c0-4c9c-a16a-22d132f1d8e6 Søren Vest               Block users change profile photos
c32b2b27-d809-439a-a3e3-eb7a749eeb72 Stephen Hunter           OwaMailboxPolicy-Default
fd199cb4-2ebf-4171-96e2-12fd75453e39 Susan Brown              OwaMailboxPolicy-Default
Test SharedMailbox20231129082329     Test SharedMailbox       OwaMailboxPolicy-Default

Check user can’t change profile picture in Microsoft Teams

If you sign into Microsoft Teams, you can still click on the icon in the right corner.

When you click on the icon to change your profile picture, it shows that the picture options are disabled by policy.

The below is when the user photo was set.

The below is when the profile photo was not set.

Verify user can’t change photo in Microsoft Entra admin center

Verify the user has restricted access to the Microsoft Entra portal, which means they can’t change their photo.

The Microsoft Entra admin center overview looks different, and when you scroll down, you will see that You don’t have access to this data.

That’s it!

Read more: Configure Microsoft 365 quarantine retention period to 30 days »

Conclusion

You learned how to prevent Microsoft 365 users from changing their profile photos. First, you need to restrict user access in Microsoft Entra admin center. Next, use PowerShell to disable the OWA policy to block users from changing their profile picture in Outlook, OWA, and Microsoft Teams.

Did you enjoy this article? You may also like How to fix recover deleted items greyed out in Exchange Online. Don’t forget to follow us and share this article.