Partner management for customers

Article
04/08/2024
Applies to:

Microsoft Teams

Partner management in the Teams Rooms Pro Management service enables customers to seamlessly delegate access and responsibilities to one or many partner organizations. Partners can only manage rooms that they are assigned to manage.

On-boarding partners

Invite partners through the Teams Rooms Pro Management portal to establish the relationship between your organization and the partner organization’s tenant.

Note

The partner needs to satisfy the pre-requisites in Multi-tenant Management for Partners.

Invitation to partner

In this method, you should know the domain name of the partner (such as Contoso.com).

To initiate the invite

Log in to the Teams Rooms Pro Management portal as a Teams Rooms Pro Manager.
Go to Settings > Partners, then select Add partner.
Enter the domain name in the first row.
Configure the number of days until the invitation expires by entering an integer from 1-30.
Configure the events that will require a change control approval. By default, all controls are set to Auto approval.
Note

Only auto-approve is currently available for now.
1. Manual approval: When the partner performs the action, an approval request is generated for the customer to review and approve. The action is not implemented until the request has been approved.
2. Auto- approval: When the partner performs the action, no approval request is generated and the action is implemented immediately.
Select Next.
Assign rooms the partner will manage, then select Next.
To continue, review the terms and select I agree.
Review the details of the invitation.
Select Add partner to send the invitation.

The invitation is sent to the Tenant managers in the partner instance for review. The first partner user that accepts the invitation will establish the link between the Partner and your tenant and assign Primary admins. There is no special association with the user that establishes the link, which allows flexibility should the user be reassigned. There must always be at least one user in the primary admin role.

To manage users in the primary admin role, see Multi-tenant Management for Partners.

Off-boarding partners

To remove a partner

Log in to the Teams Rooms Pro Management-Multi-tenant Management (MTM) portal as a Teams Rooms Pro Manager.
Navigate Go to Settings > Partners.
Select the partner you wish to remove.
In the customer detail pane, select Remove partner.
Select Delete.
At the confirmation prompt to terminate the association between you and the customer tenant, select Delete.

Managing partner roles

Partner roles allow for your partner to more granularly delegate responsibilities to additional personnel. The concept of these roles is the same as described in Role-based access control. It is important to note that partner roles are distinct from your custom roles.

The Primary admin role is the only built-in role for each partner you add. This role has almost all permissions to the rooms you assigned that partner for the TRM service (see Table 1). For example, if you have rooms across the globe and assign a partner to manage All US rooms, the primary admin would only be able to manage and delegate permissions for those rooms. In this case, the primary admins for this Partner have no visibility to any rooms outside of the US.

Adding Primary admins to partner

If you already sent an invitation to a partner and wish to delegate more rooms, you can add rooms to the partner admin role.

To add new rooms to an existing partner

Log in to the Teams Rooms Pro Management-MTM portal as a Teams Rooms Pro Manager.
Go to Settings > Roles.
Select Partner roles.
Select the Primary admin role for the corresponding partner name.
In the role pane, select Assignments.
Select the Assigned admins assignment.
In the Assigned admins assignment pane, select Scope.
Select Edit.
Search for the rooms you wish to add and select the desired room.
To confirm the changes, select Save.

Table 1

Feature	Permission	Teams Rooms Pro Manager	Site Lead	Site Tech	Partner admin
Rooms	View	✔	✔	✔	✔
	Modify	✔	✔	✔	✔
	Reset key	✔
	Download key	✔	✔	✔
	Unenroll	✔	✔	✔
	Create	✔	✔
Group management	View	✔	✔		✔
	Modify	✔	✔
	Create	✔	✔
Update ring management	View	✔	✔		✔
	Modify	✔	✔		✔
Reports	View	✔	✔		✔
	Create customer incident	✔	✔	✔	✔
Tickets Management	View	✔	✔	✔	✔
	Update	✔	✔	✔	✔
Pro Management Settings	View	✔
	Modify	✔
Role management	View	✔			✔
	Modify	✔			✔

Security

As the end customer, you retain control over access to your data and can completely remove a partner at any time.

With the delegated access feature, a partner does not gain any other privileges outside of the Teams Rooms Pro Management portal. However, any data present in the Teams Rooms Pro Management service derived from other Microsoft products is considered data in the service. As an example, while call quality reports are derived from Teams call quality data, any data in the Teams Rooms Pro Management portal is in the permission scope.

No permissions are granted to Microsoft Entra ID or the Teams Admin Center or any other Microsoft product. Furthermore, partners do not have any access to view or modify rooms not defined in the invitation scope.

Data resides in the customer’s tenant and is not copied to the partner’s tenant.

The MTM portal uses Microsoft Entra authentication to validate the login credentials of the partner. Note that at this time, the customer’s authentication policies do not apply to the partner. For example, if the customer has a multi-factor authentication policy, it does not translate to the partner.

To pull logs on partner activity, see Auditing.