Troubleshooting Teams phone sign-in and provisioning

See also

Sources

1. 1
   A device with Admin Agent 794 or later is updated automatically to the latest eligible Admin Agent by Microsoft's Zero-Day Update mechanism once powered on and connected; a device on an earlier Admin Agent must first be manually updated with OEM firmware that includes Admin Agent 794 or later.

   Transitioning updates management for Teams Android devices from Teams Admin Center to the Teams Rooms Pro Management Portal · Guidance for devices with older Admin Agent versions · Checked 2026-09-30
2. 2
   Error AADSTS530036 indicates that a refresh token is invalid because of authentication flow checks by Conditional Access; Microsoft lists it as the way to recognise a protocol-tracking block when the authentication flows policy applies to all applications.

   Authentication flows as a condition in Conditional Access policy · Troubleshooting unexpected blocks · Checked 2026-09-30
3. 3
   Teams Android devices need Admin Agent version 830 (1.0.0.202606082157) or later to be managed in the Pro Management Portal, and existing Teams phones enrolled in the Teams admin center enrol in the portal automatically after updating to that version.

   Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal · Minimum app version requirements; Migration checklist and prerequisites > Step 1 > item 7.3.1 · Checked 2026-09-30
4. 4
   Microsoft lists as a known issue that a phone signed in with a Teams Shared Devices licence in Common Area Phone sign-in mode and enabled for Advanced Calling shows Basic Calling after updating to version 1449/1.0.94.2026220406; workarounds are to change the sign-in mode to UserSignIn or to re-enable Advanced Calling in the Teams admin center or on the device.

   Known issues with Teams on Android devices · Issues affecting Teams phone devices > row Basic Calling displays instead of Advanced Calling · Checked 2026-09-30
5. 5
   In Microsoft's supported-policy table the Conditional Access Authentication flows condition is Not supported for Teams Rooms on Android, Teams phone and Teams panels, with the instruction not to block device code flow.

   Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > table row Authentication flows · Checked 2026-09-30
6. 6
   Authentication strength, including FIDO2 security keys, is not supported in Conditional Access policies that affect Teams devices.

   Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > Note after table; table row Require authentication strength · Checked 2026-09-30
7. 7
   A certified device is enrolled in Teams device management automatically the first time a user signs in to Teams on it, and phones are automatically enrolled in Microsoft Intune if the organisation has signed up for it, after which device compliance is confirmed and Conditional Access policies are applied to the device.

   Manage devices in Microsoft Teams · What devices can you manage?; Manage phones, Teams Rooms on Android, Teams displays, and Teams panels · Checked 2026-09-30
8. 8
   The Teams upgrade configuration setting BlockLegacyAuthorization, when enabled, prevents Teams phones from connecting to Teams services; its state can be checked with Get-CsTeamsUpgradeConfiguration.

   Authentication best practices for Teams phones · Teams Legacy Authorization · Checked 2026-09-30
9. 9
   When Conditional Access policies apply to the Teams service, noncompliant Teams Android devices can fail to sign in or get stuck in sign-in loops, sign out of Teams at random, or have Teams stop responding.

   Fix Conditional Access-related issues for Teams Android devices · Symptoms · Checked 2026-09-30
10. 10
    If a custom app setup policy unpins the calling app, the dial pad does not appear on a common area phone after sign-in.

    Set up the common area phones for Microsoft Teams · Step 5 > Local sign-in > Note · Checked 2026-09-30
11. 11
    A common area phone is signed in with a resource account that holds a Teams Shared Devices licence; that licence includes Phone System features, so no separate Phone System licence is needed, though a Calling Plan may be added when Direct Routing or Operator Connect is not used.

    Set up the common area phones for Microsoft Teams · Step 1 - Buy the licenses; Step 2 > Using the Microsoft 365 admin center > step 6 and Note · Checked 2026-09-30
12. 12
    When creating a common area phone account Microsoft highly recommends setting the password manually, clearing both Automatically create a password and the requirement to change the password at first sign-in, to prevent sign-in issues.

    Set up the common area phones for Microsoft Teams · Step 2 > Using the Microsoft 365 admin center > step 5 and Important note · Checked 2026-09-30
13. 13
    The common area phone experience is enabled by setting the Teams IP Phone policy SignInMode parameter to CommonAreaPhoneSignIn, and the IP Phone policy can be modified only if the account signing in to the phone is licensed with something other than a Teams Shared Devices licence.

    Set up the common area phones for Microsoft Teams · Step 3 - Set policies for common area phones > IP phone policies · Checked 2026-09-30
14. 14
    Microsoft lists three ways to sign in a common area phone: local sign-in with Sign in on this device, sign-in from another device by entering the code shown on the phone at https://www.microsoft.com/devicelogin, and sign-in by an admin using the Teams admin center.

    Set up the common area phones for Microsoft Teams · Step 5 - Sign in to the Teams Phone · Checked 2026-09-30
15. 15
    For Teams phones enrolled with AOSP Device Management the supported Intune compliance settings are rooted devices, minimum and maximum operating system version, minimum security patch level and storage encryption; the three password-unlock settings are not supported because Teams devices do not support a password unlock.

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported device compliance policies > Teams phones tab · Checked 2026-09-30
16. 16
    Blocking device code flow with Conditional Access prevents using microsoft.com/devicelogin to remotely sign in a Teams Android device.

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > Important note · Checked 2026-09-30
17. 17
    Microsoft Entra documents blocks on protocol-tracked sessions as expected behaviour whose impact can include complete device sign-out, with no recommended remediation while the policy is enabled; if the policy was set to disabled or report-only a fresh token may be needed to use the device again.

    Authentication flows as a condition in Conditional Access policy · Troubleshooting unexpected blocks > Note · Checked 2026-09-30
18. 18
    Since early September 2024 Microsoft enforces authentication flows policies on the Device Registration Service when the policy targets all resources, and organisations that use device code flow for device registration must exclude Device Registration Service from such a policy to avoid impact.

    Authentication flows as a condition in Conditional Access policy · Enforcement of Authentication Flows policies on Device Registration Service resource · Checked 2026-09-30
19. 19
    A tenant that follows the Entra recommendation to block device code flow for all users will break code-based remote sign-in on Teams phones unless the accounts or devices used on those phones are scoped out of that block.inferred

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > Important note · Checked 2026-09-30
20. 20
    Once the failing Conditional Access policy is identified, Microsoft's resolution is to exclude the affected device with a device filter; device filters apply only to device objects, and the model and manufacturer attributes are available only for Intune-enrolled devices, otherwise extension attributes must be used.

    Fix Conditional Access-related issues for Teams Android devices · Resolution > Manual checks > paragraph and Note after step 7 · Checked 2026-09-30
21. 21
    As Teams Android devices move to Intune AOSP device management, the device.displayName attribute carries manufacturer information early in the sign-in process, before Intune completes enrollment, so Microsoft suggests it for Conditional Access device filter rules.

    Fix Conditional Access-related issues for Teams Android devices · Resolution > paragraphs 2-3 · Checked 2026-09-30
22. 22
    For Teams devices to function, Conditional Access must not block access to Office 365, Office 365 SharePoint Online, Microsoft Teams Services, Microsoft Intune Enrollment and Device Registration Service.

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > table row Target Resources · Checked 2026-09-30
23. 23
    Microsoft Entra guidance recommends blocking device code flow wherever possible and allowing it only where necessary.

    Authentication flows as a condition in Conditional Access policy · Device code flow · Checked 2026-09-30
24. 24
    Microsoft Entra guidance gives as an example that where device code flow is used for Android-based conference room devices, it can be blocked everywhere except for Android devices in a specific network location.

    Authentication flows as a condition in Conditional Access policy · Device code flow · Checked 2026-09-30
25. 25
    As a last resort Microsoft documents a factory reset through the OEM device settings or OEM key combination, followed by deleting the device object in Microsoft Entra ID, Microsoft Intune and the Teams admin center so that fresh objects are created, and then signing in again.

    Certified Android devices get signed out of Teams · Teams displays > Option 4: Reset the device · Checked 2026-09-30
26. 26
    The Teams admin center health status No connection means the connection between the admin center and the device has been lost, and Microsoft's stated fix is to restart or update the device through the admin center; if a troubled device shows no issues, Microsoft says to make sure its firmware is on the latest version.

    Manage devices in Microsoft Teams · View issues with Android-based Teams devices > item 2 and Note · Checked 2026-09-30
27. 27
    In the Teams admin center device list the health status column can show Sign-in errors exist for an Android-based Teams device; selecting it shows the time of the failure, the account that attempted to sign in, the reason for the failure and a history of earlier sign-in failures.

    Manage devices in Microsoft Teams · View issues with Android-based Teams devices · Checked 2026-09-30
28. 28
    Shared Teams phones used for hot-desking should be excluded from compliance policies because compliance policies prevent the device from enrolling into the hot-desk user's account; Microsoft says to secure them with named locations instead.

    Authentication best practices for Teams phones · When and when not to require compliant shared devices > Note · Checked 2026-09-30
29. 29
    If Teams Android devices are not visible, are unmanageable or show Device is not connected to IoT Hub in the Pro Management Portal, Microsoft's checks are to allow the required network URLs, update the device to the minimum Admin Agent version, and make sure no unsupported Conditional Access policies are assigned to the Teams resource accounts.

    Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal · Migration checklist and prerequisites > Step 2 · Checked 2026-09-30
30. 30
    The user interface a Teams phone shows is chosen from the licence on the signed-in account: the Teams Shared Devices licence allows only the common area phone interface, the Teams Rooms licence allows only meeting room interfaces, and an E3 or E5 licence supports all sign-in modes.

    Set Microsoft Teams Android devices user interface · Override automatic user interface detection > Note · Checked 2026-09-30
31. 31
    The Require multifactor authentication grant control is listed as Supported for Teams Rooms on Android, Teams phone and Teams panels, with the advice not to enforce it and to use a different secondary authentication factor so that sign-on is seamless.

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > table row Require multifactor authentication · Checked 2026-09-30
32. 32
    Teams phone sign-in fails or loops continually when both an MFA Conditional Access policy and a Terms of Use Conditional Access policy are used; Microsoft states the combination is not supported.

    Known issues with Teams on Android devices · Issues affecting Teams phone devices > row Sign in loops or fails for Teams Phones · Checked 2026-09-30
33. 33
    Microsoft's workaround for the MFA plus Terms of Use sign-in loop is to use only the MFA Conditional Access policy or only the MDM Conditional Access policy, and when only the MFA policy is used to make sure it is enabled in Device Registration Services.

    Known issues with Teams on Android devices · Issues affecting Teams phone devices > row Sign in loops or fails for Teams Phones > Workaround · Checked 2026-09-30
34. 34
    A Teams phone whose Admin Agent is below version 830 receives no app or firmware updates until the Admin Agent is updated to 830 or later; the Admin Agent update itself is pushed through the Teams admin center and cannot be paused.

    Transitioning updates management for Teams Android devices from Teams Admin Center to the Teams Rooms Pro Management Portal · Device type specific updates guidance > Teams phones · Checked 2026-09-30
35. 35
    If a device is marked noncompliant, the Microsoft Entra token-issuing service stops renewing or revokes its tokens, so the device cannot get an updated authentication token and is forced to sign out.

    Fix Conditional Access-related issues for Teams Android devices · Cause > Unsupported Conditional Access policy or Intune device compliance policy settings · Checked 2026-09-30
36. 36
    User password-expiration policies also apply to accounts used on shared Teams phones, and when such a password expires the account stops working on the device until an administrator resets the password and signs the device back in; Microsoft recommends setting these accounts' passwords never to expire.

    Authentication best practices for Teams phones · Best practices for the deployment of shared Teams phones > Use a resource account and curtail its password expiration · Checked 2026-09-30
37. 37
    For affected Teams phones Microsoft directs admins to the Teams Android Desk Phone Sign in connectivity test in the Microsoft Remote Connectivity Analyzer, which verifies that the user account meets the requirements to sign in to a Teams Android desk phone and can be run by administrators and non-administrators.

    Certified Android devices get signed out of Teams · Teams phones · Checked 2026-09-30
38. 38
    Access to the Pro Management Portal requires that the organisation has at least one Teams Rooms Pro, Basic or Standard licence, or at least one Teams Shared Space licence, or at least one Teams device already enrolled in the portal.

    Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal · Migration checklist and prerequisites > Step 1 > Licensing requirements for PMP access · Checked 2026-09-30
39. 39
    All Teams Rooms on Android, Teams panel, Teams phone and SIP gateway devices can be provisioned remotely from the Teams Pro Management Portal.

    Remote provisioning and sign in for Teams Android devices · Supported devices · Checked 2026-09-30
40. 40
    The Pro Management Portal remote provisioning sequence is: add the device MAC address or hardware ID under Planning > Android Devices; generate a verification code for a device listed as Ready for provisioning; enter that code on the device under Provision device in Settings; then complete the first remote sign-in from the device's Waiting for sign in entry using the code at microsoft.com/devicelogin.

    Remote provisioning and sign in for Teams Android devices · Step 1 through Step 4 · Checked 2026-09-30
41. 41
    For a device already connected to the Pro Management Portal that has been signed out, an admin can select the device, open the Account tab and select Generate code to sign it back in; after a few minutes the Account tab shows the user principal name of the signed-in account.

    Remote provisioning and sign in for Teams Android devices · Sign in a device which was previously signed in · Checked 2026-09-30
42. 42
    After a policy is assigned to a common area phone account the phone must be signed out and signed back in, and the assignment may take up to an hour to take effect.

    Set up the common area phones for Microsoft Teams · Step 3 - Set policies for common area phones > Calling policies > Note · Checked 2026-09-30
43. 43
    A session established with device code flow is protocol tracked, the tracked state persists through token refreshes, and later requests in that session that do not use device code flow can still be blocked by an authentication flows policy.

    Authentication flows as a condition in Conditional Access policy · Protocol tracking · Checked 2026-09-30
44. 44
    The Microsoft Remote Connectivity Analyzer is not available for the GCC and GCC High Microsoft 365 Government environments.

    Certified Android devices get signed out of Teams · Teams phones > Note · Checked 2026-09-30
45. 45
    The on-device recovery sequence Microsoft documents is: select Refresh code and use the new code; if no code is generated select Sign in on this device and enter the password for the pre-populated username; if sign-in still fails select Start over, which signs the device out, then select Refresh code again.

    Certified Android devices get signed out of Teams · Teams displays > Option 3: Generate a new code on the device to sign in · Checked 2026-09-30
46. 46
    Microsoft recommends securing shared Teams phone resource accounts with a named location or a require-compliant-device control rather than user-interactive MFA.

    Authentication best practices for Teams phones · Best practices for the deployment of shared Teams phones > Review these Conditional Access policies > Tip · Checked 2026-09-30
47. 47
    Microsoft states that if shared Teams phones are grouped with user accounts or personal devices under a Conditional Access policy the sign-in will fail, because a shared device generally has no single user who can complete multifactor authentication or periodic reauthentication.

    Authentication best practices for Teams phones · Authentication recommendations are different for personal versus shared android devices > item 2 · Checked 2026-09-30
48. 48
    With a Conditional Access sign-in frequency setting, each forced reauthentication revokes the token and creates a new device object under the user account, and once the number of device objects exceeds the Microsoft Entra or Intune device limit the user can no longer sign in to the device.

    Fix Conditional Access-related issues for Teams Android devices · Cause > The Sign-in frequency setting · Checked 2026-09-30
49. 49
    Sign-in frequency is listed as Not supported for all Teams device types; Microsoft states it causes devices to sign out periodically and that sign-in frequency configured on individual Microsoft 365 services can interrupt or stop the Teams device sign-in flow.

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > Important note; table row Sign-in frequency · Checked 2026-09-30
50. 50
    Microsoft's known-issues list attributes automatic sign-out of Teams Rooms on Android, Teams Phones, Teams panels and Teams displays to a policy block on the device registration service.

    Known issues with Teams on Android devices · Issues affecting multiple device types > row Signed out of Teams on Android devices · Checked 2026-09-30
51. 51
    A device that remains signed out for an extended period cannot be onboarded to the Pro Management Portal automatically; an administrator must sign in to it at least once after it has been updated to the latest eligible Admin Agent version.

    Transitioning updates management for Teams Android devices from Teams Admin Center to the Teams Rooms Pro Management Portal · Guidance for devices that remain signed out for an extended period · Checked 2026-09-30
52. 52
    The automatic sign-out issue on certified Teams Android devices is identified in the Entra non-interactive user sign-in logs by entries with Application Microsoft Authentication Broker, Status Failure and Resource Device Registration Service.

    Certified Android devices get signed out of Teams · Introduction (before first heading) · Checked 2026-09-30
53. 53
    To check a Conditional Access sign-in failure manually, Microsoft directs the admin to the Entra sign-in logs, User sign-ins (non-interactive) tab, filtered to Status Failure and Application Teams, then to entries for Microsoft Teams, Microsoft Teams Service or Microsoft Teams - Device Admin Agent, then to the sign-in error code and failure reason on Basic info, then to the Conditional Access tab for policies showing Failure.

    Fix Conditional Access-related issues for Teams Android devices · Resolution > Manual checks > steps 1-7 · Checked 2026-09-30
54. 54
    Whether Teams admin center sign-in, sign-out and provisioning actions for Teams phones are still usable on 2026-09-30 is disputed between Microsoft pages: the transition article schedules their retirement by the end of September 2026, while the phone provisioning, remote sign-in and signed-out troubleshooting articles still give Teams admin center steps without a retirement notice.disputed

    Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal · Migration Timeline > Phase 4 · Checked 2026-09-30
55. 55
    The Teams admin center phone provisioning article states that once a Teams phone has been signed in the remote provisioning feature is no longer available for it, and the device must be reset to factory default settings to use it again.

    Remote provisioning and sign in for Teams phones · Note after introduction · Checked 2026-09-30
56. 56
    The Teams admin center remote provisioning sequence for a Teams phone is: under Teams Devices > Phones choose Actions > Provision devices and add the MAC address; generate a verification code from the Waiting on activation tab; a technician selects Provision device in the phone's Settings and enters the code; the phone then appears in the Waiting for sign in tab, where the admin completes Sign in a user.

    Remote provisioning and sign in for Teams phones · Add a device MAC address; Generate a verification code; Provision the device; First time remote sign in · Checked 2026-09-30
57. 57
    Microsoft's signed-out troubleshooting article (dated 2024-08-08) documents re-signing a device from the Teams admin center by selecting the device under Teams devices, choosing Actions > Sign out, then Sign in, after which a pop-up is populated within two to five minutes with a URL, a code and sign-in instructions; it requires Teams administrator permissions.

    Certified Android devices get signed out of Teams · Teams displays > Option 1: Sign in from the Microsoft Teams admin center · Checked 2026-09-30
58. 58
    Microsoft's transition plan schedules the retirement of the remaining Teams admin center device management workflows for September 2026 (Phase 4), with phased deprecation starting in the first week of September 2026 and expected to complete by the end of September 2026, after which the Teams Rooms Pro Management Portal is the primary management portal.

    Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal · Migration Timeline > Phase 4; Frequently Asked Questions > What is the deadline to migrate from TAC to PMP? · Checked 2026-09-30
59. 59
    The Terms of Use Acceptance grant control is listed as Not supported for Teams Rooms on Windows and for Teams Rooms on Android, Teams phone and Teams panels.

    Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms · Supported Conditional Access policies > table row Terms of Use Acceptance · Checked 2026-09-30
60. 60
    The provisioning verification code for a Teams Android device is generated in bulk or per device and is valid for 24 hours.

    Remote provisioning and sign in for Teams Android devices · Step 2: Generate a verification code · Checked 2026-09-30

Documents

Cite this page

WarmTransfer. (2026, September 30). Troubleshooting Teams phone sign-in and provisioning. WarmTransfer. https://warmtransfer.net/knowledge/teams-phone-sign-in-troubleshooting

@misc{warmtransfer-teams-phone-sign-in-troubleshooting,
  title  = {Troubleshooting Teams phone sign-in and provisioning},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/teams-phone-sign-in-troubleshooting},
  note   = {Verified 2026-09-30}
}