We're facing a problem with a vulnerability flagged in our scans related to Microsoft Teams. After investigating, I found that the problematic files are located in the Teams folder under the user's AppData. It appears that this folder is lingering due to incomplete cleanups from past Teams updates, and the main issue seems to originate from the Teams Machine-Wide Installer. Here's what I've done so far:
1. Removed the Teams Machine-Wide Installer through an Intune script.
2. Disabled Teams in the Office 365 app deployment in Intune.
3. Currently, I'm in the process of deleting leftover Teams AppData folders.
4. I'm also working on a new Teams deployment using the Microsoft Store method, but it hasn't been deployed yet.
Despite these actions, the vulnerability keeps resurfacing, and now even more devices are being flagged. I have a few questions to guide our next steps:
1. How can we stop future Teams installations from recreating the AppData Teams folder?
2. Is deploying Teams via the Microsoft Store a good long-term solution?
3. What explains the inconsistencies and challenges in managing Microsoft Teams installations or uninstallations?
2 Answers
It sounds like the root issue might be that even though you’ve removed the Teams Machine-Wide Installer, users are still somehow able to access Teams through the old version. If that installer isn't fully uninstalled, it could be recreating the AppData folder every time, which is likely causing your problem. I suggest getting that new deployment set up and tested as soon as possible to see if it resolves the issue. Otherwise, you may be stuck in a cycle until you can completely cut off access through those old installations. By the way, digging into the logs might help narrow down the exact cause if you're up for it! Also, managing AppData is a headache; caching seems inevitable with Teams, so I wouldn't focus too much energy on preventing that altogether. It's just part of how it operates.
Definitely check out Microsoft’s documentation on bulk installation methods. It might provide insights into how best to deploy Teams in a way that minimizes these issues long-term. Here's a link to the relevant page: https://learn.microsoft.com/en-us/microsoftteams/teams-client-bulk-install.
Some users might be using Teams through PWA or have manually installed it. If you removed the old installer and folder but they're still appearing, the problem might lie in those other installation methods.