Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,372 questions
Teams Rooms on Windows DUO MFA
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 18%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJG%3C/text%3E%3C/svg%3E)
Josh Gallagher
0
Reputation points
I am having an issue with a Teams Room on Windows not being able to sign into the resource account that was created. I can login to the account with the web client and I have DUO set to bypass. Not sure how to bypass DUO in Azure.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 94%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EW%3C/text%3E%3C/svg%3E)
Will 420 Reputation points2023-08-01T20:10:03.72+00:00 Typically with Duo MFA, you just need to bypass it at the account level which you've already done.
In terms of Azure, go to your conditional access policies and find the one for your Duo MFA (I presume you will have a global one) - just go to Users and Group and add the resource account to the exclude users and apply.
One note:
- I highly recommend that you create a group (label it or make notes so that everyone knows what the group does) for that specific CA policy exclusions and add the user there.
- It's easier and better for auditability:
- yes I know you can do it by PowerShell but not every is a PS guru - its just easier to export the list of users from an AD group for whomever is doing a spot check or for the auditor
- You won't need to explicitly need to go to the CA policy to check
- If you have a large IT with defined roles, a ticket to your Helpdesk would be enough to give the auditee the info they want - generally HD will get AD visibility but may not get/need CA policy visibility.
- You won't need to explicitly need to go to the CA policy to check
- yes I know you can do it by PowerShell but not every is a PS guru - its just easier to export the list of users from an AD group for whomever is doing a spot check or for the auditor
-
Josh Gallagher 0 Reputation points
2023-08-02T01:27:49.44+00:00 We have a hybrid setup with our Servers ONPrem set at authoratative. So we dont have a CA policy setup for DUO.
-
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,456 Reputation points2023-09-14T23:40:55.1566667+00:00 Hello @Josh Gallagher , was your issue solved? Do you still need help?
Sign in to comment
Sign in to answer