Manage resource accounts in Microsoft Teams

In Microsoft Teams, a resource account is required for each auto attendant or call queue. Resource accounts may also be assigned telephone numbers. This is how you assign phone numbers to auto attendants and call queues allowing callers from outside Teams to reach the auto attendant or call queue.

This article covers how to create resource accounts and ready them for use with auto attendants and call queues.

Before you start the procedures in this article, ensure you've done the following steps:

Note

Resource accounts used for auto attendants and call queues are disabled for sign in and must remain so. Chat and presence are not available for these accounts.

Obtain Microsoft Teams Phone Resource Account licenses

Each resource account requires a license in order to work with auto attendants and call queues, known as a Microsoft Teams Phone Resource Account license. Subscriptions with Teams Phone automatically get a free allocation of Microsoft Teams Phone Resource Account licenses, and if more are needed, extra Microsoft Teams Phone Resource Account licenses can be purchased. For details on how to obtain these licenses, see Microsoft Teams Phone Resource Account licenses.

We cover how to assign the license to a resource account later in this article.

If you purchased Teams Phone Standard or Teams Phone with Calling Plan bundle licenses, Teams Phone Resource Account licenses are already in your account.

To see if you already have Teams Phone Resource Account licenses, sign into the Microsoft 365 admin center using an account with Global admin permissions. Then, go to Billing > Your products. If you have Teams Phone Resource Account licenses, they'll appear as Microsoft Teams Phone Resource Account.

  1. Open the Microsoft 365 admin center and sign in with a user that is a Global admin. This is usually the account you used to sign up for Microsoft 365.
  2. In the left navigation pane, go to Billing > Purchase services > Add-ons > See all Add-ons products.
  3. Scroll to the end to find the Microsoft Teams Phone Resource Account license. Select Details, then Buy.
  4. On the license purchase page, select the number of licenses you want. You need one license for each auto attendant and call queue you plan to set up. We recommend selecting at least five licenses so you can easily set up more auto attendants and call queues in the future without having to purchase more licenses right away.
  5. Uncheck Automatically assign to all of your users with no licenses.
  6. Select Check out now.
  7. Confirm your order, select Next, and then Place order.

There's zero cost, but you still need to follow these steps to acquire the license.

Obtain phone numbers

Phone numbers are optional for auto attendants and call queues. For any auto attendant or call queue that you want to be reachable directly by a phone number, you must have a resource account with an associated phone number.

Resource accounts can use either toll or toll-free phone numbers. You can request new numbers or port existing numbers from another carrier.

Acceptable phone numbers that can be applied to resource accounts include:

To port a number from another carrier, see Transfer phone numbers to Teams.

Create a resource account

You can create a resource account in the Teams admin center.

  1. Sign into the Teams admin center.
  2. Expand Voice, and then select Resource accounts.
  3. Select Add.
  4. In the Add resource account pane, fill out Display name, Username, and the Resource account type. The resource account type can be either Auto attendant or Call queue, depending how you intend to use this resource account.
  5. Select Save.

Assign a license

For each resource account, you must assign a Microsoft Teams Phone Resource Account license.

  1. Sign into the Microsoft 365 admin center.
  2. Expand Users, then select Active users.
  3. Select the resource account to which you want to assign a license. The resource account's user pane will appear.
  4. On the Licenses and Apps tab, under Licenses, select Microsoft Teams Phone Resource Account.
  5. Select Save changes.

Assign a phone number

If you're planning to use the resource account with an auto attendant or call queue that requires a phone number, assign a number to the resource account.

  1. Sign into the Teams admin center.
  2. Expand Voice, and then select Resource accounts page.
  3. Select the resource account to which you want to assign a phone number, and then select Assign/unassign.
  4. In the Phone number type dropdown, choose the type of number that you want to use.
  5. In the Assigned phone number box, search for the number you want to use and select Add. Be sure to include the country code (for example, +1 250 555 0012).
  6. Select Save.

To assign a Direct Routing or hybrid number to a resource account, you need to use PowerShell:

Set-CsPhoneNumberAssignment -Identity aa-contoso_main@contoso64.net -PhoneNumber +19295550150 -PhoneNumberType DirectRouting

Next steps

Once you've completed the resource account setup and assigning a phone number if needed, you're ready to use the resource account with an auto attendant or call queue.

See the following references to learn more:

You can edit the resource account Display name and Resource account type using the Edit option. Select Save when you're done.

Change an existing resource account to use a Microsoft Teams Phone Resource Account license

To switch the licenses on your existing resource account from a Teams Phone Standard license to a Microsoft Teams Phone Resource Account license, you'll need to acquire the Microsoft Teams Phone Resource Account license, and then follow the steps in the Microsoft 365 admin center to Move users to a different subscription.

Warning

Always remove a Teams Phone Standard license and assign the Microsoft Teams Phone Resource Account license in the same license activity. If you remove the old license, save the account changes, add the new license, and then save the account settings again, the resource account may no longer function as expected. If this happens, we recommend you create a new resource account for the Microsoft Teams Phone Resource Account license and remove the broken resource account.

Skype For Business Server 2019

For resource accounts homed on Skype For Business Server 2019 that can be used with cloud call queues and cloud auto attendants, see Plan Cloud call queues or Plan Cloud auto attendants. Hybrid implementations (numbers homed on Direct Routing) are configured using the New-CsHybridApplicationEndpoint cmdlet on an on-premises Skype for Business Server 2019 server.

The application IDs that you need to use while creating the application instances are:

  • Auto Attendant: ce933385-9390-45d1-9512-c8d228074e07
  • Call Queue: 11cd3e2e-fccb-42ad-ad00-878b93575e07

Note

If you want the call queue or auto attendant to be searchable by Skype For Business Server 2019 users, you should create your resource accounts on Skype For Business Server 2019, since online resource accounts are not synced down to Active Directory. When DNS SRV records for sipfederationtls resolve to Skype for Business Server 2019, then resource accounts must be created on Skype For Business Server 2019 using SfB Management shell and synchronized to Azure AD.

For hybrid implementations with Skype for Business Server:

Delete a resource account

Make sure you dissociate the telephone number from the resource account before deleting it, to avoid getting your phone number stuck in pending mode.

After you do that, you can delete the resource account in the Microsoft 365 admin center, under the Users tab.

To disassociate a Direct Routing telephone number from the resource account, use the following cmdlet:

Remove-CsPhoneNumberAssignment -Identity <Resource Account Object ID> -PhoneNumber <assigned phone number> -PhoneNumberType DirectRouting

Hide resource accounts from Teams users

You may want to hide certain resources accounts from Teams users. For example, you may want to prevent Teams users from directly calling a call queue and bypassing the auto attendant where the hours of operation are configured.

Information barriers are used to hide the resource accounts. Review the information barriers documentation to understand the possible impacts before proceeding with the steps below.

Required subscriptions and permissions

To access and use information barriers, your organization must have one of the following subscriptions or add ons:

  • Microsoft 365 E5/A5 subscription (paid or trial version).
  • Office 365 E5/A5/A3/A1 subscription (paid or trial version).
  • Office 365 Advanced Compliance add-on.
  • Microsoft 365 E3/A3/A1 subscription + the Microsoft 365 E5/A5 Compliance add-on.
  • Microsoft 365 E3/A3/A1 subscription + the Microsoft 365 E5/A5 Insider Risk Management add-on.

Note

If you already have Exchange Online address book policies configured, they must be removed before proceeding with the steps below.

All the steps below are performed by the Tenant Global Administrator.

These instructions assume there are no other information barriers configured.

Teams admin center

  1. Sign into the Teams admin center.
  2. In the left-rail menu, expand Teams.
  3. Select Teams settings.
  4. Scroll down to Search by name.
  5. Turn on the toggle, and save the change.

For more information on this option, see Limit who users can see when searching the directory in Teams.

Compliance - Auditing

  1. Sign into the Microsoft Purview compliance portal.

  2. In the left navigation pane, select Audit.

  3. If auditing is turned off, the following banner will be displayed:

    Screenshot showing audit banner if auditting is not enabled

  4. Select the Start recording user and admin activity.

For more information on auditing, see Set up Audit (Standard) in Microsoft 365.

Segmenting Data

The Resource Accounts that shouldn't be called directly need to be segmented and easily identifiable. This can be done by making them members of a particular group or by some unique information in their user profile such as:

  • Company
  • User principal name
  • Location
  • Department
  • Usage location
  • Mail nickname (Alias)
  • Physical delivery office name (Office)
  • Postal code
  • Proxy address (Email Address)
  • Street address
  • Target address (ExternalEmailAddress)
  • Mail (WindowsEmailAddress)
  • Description

In the example steps below, the Department field will be used.

For more information on segmenting users, see Identify segments.

Microsoft admin center

  1. Sign into the Microsoft 365 Admin Center.
  2. In the left navigation pane, select Active Users.
  3. Select the first Resource Account to block direct calls to.
  4. Select Manage contact information in the right pane.
  5. Replace the contents of the Department field with a unique word or acronym that isn't used as a department name. For example, DNC.
  6. Save changes.
  7. Repeat for each Resource Account that needs to be blocked from receiving direct calls.

Compliance - Information Barriers

  1. Sign into the Microsoft Purview compliance portal.
  2. In the left navigation pane, select Information barriers > Segments.
  3. Select New segment.
  4. Enter a name for the segment, and select Next. For example, Uncallable Resource Accounts.
  5. Select + Add, and then Department.
  6. Enter the unique word or acronym used in Microsoft admin center step 5 above. For example, DNC.
  7. Select Next, and then Submit.
  8. Select New segment.
  9. Enter a name for the segment, and select Next. For example, Callable Users.
  10. Select + Add, and then Department.
  11. Select the Equal drop-down, and select Not equal to.
  12. Enter the unique word or acronym used in Microsoft admin center step 5 above. For example, DNC.
  13. Select Next, and then Submit.
  14. In the left navigation pane, select Information barriers > Policies.
  15. Select Create policy.
  16. Enter a name for the policy, and select Next. For example, Uncallable Resource Accounts.
  17. Select + Choose segment, add the segment created in step 9 above, and select Next. For example, Callable Users.
  18. Select Blocked from the Communication and collaboration drop-down.
  19. Select + Choose segment, add the segment created in step 4 above, and select Next. For example, Uncallable Resource Accounts.
  20. Set the policy to On, select Next, and then Submit.
  21. Select Create policy.
  22. Enter a name for the policy, and select Next. For example, Callable Users.
  23. Select + Choose segment, add the segment created in step 4, and select Next.
  24. Select Blocked from the Communication and collaboration drop-down.
  25. Select + Choose segment, add the segment created in step 9 above, and select Next.
  26. Set the policy to On, select Next, and then Submit.
  27. In the left navigation pane, select Information barriers > Policy application.
  28. Select Apply all policies.

Note

It may take 30 minutes or more for the policy to be applied.

Once the status shows completed, go into Teams Client and try to search for the Resource Accounts that were blocked. It may be necessary to clear the Teams cache.

If a Teams user has saved the Resource Account as a contact, they will no longer be able to call it.