Unable to Prevent MFA Prompts on Teams Rooms Resource Account, Persistent Sign-In Challenges with Teams Rooms Resource Accounts

Question

We have a Teams rooms resource account for our Teams Android Device, and we configured a conditional access policy to exclude the resource account from MFA prompts if it comes from a known location (basically "to only ask for MFA if it comes from an unknown location") and excluded that resource account from all the conditional access policies involving MFA. We even excluded the resource account from SSPR. But the policy does not seem to work as expected. The policy is configured correctly as per Microsoft Learn's documentation and have been tested using the What If tool as well, but the desired end results are not achieved. When we look into the sign in logs to see if any other policy could possibly be affecting it, we see the following in Authentication Details:

Authentication Policies Applied Session Lifetime Policies Applied

App requires multifactor authentication Register passwordless authentication methods

And I'm unable to find where these policies or settings are configured in our tenant and if these are globally applied policies, where am I supposed to look for them? I created a support ticket with Microsoft as well, which has been ongoing for a month now, and have not found an acceptable answer or solution to my problem. On further digging into the sign-in logs, I find the names of two applications which are:

Application Name Application ID

Microsoft App Access Panel 0000000c-0000-0000-c000-000000000000

Microsoft Authentication Broker 29d9ed98-a469-4536-ade2-f981bc1d605e

which is a bit weird because we are trying to use the resource account on our Teams device via device login. Does anybody have a clue on how to fix this behavior?

Our sole purpose to setup this policy in the first place was to reduce the labor of signing into the Teams device again and again with the Teams room resource account, as and when the session expires. Currently we have configured a sign in frequency of 180 days to save ourselves from frequently signing into the device every 30 days, but is there any workaround? and how do large organizations handle this issue? Do they also have to keep signing into the Teams device again and again? I'm pretty sure that there must be a way out. Please reach out to me with any possible solutions.

Answer 1

Our Teams device is an EPOS-EXPANDVISION-3T which is considered legacy now as per Microsoft's documentation and it can be managed using Android device administrator only.

Moving Teams Android Devices to AOSP Device Management | Microsoft Community Hub

Answer 2

Does your Intune account connect to an Android enterprise account? End of last year, might have been earlier this year, it was switched to Android enterprise from the legacy Android Device Administrator.

Make sure in your admin portal for Intune, you have Android enterprise set up and the account linked.

Answer 3

Hi Emily, we have an android Teams Device and is enrolled in Intune. We followed the steps mentioned in this documentation Deploy Teams Rooms on Android and Teams panels - Microsoft Teams | Microsoft Learn, and the CA is made in reference to Authentication best practices for Microsoft Teams shared device management of Android devices. - Microsoft Teams | Microsoft Learn

Answer 4

It is unclear to me - did you enroll your device in Intune? Your CA policy should be device-level, not account level.

https://learn.microsoft.com/en-us/microsoftteams/rooms/rooms-authentication

Answer 5

Dear Yukti, 

I hope you have a good day. Thanks for choosing Microsoft Community.     

Thank you for reaching out and providing a clear explanation of the issue. We're sorry to hear you're experiencing this issue with the Teams Rooms resource account on Android devices, despite having configured Conditional Access exclusions. 

To resolve this, Microsoft’s support team will need to step in. A technical support engineer can perform a remote session to investigate the situation, verify the backend configurations, and run any necessary synchronization tools to resolve the problem. If the issue requires further attention, they can escalate it to a specialized team for deeper analysis.    

As forum moderators, we don’t have access to the detailed logs or backend systems needed to troubleshoot this effectively due to privacy and security constraints. For that reason, the most efficient solution would be to contact Microsoft’s support team directly.    
  
For the standard procedure outlined above, Office 365 global administrators may need to contact the Office 365 support team by submitting a service request.    
  
Here’s what your Office 365 Global Admin should do next:       

• Submit a Service Request: The Global Admin should create a service request with Microsoft support to get advanced technical assistance and diagnostics. For detailed instructions on how to get support, please refer to Get support - Microsoft 365 admin | Microsoft Learn.
• Find Your Microsoft 365 Admin: If you’re unsure who the Global Admin is within your organization, you can find guidance on locating them here: How do I find my Microsoft 365 admin? - Microsoft Support.
• Call Microsoft Support: For additional assistance, use this link to find the appropriate contact number: Customer service phone numbers - Microsoft Support
• Contact a Reseller (if applicable): If your Office 365 subscriptions are managed through a federated partner or reseller and the Global Admin cannot open a service request, they should contact the reseller’s support provider. The reseller can assist with initiating the request and coordinating with the Office 365 support team.

Note: If you’re an end-user, please coordinate with your Office 365 Global Administrator to handle these steps.       

I sincerely apologize for the inconvenience and the negative experience this may have caused. Please know that we take these matters seriously, and we truly appreciate your patience and understanding as we work to support you. If you need any further assistance or clarification, feel free to reach out—we're here to help. Thank you very much for your understanding and your cooperation.    

Best regards,  

Clover-L - MSFT | Microsoft Community Support Specialist.