Session is not established, run Connect-MicrosoftTeams before requesting access token

Session is not established, run Connect-MicrosoftTeams before requesting access token is printed by the Cs cmdlets of the MicrosoftTeams module (the former Skype for Business Online cmdlets such as Get-CsOnlineUser, Grant-CsTeamsMeetingPolicy, Set-CsTeamsMessagingPolicy, Set-CsPhoneNumberAssignment) when no Teams session exists. Connect first:

Connect-MicrosoftTeams
Get-CsOnlineUser -Identity anna@contoso.com

Reproduce it

MicrosoftTeams 8.0.0 imported, no connection:

Import-Module MicrosoftTeams
foreach ($run in { Get-CsOnlineUser -Identity anna@contoso.com -ErrorAction Stop },
                 { Grant-CsTeamsMeetingPolicy -Identity anna@contoso.com -PolicyName Kiosk -ErrorAction Stop }) {
  try { & $run } catch { $_.Exception.Message }
}

Session is not established, run Connect-MicrosoftTeams before requesting access token
Session is not established, run Connect-MicrosoftTeams before requesting access token

The Teams team and channel cmdlets (Get-Team, New-Team, Add-TeamUser) use a different wording for the same problem: You must call the Connect-MicrosoftTeams cmdlet before calling any other cmdlets.

In scripts

try {
  $null = Get-CsTenant -ErrorAction Stop
} catch {
  Connect-MicrosoftTeams
}

Each PowerShell runspace has its own session: Start-Job and ForEach-Object -Parallel blocks must connect themselves. For scheduled scripts use certificate-based app-only sign-in; only part of the Cs cmdlets support it.

What the message means

The MicrosoftTeams module contains two families of cmdlets. The team and channel cmdlets (Get-Team, New-Team, Add-TeamUser) and the Cs cmdlets (policies, users, phone numbers, call queues, inherited from Skype for Business Online) talk to different back ends and check the connection in different ways. Before sending a request, a Cs cmdlet asks the module for an access token for the current session. When the module has no session, it stops with this message instead of contacting the service: nothing was changed and no request was sent. The cmdlet name and parameters were valid, otherwise you would see a parameter error first.

How to recognise each cause

Fix and confirm

1. Run Connect-MicrosoftTeams (or the certificate form for unattended scripts) in the same session.
2. Confirm with a read-only call such as Get-CsTenant or Get-CsOnlineUser -Identity you@contoso.com. Data back means the session is established.
3. If the read works but changes fail, check the account's admin role: policy assignment needs Teams Administrator or a more specific Teams role, which is a separate problem from this error.

Prevent it in scripts

Connect once at the top of every script, in the same runspace that calls the Cs cmdlets, and disconnect at the end with Disconnect-MicrosoftTeams. Pass the connection into parallel work by connecting inside each job instead of relying on the parent window. For scheduled tasks, use an app registration with a certificate (-CertificateThumbprint, -ApplicationId, -TenantId) and check in the Connect-MicrosoftTeams reference which Cs cmdlets support app-only access. Policy assignment examples are on Grant-CsTeamsMeetingPolicy.

FAQ