Teams policy: which one wins?

Direct beats group

A policy assigned directly to a user takes precedence over any policy of the same type assigned to a group the user is in. The user inherits nothing of that type from a group until the direct assignment is removed. Microsoft's page on assigning Teams policies to users and groups

Between groups, the smaller rank wins

When a user is in two groups that each carry a policy of the same type, the user gets the policy of the higher-ranked assignment: the smaller number, with 1 the highest. Ranks are counted per policy type, and they close up. Remove the rank 2 assignment and ranks 3 and 4 move up.

No rank means last

A group assignment added without a rank gets the lowest ranking, so set it on purpose. In the Teams admin center, changing a rank later means removing the group assignment and adding it again. In PowerShell, the policy type's Grant cmdlet changes the rank in place.

Nested groups get nothing

Group policy assignments reach the group's direct members only. Members of a nested group inherit nothing from it. A user with no direct assignment and no group assignment of that type gets the org-wide default.

Three types that can't go to a group

Microsoft's page lists three policy types that the Teams admin center and the Teams PowerShell module don't support for group assignment: Teams App Permission Policy, Teams Upgrade Policy and Dialout Policy. Separately, a group with the HiddenGroupMembership setting enabled can't use group policy assignment, and class teams have that setting on by default.

Settle it for one user

Get-CsUserPolicyAssignment, with the policy type and PolicySource expanded, lists every assignment behind a user's policy. AssignmentType reads Direct or Group, and a Group row carries the group's ID under Reference.

The MS-700 Managing Microsoft Teams Complete Exam Guide covers these precedence rules in its governance chapter. The card below links it.

All 75 MS-700 sampler questions, with answers and the Microsoft Learn page behind each