# Troubleshooting Teams phone sign-in and provisioning Canonical: https://warmtransfer.net/knowledge/teams-phone-sign-in-troubleshooting Last verified: 2026-09-30 When Conditional Access policies apply to the Teams service, noncompliant Teams Android devices can fail to sign in, get stuck in sign-in loops, sign out of Teams at random, or have Teams stop responding[^9]. Microsoft documents the Conditional Access settings that Teams phones do not support, along with the provisioning and re-sign-in workflows for those phones, and these workflows are moving from the Teams admin center to the Teams Rooms Pro Management Portal[^5][^49][^40][^58]. ## How enrolment and tokens work A certified device is enrolled in Teams device management automatically the first time a user signs in to Teams on it[^7]. If the organisation has signed up for Microsoft Intune, phones are also enrolled in Intune automatically, after which device compliance is confirmed and Conditional Access policies are applied to the device[^7]. If a device is marked noncompliant, the Microsoft Entra token-issuing service stops renewing or revokes its tokens, so the device cannot get an updated authentication token and is forced to sign out[^35]. The licence on the signed-in account determines which user interface a Teams phone shows[^30]. The Teams Shared Devices licence allows only the common area phone interface, the Teams Rooms licence allows only meeting room interfaces, and an E3 or E5 licence supports all sign-in modes[^30]. ## Conditional Access settings that break phone sign-in ### Device code flow In Microsoft's supported-policy table, the Conditional Access Authentication flows condition is Not supported for Teams Rooms on Android, Teams phone and Teams panels, and the table instructs admins not to block device code flow[^5]. Blocking device code flow with Conditional Access prevents using microsoft.com/devicelogin to remotely sign in a Teams Android device[^16]. Microsoft Entra guidance recommends blocking device code flow wherever possible and allowing it only where necessary[^23]. As an example, the same guidance says that where device code flow is used for Android-based conference room devices, it can be blocked everywhere except for Android devices in a specific network location[^24]. We infer that a tenant that follows the Entra recommendation to block device code flow for all users will break code-based remote sign-in on Teams phones, unless the accounts or devices used on those phones are scoped out of that block[^19]. A session established with device code flow is protocol tracked, and the tracked state persists through token refreshes[^43]. Later requests in that session that do not use device code flow can therefore still be blocked by an authentication flows policy[^43]. Microsoft Entra documents these blocks as expected behaviour whose impact can include complete device sign-out, and it recommends no remediation while the policy is enabled[^17]. If the policy was set to disabled or report-only, a fresh token may be needed before the device can be used again[^17]. Microsoft enforces authentication flows policies on the Device Registration Service when the policy targets all resources, and has done so since early September 2024[^18]. Organisations that use device code flow for device registration must exclude Device Registration Service from such a policy to avoid impact[^18]. ### Sign-in frequency Sign-in frequency is listed as Not supported for all Teams device types[^49]. Microsoft states that it causes devices to sign out periodically, and that sign-in frequency configured on individual Microsoft 365 services can interrupt or stop the Teams device sign-in flow[^49]. With a sign-in frequency setting, each forced reauthentication revokes the token and creates a new device object under the user account[^48]. Once the number of device objects exceeds the Microsoft Entra or Intune device limit, the user can no longer sign in to the device[^48]. ### MFA, Terms of Use and authentication strength Teams phone sign-in fails or loops continually when both an MFA Conditional Access policy and a Terms of Use Conditional Access policy are used, and Microsoft states that this combination is not supported[^32]. Microsoft's workaround is to use only the MFA Conditional Access policy or only the MDM Conditional Access policy[^33]. When only the MFA policy is used, Microsoft says to make sure it is enabled in Device Registration Services[^33]. The Terms of Use Acceptance grant control is listed as Not supported for Teams Rooms on Windows and for Teams Rooms on Android, Teams phone and Teams panels[^59]. The Require multifactor authentication grant control is listed as Supported for Teams Rooms on Android, Teams phone and Teams panels[^31]. However, Microsoft advises not to enforce it and to use a different secondary authentication factor so that sign-on is seamless[^31]. Authentication strength, including FIDO2 security keys, is not supported in Conditional Access policies that affect Teams devices[^6]. ### Resources that must stay reachable For Teams devices to function, Conditional Access must not block access to the following resources[^22]: - Office 365[^22] - Office 365 SharePoint Online[^22] - Microsoft Teams Services[^22] - Microsoft Intune Enrollment[^22] - Device Registration Service[^22] ### Shared phones Microsoft states that if shared Teams phones are grouped with user accounts or personal devices under a Conditional Access policy, the sign-in will fail[^47]. The reason Microsoft gives is that a shared device generally has no single user who can complete multifactor authentication or periodic reauthentication[^47]. Microsoft recommends securing shared Teams phone resource accounts with a named location or a require-compliant-device control rather than user-interactive MFA[^46]. Shared Teams phones used for hot-desking should be excluded from compliance policies, because compliance policies prevent the device from enrolling into the hot-desk user's account[^28]. Microsoft says to secure those phones with named locations instead[^28]. User password-expiration policies also apply to accounts used on shared Teams phones[^36]. When such a password expires, the account stops working on the device until an administrator resets the password and signs the device back in[^36]. Microsoft recommends setting these accounts' passwords never to expire[^36]. ### Intune compliance settings Some Intune compliance settings are supported for Teams phones enrolled with AOSP Device Management[^15]: - rooted devices[^15] - minimum and maximum operating system version[^15] - minimum security patch level[^15] - storage encryption[^15] The 3 password-unlock settings are not supported, because Teams devices do not support a password unlock[^15]. ### Legacy authorization When the Teams upgrade configuration setting BlockLegacyAuthorization is enabled, it prevents Teams phones from connecting to Teams services[^8]. Its state can be checked with Get-CsTeamsUpgradeConfiguration[^8]. ## Diagnosing a failure ### Teams admin center health status In the Teams admin center device list, the health status column can show Sign-in errors exist for an Android-based Teams device[^27]. Selecting that status shows the time of the failure, the account that attempted to sign in, the reason for the failure and a history of earlier sign-in failures[^27]. The health status No connection means the connection between the admin center and the device has been lost[^26]. Microsoft's stated fix is to restart or update the device through the admin center[^26]. If a device with problems shows no issues, Microsoft says to make sure its firmware is on the latest version[^26]. ### Entra sign-in logs To check a Conditional Access sign-in failure manually, Microsoft directs the admin through these steps, in this order[^53]: - Open the Entra sign-in logs and select the User sign-ins (non-interactive) tab[^53]. - Filter to Status Failure and Application Teams[^53]. - Open entries for Microsoft Teams, Microsoft Teams Service or Microsoft Teams - Device Admin Agent[^53]. - Read the sign-in error code and failure reason on Basic info[^53]. - Check the Conditional Access tab for policies showing Failure[^53]. Once the failing Conditional Access policy is identified, Microsoft's resolution is to exclude the affected device with a device filter[^20]. Device filters apply only to device objects[^20]. The model and manufacturer attributes are available only for Intune-enrolled devices; for other devices, extension attributes must be used[^20]. As Teams Android devices move to Intune AOSP device management, the device.displayName attribute carries manufacturer information early in the sign-in process, before Intune completes enrollment[^21]. For that reason, Microsoft suggests using it in Conditional Access device filter rules[^21]. The automatic sign-out issue on certified Teams Android devices shows up in the Entra non-interactive user sign-in logs as entries with Application Microsoft Authentication Broker, Status Failure and Resource Device Registration Service[^52]. Microsoft's known-issues list attributes automatic sign-out of Teams Rooms on Android, Teams Phones, Teams panels and Teams displays to a policy block on the device registration service[^50]. Error AADSTS530036 indicates that a refresh token is invalid because of authentication flow checks by Conditional Access[^2]. Microsoft lists this error as the way to recognise a protocol-tracking block when the authentication flows policy applies to all applications[^2]. ### Connectivity and portal checks For affected Teams phones, Microsoft directs admins to the Teams Android Desk Phone Sign in connectivity test in the Microsoft Remote Connectivity Analyzer[^37]. The test verifies that the user account meets the requirements to sign in to a Teams Android desk phone[^37]. Both administrators and non-administrators can run it[^37]. The Microsoft Remote Connectivity Analyzer is not available for the GCC and GCC High Microsoft 365 Government environments[^44]. A Teams Android device may not be visible in the Pro Management Portal, may be unmanageable there, or may show Device is not connected to IoT Hub[^29]. In those cases, Microsoft's checks are to allow the required network URLs, update the device to the minimum Admin Agent version, and make sure no unsupported Conditional Access policies are assigned to the Teams resource accounts[^29]. ## Recovering a signed-out phone Microsoft documents an on-device recovery sequence, in this order[^45]: - Select Refresh code and use the new code[^45]. - If no code is generated, select Sign in on this device and enter the password for the pre-populated username[^45]. - If sign-in still fails, select Start over, which signs the device out, and then select Refresh code again[^45]. An admin can also sign a phone back in remotely if the device is already connected to the Pro Management Portal and has been signed out[^41]. To do this, the admin selects the device, opens the Account tab and selects Generate code[^41]. After a few minutes, the Account tab shows the user principal name of the signed-in account[^41]. Microsoft's signed-out troubleshooting article, dated 2024-08-08, documents a way to re-sign a device from the Teams admin center[^57]. The admin selects the device under Teams devices, chooses Actions > Sign out, and then chooses Sign in[^57]. Within 2 to 5 minutes, a pop-up is populated with a URL, a code and sign-in instructions[^57]. This method requires Teams administrator permissions[^57]. Microsoft's transition plan schedules the remaining Teams admin center device management workflows for retirement in September 2026[^58]. As a last resort, Microsoft documents a factory reset, in this order[^25]: - Reset the device through the OEM device settings or the OEM key combination[^25]. - Delete the device object in Microsoft Entra ID, Microsoft Intune and the Teams admin center so that fresh objects are created[^25]. - Sign in again[^25]. ## Remote provisioning All Teams Rooms on Android, Teams panel, Teams phone and SIP gateway devices can be provisioned remotely from the Teams Pro Management Portal[^39]. The Pro Management Portal sequence runs in this order[^40]: - Add the device MAC address or hardware ID under Planning > Android Devices[^40]. - Generate a verification code for a device listed as Ready for provisioning[^40]. - Enter that code on the device under Provision device in Settings[^40]. - Complete the first remote sign-in from the device's Waiting for sign in entry, using the code at microsoft.com/devicelogin[^40]. The provisioning verification code for a Teams Android device can be generated in bulk or per device, and it is valid for 24 hours[^60]. Access to the Pro Management Portal requires that the organisation meets at least 1 of these conditions: it has at least 1 Teams Rooms Pro, Basic or Standard licence, at least 1 Teams Shared Space licence, or at least 1 Teams device already enrolled in the portal[^38]. The Teams admin center sequence for a Teams phone runs in this order[^56]: - Under Teams Devices > Phones, choose Actions > Provision devices and add the MAC address[^56]. - Generate a verification code from the Waiting on activation tab[^56]. - A technician selects Provision device in the phone's Settings and enters the code[^56]. - When the phone appears in the Waiting for sign in tab, the admin completes Sign in a user[^56]. The Teams admin center phone provisioning article states that once a Teams phone has been signed in, the remote provisioning feature is no longer available for it[^55]. To use remote provisioning again, the device must be reset to factory default settings[^55]. ## Admin Agent and the Pro Management Portal transition Microsoft's transition plan schedules the remaining Teams admin center device management workflows for retirement in September 2026[^58]. Phased deprecation starts in the first week of September 2026 and is expected to complete by the end of that month[^58]. After that, the Teams Rooms Pro Management Portal is the primary management portal[^58]. Teams Android devices need Admin Agent version 830 (1.0.0.202606082157) or later to be managed in the Pro Management Portal[^3]. Existing Teams phones enrolled in the Teams admin center enrol in the portal automatically after updating to that version[^3]. A Teams phone whose Admin Agent is below version 830 receives no app or firmware updates until the Admin Agent is updated to 830 or later[^34]. The Admin Agent update itself is pushed through the Teams admin center and cannot be paused[^34]. A device with Admin Agent 794 or later is updated automatically to the latest eligible Admin Agent by Microsoft's Zero-Day Update mechanism once it is powered on and connected[^1]. A device on an earlier Admin Agent must first be manually updated with OEM firmware that includes Admin Agent 794 or later[^1]. A device that remains signed out for an extended period cannot be onboarded to the Pro Management Portal automatically[^51]. An administrator must sign in to it at least once after it has been updated to the latest eligible Admin Agent version[^51]. ## Common area phones A common area phone is signed in with a resource account that holds a Teams Shared Devices licence[^11]. That licence includes Phone System features, so no separate Phone System licence is needed[^11]. A Calling Plan may be added when Direct Routing or Operator Connect is not used[^11]. When creating the account, Microsoft highly recommends setting the password manually[^12]. This means clearing both Automatically create a password and the requirement to change the password at first sign-in, which Microsoft says prevents sign-in issues[^12]. The common area phone experience is enabled by setting the Teams IP Phone policy SignInMode parameter to CommonAreaPhoneSignIn[^13]. The IP Phone policy can be modified only if the account signing in to the phone is licensed with something other than a Teams Shared Devices licence[^13]. After a policy is assigned to a common area phone account, the phone must be signed out and signed back in[^42]. The assignment may take up to an hour to take effect[^42]. Microsoft lists 3 ways to sign in a common area phone[^14]: - local sign-in with Sign in on this device[^14] - sign-in from another device by entering the code shown on the phone at https://www.microsoft.com/devicelogin[^14] - sign-in by an admin using the Teams admin center[^14] If a custom app setup policy unpins the calling app, the dial pad does not appear on a common area phone after sign-in[^10]. Microsoft lists a known issue affecting a phone that is signed in with a Teams Shared Devices licence in Common Area Phone sign-in mode and enabled for Advanced Calling[^4]. After updating to version 1449/1.0.94.2026220406, such a phone shows Basic Calling[^4]. The workarounds are to change the sign-in mode to UserSignIn, or to re-enable Advanced Calling in the Teams admin center or on the device[^4]. ## See also - [Troubleshooting phones signing in through Teams SIP Gateway](https://warmtransfer.net/knowledge/teams-sip-gateway-troubleshooting) - [Teams phones and certified devices](https://warmtransfer.net/knowledge/teams-phone-devices) - [Teams Rooms and common area phones calling](https://warmtransfer.net/knowledge/teams-rooms-common-area-phones) - [Teams voice administration with PowerShell](https://warmtransfer.net/knowledge/teams-powershell-voice-admin) - [Microsoft Teams Calling Plans](https://warmtransfer.net/knowledge/teams-calling-plans) - [Teams Phone Direct Routing and SBC certification](https://warmtransfer.net/knowledge/teams-direct-routing) - [Teams Operator Connect and Azure Communication routing](https://warmtransfer.net/knowledge/teams-operator-connect) ## Applicability Applies to: Microsoft Teams phones, Microsoft Teams Rooms Pro Management Portal, Microsoft Teams admin center, Microsoft Entra ID, Microsoft Teams Android devices, and Microsoft Teams Phone. Deployments: multi-tenant. Sources checked 2026-09-30. The Intune compliance settings described above apply to Teams phones enrolled with AOSP Device Management[^15]. Enforcement of authentication flows policies on the Device Registration Service has applied since early September 2024[^18]. Pro Management Portal management requires Admin Agent version 830 (1.0.0.202606082157) or later[^3]. The Basic Calling known issue applies to version 1449/1.0.94.2026220406[^4]. The Microsoft Remote Connectivity Analyzer is not available for GCC and GCC High[^44]. The deployment model is not covered by the sources below. ## What remains uncertain Microsoft's transition plan schedules the Teams admin center device management workflows for retirement in September 2026[^58]. Whether Teams admin center sign-in, sign-out and provisioning actions for phones still work after that retirement is not covered by the sources below. The general Admin Agent minimum for Pro Management Portal management is version 830[^3]. Minimum firmware, Teams app, Company Portal and Admin Agent versions for each certified phone model are not covered by the sources below. Microsoft suggests the device.displayName attribute for device filters on Intune AOSP-managed devices[^21]. Beyond that suggestion, the effect of migrating Teams phones to Intune AOSP device management on enrolment and compliance at sign-in is not covered by the sources below. Microsoft tells admins to allow the required network URLs[^29]. The specific network URLs and ports a Teams Android phone needs to reach to sign in and to connect to the Pro Management Portal are not covered by the sources below. Whether the Teams Shared Devices and Teams Shared Space licence names refer to different products, and what each one entitles, is not covered by the sources below. OEM-specific factory reset key combinations and local provisioning menus for individual phone manufacturers are not covered by the sources below. Repeated re-registration can exceed the Microsoft Entra or Intune device limit and block sign-in[^48]. The numeric per-user values of those limits are not covered by the sources below. SIP gateway devices can be provisioned remotely from the Pro Management Portal[^39]. Sign-in and provisioning troubleshooting specific to SIP gateway devices is not covered by the sources below. ## Sources [^1]: A device with Admin Agent 794 or later is updated automatically to the latest eligible Admin Agent by Microsoft's Zero-Day Update mechanism once powered on and connected; a device on an earlier Admin Agent must first be manually updated with OEM firmware that includes Admin Agent 794 or later. Source: [Transitioning updates management for Teams Android devices from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/androidupdatemanagementinpmp), Guidance for devices with older Admin Agent versions. Checked 2026-09-30. [^2]: Error AADSTS530036 indicates that a refresh token is invalid because of authentication flow checks by Conditional Access; Microsoft lists it as the way to recognise a protocol-tracking block when the authentication flows policy applies to all applications. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Troubleshooting unexpected blocks. Checked 2026-09-30. [^3]: Teams Android devices need Admin Agent version 830 (1.0.0.202606082157) or later to be managed in the Pro Management Portal, and existing Teams phones enrolled in the Teams admin center enrol in the portal automatically after updating to that version. Source: [Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/aboutunifieddevicemanagement-pmp1), Minimum app version requirements; Migration checklist and prerequisites > Step 1 > item 7.3.1. Checked 2026-09-30. [^4]: Microsoft lists as a known issue that a phone signed in with a Teams Shared Devices licence in Common Area Phone sign-in mode and enabled for Advanced Calling shows Basic Calling after updating to version 1449/1.0.94.2026220406; workarounds are to change the sign-in mode to UserSignIn or to re-enable Advanced Calling in the Teams admin center or on the device. Source: [Known issues with Teams on Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-rooms-known-issues-android), Issues affecting Teams phone devices > row Basic Calling displays instead of Advanced Calling. Checked 2026-09-30. [^5]: In Microsoft's supported-policy table the Conditional Access Authentication flows condition is Not supported for Teams Rooms on Android, Teams phone and Teams panels, with the instruction not to block device code flow. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > table row Authentication flows. Checked 2026-09-30. [^6]: Authentication strength, including FIDO2 security keys, is not supported in Conditional Access policies that affect Teams devices. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > Note after table; table row Require authentication strength. Checked 2026-09-30. [^7]: A certified device is enrolled in Teams device management automatically the first time a user signs in to Teams on it, and phones are automatically enrolled in Microsoft Intune if the organisation has signed up for it, after which device compliance is confirmed and Conditional Access policies are applied to the device. Source: [Manage devices in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/devices/device-management), What devices can you manage?; Manage phones, Teams Rooms on Android, Teams displays, and Teams panels. Checked 2026-09-30. [^8]: The Teams upgrade configuration setting BlockLegacyAuthorization, when enabled, prevents Teams phones from connecting to Teams services; its state can be checked with Get-CsTeamsUpgradeConfiguration. Source: [Authentication best practices for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/authentication-best-practices-phones), Teams Legacy Authorization. Checked 2026-09-30. [^9]: When Conditional Access policies apply to the Teams service, noncompliant Teams Android devices can fail to sign in or get stuck in sign-in loops, sign out of Teams at random, or have Teams stop responding. Source: [Fix Conditional Access-related issues for Teams Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-android-devices-conditional-access-issues), Symptoms. Checked 2026-09-30. [^10]: If a custom app setup policy unpins the calling app, the dial pad does not appear on a common area phone after sign-in. Source: [Set up the common area phones for Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/phones/set-up-common-area-phones), Step 5 > Local sign-in > Note. Checked 2026-09-30. [^11]: A common area phone is signed in with a resource account that holds a Teams Shared Devices licence; that licence includes Phone System features, so no separate Phone System licence is needed, though a Calling Plan may be added when Direct Routing or Operator Connect is not used. Source: [Set up the common area phones for Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/phones/set-up-common-area-phones), Step 1 - Buy the licenses; Step 2 > Using the Microsoft 365 admin center > step 6 and Note. Checked 2026-09-30. [^12]: When creating a common area phone account Microsoft highly recommends setting the password manually, clearing both Automatically create a password and the requirement to change the password at first sign-in, to prevent sign-in issues. Source: [Set up the common area phones for Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/phones/set-up-common-area-phones), Step 2 > Using the Microsoft 365 admin center > step 5 and Important note. Checked 2026-09-30. [^13]: The common area phone experience is enabled by setting the Teams IP Phone policy SignInMode parameter to CommonAreaPhoneSignIn, and the IP Phone policy can be modified only if the account signing in to the phone is licensed with something other than a Teams Shared Devices licence. Source: [Set up the common area phones for Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/phones/set-up-common-area-phones), Step 3 - Set policies for common area phones > IP phone policies. Checked 2026-09-30. [^14]: Microsoft lists three ways to sign in a common area phone: local sign-in with Sign in on this device, sign-in from another device by entering the code shown on the phone at https://www.microsoft.com/devicelogin, and sign-in by an admin using the Teams admin center. Source: [Set up the common area phones for Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/phones/set-up-common-area-phones), Step 5 - Sign in to the Teams Phone. Checked 2026-09-30. [^15]: For Teams phones enrolled with AOSP Device Management the supported Intune compliance settings are rooted devices, minimum and maximum operating system version, minimum security patch level and storage encryption; the three password-unlock settings are not supported because Teams devices do not support a password unlock. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported device compliance policies > Teams phones tab. Checked 2026-09-30. [^16]: Blocking device code flow with Conditional Access prevents using microsoft.com/devicelogin to remotely sign in a Teams Android device. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > Important note. Checked 2026-09-30. [^17]: Microsoft Entra documents blocks on protocol-tracked sessions as expected behaviour whose impact can include complete device sign-out, with no recommended remediation while the policy is enabled; if the policy was set to disabled or report-only a fresh token may be needed to use the device again. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Troubleshooting unexpected blocks > Note. Checked 2026-09-30. [^18]: Since early September 2024 Microsoft enforces authentication flows policies on the Device Registration Service when the policy targets all resources, and organisations that use device code flow for device registration must exclude Device Registration Service from such a policy to avoid impact. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Enforcement of Authentication Flows policies on Device Registration Service resource. Checked 2026-09-30. [^19]: A tenant that follows the Entra recommendation to block device code flow for all users will break code-based remote sign-in on Teams phones unless the accounts or devices used on those phones are scoped out of that block (inferred). Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > Important note. Checked 2026-09-30. [^20]: Once the failing Conditional Access policy is identified, Microsoft's resolution is to exclude the affected device with a device filter; device filters apply only to device objects, and the model and manufacturer attributes are available only for Intune-enrolled devices, otherwise extension attributes must be used. Source: [Fix Conditional Access-related issues for Teams Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-android-devices-conditional-access-issues), Resolution > Manual checks > paragraph and Note after step 7. Checked 2026-09-30. [^21]: As Teams Android devices move to Intune AOSP device management, the device.displayName attribute carries manufacturer information early in the sign-in process, before Intune completes enrollment, so Microsoft suggests it for Conditional Access device filter rules. Source: [Fix Conditional Access-related issues for Teams Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-android-devices-conditional-access-issues), Resolution > paragraphs 2-3. Checked 2026-09-30. [^22]: For Teams devices to function, Conditional Access must not block access to Office 365, Office 365 SharePoint Online, Microsoft Teams Services, Microsoft Intune Enrollment and Device Registration Service. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > table row Target Resources. Checked 2026-09-30. [^23]: Microsoft Entra guidance recommends blocking device code flow wherever possible and allowing it only where necessary. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Device code flow. Checked 2026-09-30. [^24]: Microsoft Entra guidance gives as an example that where device code flow is used for Android-based conference room devices, it can be blocked everywhere except for Android devices in a specific network location. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Device code flow. Checked 2026-09-30. [^25]: As a last resort Microsoft documents a factory reset through the OEM device settings or OEM key combination, followed by deleting the device object in Microsoft Entra ID, Microsoft Intune and the Teams admin center so that fresh objects are created, and then signing in again. Source: [Certified Android devices get signed out of Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/signed-out-of-teams-android-devices), Teams displays > Option 4: Reset the device. Checked 2026-09-30. [^26]: The Teams admin center health status No connection means the connection between the admin center and the device has been lost, and Microsoft's stated fix is to restart or update the device through the admin center; if a troubled device shows no issues, Microsoft says to make sure its firmware is on the latest version. Source: [Manage devices in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/devices/device-management), View issues with Android-based Teams devices > item 2 and Note. Checked 2026-09-30. [^27]: In the Teams admin center device list the health status column can show Sign-in errors exist for an Android-based Teams device; selecting it shows the time of the failure, the account that attempted to sign in, the reason for the failure and a history of earlier sign-in failures. Source: [Manage devices in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/devices/device-management), View issues with Android-based Teams devices. Checked 2026-09-30. [^28]: Shared Teams phones used for hot-desking should be excluded from compliance policies because compliance policies prevent the device from enrolling into the hot-desk user's account; Microsoft says to secure them with named locations instead. Source: [Authentication best practices for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/authentication-best-practices-phones), When and when not to require compliant shared devices > Note. Checked 2026-09-30. [^29]: If Teams Android devices are not visible, are unmanageable or show Device is not connected to IoT Hub in the Pro Management Portal, Microsoft's checks are to allow the required network URLs, update the device to the minimum Admin Agent version, and make sure no unsupported Conditional Access policies are assigned to the Teams resource accounts. Source: [Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/aboutunifieddevicemanagement-pmp1), Migration checklist and prerequisites > Step 2. Checked 2026-09-30. [^30]: The user interface a Teams phone shows is chosen from the licence on the signed-in account: the Teams Shared Devices licence allows only the common area phone interface, the Teams Rooms licence allows only meeting room interfaces, and an E3 or E5 licence supports all sign-in modes. Source: [Set Microsoft Teams Android devices user interface](https://learn.microsoft.com/en-us/microsoftteams/phones/teams-android-devices-user-interface), Override automatic user interface detection > Note. Checked 2026-09-30. [^31]: The Require multifactor authentication grant control is listed as Supported for Teams Rooms on Android, Teams phone and Teams panels, with the advice not to enforce it and to use a different secondary authentication factor so that sign-on is seamless. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > table row Require multifactor authentication. Checked 2026-09-30. [^32]: Teams phone sign-in fails or loops continually when both an MFA Conditional Access policy and a Terms of Use Conditional Access policy are used; Microsoft states the combination is not supported. Source: [Known issues with Teams on Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-rooms-known-issues-android), Issues affecting Teams phone devices > row Sign in loops or fails for Teams Phones. Checked 2026-09-30. [^33]: Microsoft's workaround for the MFA plus Terms of Use sign-in loop is to use only the MFA Conditional Access policy or only the MDM Conditional Access policy, and when only the MFA policy is used to make sure it is enabled in Device Registration Services. Source: [Known issues with Teams on Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-rooms-known-issues-android), Issues affecting Teams phone devices > row Sign in loops or fails for Teams Phones > Workaround. Checked 2026-09-30. [^34]: A Teams phone whose Admin Agent is below version 830 receives no app or firmware updates until the Admin Agent is updated to 830 or later; the Admin Agent update itself is pushed through the Teams admin center and cannot be paused. Source: [Transitioning updates management for Teams Android devices from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/androidupdatemanagementinpmp), Device type specific updates guidance > Teams phones. Checked 2026-09-30. [^35]: If a device is marked noncompliant, the Microsoft Entra token-issuing service stops renewing or revokes its tokens, so the device cannot get an updated authentication token and is forced to sign out. Source: [Fix Conditional Access-related issues for Teams Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-android-devices-conditional-access-issues), Cause > Unsupported Conditional Access policy or Intune device compliance policy settings. Checked 2026-09-30. [^36]: User password-expiration policies also apply to accounts used on shared Teams phones, and when such a password expires the account stops working on the device until an administrator resets the password and signs the device back in; Microsoft recommends setting these accounts' passwords never to expire. Source: [Authentication best practices for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/authentication-best-practices-phones), Best practices for the deployment of shared Teams phones > Use a resource account and curtail its password expiration. Checked 2026-09-30. [^37]: For affected Teams phones Microsoft directs admins to the Teams Android Desk Phone Sign in connectivity test in the Microsoft Remote Connectivity Analyzer, which verifies that the user account meets the requirements to sign in to a Teams Android desk phone and can be run by administrators and non-administrators. Source: [Certified Android devices get signed out of Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/signed-out-of-teams-android-devices), Teams phones. Checked 2026-09-30. [^38]: Access to the Pro Management Portal requires that the organisation has at least one Teams Rooms Pro, Basic or Standard licence, or at least one Teams Shared Space licence, or at least one Teams device already enrolled in the portal. Source: [Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/aboutunifieddevicemanagement-pmp1), Migration checklist and prerequisites > Step 1 > Licensing requirements for PMP access. Checked 2026-09-30. [^39]: All Teams Rooms on Android, Teams panel, Teams phone and SIP gateway devices can be provisioned remotely from the Teams Pro Management Portal. Source: [Remote provisioning and sign in for Teams Android devices](https://learn.microsoft.com/en-us/microsoftteams/devices/remote-provision-remote-login), Supported devices. Checked 2026-09-30. [^40]: The Pro Management Portal remote provisioning sequence is: add the device MAC address or hardware ID under Planning > Android Devices; generate a verification code for a device listed as Ready for provisioning; enter that code on the device under Provision device in Settings; then complete the first remote sign-in from the device's Waiting for sign in entry using the code at microsoft.com/devicelogin. Source: [Remote provisioning and sign in for Teams Android devices](https://learn.microsoft.com/en-us/microsoftteams/devices/remote-provision-remote-login), Step 1 through Step 4. Checked 2026-09-30. [^41]: For a device already connected to the Pro Management Portal that has been signed out, an admin can select the device, open the Account tab and select Generate code to sign it back in; after a few minutes the Account tab shows the user principal name of the signed-in account. Source: [Remote provisioning and sign in for Teams Android devices](https://learn.microsoft.com/en-us/microsoftteams/devices/remote-provision-remote-login), Sign in a device which was previously signed in. Checked 2026-09-30. [^42]: After a policy is assigned to a common area phone account the phone must be signed out and signed back in, and the assignment may take up to an hour to take effect. Source: [Set up the common area phones for Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/phones/set-up-common-area-phones), Step 3 - Set policies for common area phones > Calling policies > Note. Checked 2026-09-30. [^43]: A session established with device code flow is protocol tracked, the tracked state persists through token refreshes, and later requests in that session that do not use device code flow can still be blocked by an authentication flows policy. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Protocol tracking. Checked 2026-09-30. [^44]: The Microsoft Remote Connectivity Analyzer is not available for the GCC and GCC High Microsoft 365 Government environments. Source: [Certified Android devices get signed out of Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/signed-out-of-teams-android-devices), Teams phones > Note. Checked 2026-09-30. [^45]: The on-device recovery sequence Microsoft documents is: select Refresh code and use the new code; if no code is generated select Sign in on this device and enter the password for the pre-populated username; if sign-in still fails select Start over, which signs the device out, then select Refresh code again. Source: [Certified Android devices get signed out of Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/signed-out-of-teams-android-devices), Teams displays > Option 3: Generate a new code on the device to sign in. Checked 2026-09-30. [^46]: Microsoft recommends securing shared Teams phone resource accounts with a named location or a require-compliant-device control rather than user-interactive MFA. Source: [Authentication best practices for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/authentication-best-practices-phones), Best practices for the deployment of shared Teams phones > Review these Conditional Access policies > Tip. Checked 2026-09-30. [^47]: Microsoft states that if shared Teams phones are grouped with user accounts or personal devices under a Conditional Access policy the sign-in will fail, because a shared device generally has no single user who can complete multifactor authentication or periodic reauthentication. Source: [Authentication best practices for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/authentication-best-practices-phones), Authentication recommendations are different for personal versus shared android devices > item 2. Checked 2026-09-30. [^48]: With a Conditional Access sign-in frequency setting, each forced reauthentication revokes the token and creates a new device object under the user account, and once the number of device objects exceeds the Microsoft Entra or Intune device limit the user can no longer sign in to the device. Source: [Fix Conditional Access-related issues for Teams Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-android-devices-conditional-access-issues), Cause > The Sign-in frequency setting. Checked 2026-09-30. [^49]: Sign-in frequency is listed as Not supported for all Teams device types; Microsoft states it causes devices to sign out periodically and that sign-in frequency configured on individual Microsoft 365 services can interrupt or stop the Teams device sign-in flow. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > Important note; table row Sign-in frequency. Checked 2026-09-30. [^50]: Microsoft's known-issues list attributes automatic sign-out of Teams Rooms on Android, Teams Phones, Teams panels and Teams displays to a policy block on the device registration service. Source: [Known issues with Teams on Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-rooms-known-issues-android), Issues affecting multiple device types > row Signed out of Teams on Android devices. Checked 2026-09-30. [^51]: A device that remains signed out for an extended period cannot be onboarded to the Pro Management Portal automatically; an administrator must sign in to it at least once after it has been updated to the latest eligible Admin Agent version. Source: [Transitioning updates management for Teams Android devices from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/androidupdatemanagementinpmp), Guidance for devices that remain signed out for an extended period. Checked 2026-09-30. [^52]: The automatic sign-out issue on certified Teams Android devices is identified in the Entra non-interactive user sign-in logs by entries with Application Microsoft Authentication Broker, Status Failure and Resource Device Registration Service. Source: [Certified Android devices get signed out of Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/signed-out-of-teams-android-devices), Introduction (before first heading). Checked 2026-09-30. [^53]: To check a Conditional Access sign-in failure manually, Microsoft directs the admin to the Entra sign-in logs, User sign-ins (non-interactive) tab, filtered to Status Failure and Application Teams, then to entries for Microsoft Teams, Microsoft Teams Service or Microsoft Teams - Device Admin Agent, then to the sign-in error code and failure reason on Basic info, then to the Conditional Access tab for policies showing Failure. Source: [Fix Conditional Access-related issues for Teams Android devices](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/teams-android-devices-conditional-access-issues), Resolution > Manual checks > steps 1-7. Checked 2026-09-30. [^54]: Whether Teams admin center sign-in, sign-out and provisioning actions for Teams phones are still usable on 2026-09-30 is disputed between Microsoft pages: the transition article schedules their retirement by the end of September 2026, while the phone provisioning, remote sign-in and signed-out troubleshooting articles still give Teams admin center steps without a retirement notice (disputed). Source: [Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/aboutunifieddevicemanagement-pmp1), Migration Timeline > Phase 4. Checked 2026-09-30. [^55]: The Teams admin center phone provisioning article states that once a Teams phone has been signed in the remote provisioning feature is no longer available for it, and the device must be reset to factory default settings to use it again. Source: [Remote provisioning and sign in for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/remote-provision-remote-login-phones), Note after introduction. Checked 2026-09-30. [^56]: The Teams admin center remote provisioning sequence for a Teams phone is: under Teams Devices > Phones choose Actions > Provision devices and add the MAC address; generate a verification code from the Waiting on activation tab; a technician selects Provision device in the phone's Settings and enters the code; the phone then appears in the Waiting for sign in tab, where the admin completes Sign in a user. Source: [Remote provisioning and sign in for Teams phones](https://learn.microsoft.com/en-us/microsoftteams/phones/remote-provision-remote-login-phones), Add a device MAC address; Generate a verification code; Provision the device; First time remote sign in. Checked 2026-09-30. [^57]: Microsoft's signed-out troubleshooting article (dated 2024-08-08) documents re-signing a device from the Teams admin center by selecting the device under Teams devices, choosing Actions > Sign out, then Sign in, after which a pop-up is populated within two to five minutes with a URL, a code and sign-in instructions; it requires Teams administrator permissions. Source: [Certified Android devices get signed out of Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/teams-rooms-and-devices/signed-out-of-teams-android-devices), Teams displays > Option 1: Sign in from the Microsoft Teams admin center. Checked 2026-09-30. [^58]: Microsoft's transition plan schedules the retirement of the remaining Teams admin center device management workflows for September 2026 (Phase 4), with phased deprecation starting in the first week of September 2026 and expected to complete by the end of September 2026, after which the Teams Rooms Pro Management Portal is the primary management portal. Source: [Transitioning Teams Android Device Management from Teams Admin Center to the Teams Rooms Pro Management Portal](https://learn.microsoft.com/en-us/microsoftteams/rooms/aboutunifieddevicemanagement-pmp1), Migration Timeline > Phase 4; Frequently Asked Questions > What is the deadline to migrate from TAC to PMP?. Checked 2026-09-30. [^59]: The Terms of Use Acceptance grant control is listed as Not supported for Teams Rooms on Windows and for Teams Rooms on Android, Teams phone and Teams panels. Source: [Supported Conditional Access and Intune device compliance policies for Microsoft Teams Rooms](https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies), Supported Conditional Access policies > table row Terms of Use Acceptance. Checked 2026-09-30. [^60]: The provisioning verification code for a Teams Android device is generated in bulk or per device and is valid for 24 hours. Source: [Remote provisioning and sign in for Teams Android devices](https://learn.microsoft.com/en-us/microsoftteams/devices/remote-provision-remote-login), Step 2: Generate a verification code. Checked 2026-09-30.