Updated: 8th March 2023 with the latest information
Teams handsets are a great way of bringing Teams telephony in physical form to your users who prefer a traditional telephone over a headset, or to provide telephone services in common areas, meeting rooms or to guests.
Let’s take a look at how to get them set up in your organisation and how to manage them with your existing tooling.
Choosing Teams Handsets
There’s a whole range of Teams handsets available from well-known vendors like Poly, Yealink, Crestron, AudioCodes and Lenovo. You can review the full list here: Business Desk Phones with Displays | Teams devices (microsoft.com)
Configuring the user account
Teams handsets require a standard Office 365 user account – the same as what you’d assign a normal Teams user.
It’s advisable to set the password for your phone account to never expire – particularly if you’re setting the phone up as a meeting room or common area phone.
This is easily achieved in Powershell:
- Connect to Office 365:
- Set the password for the phone account to never expire:
Set-MsolUser -UserPrincipalName firstname.lastname@example.org -PasswordNeverExpires $true
If you’re assigning a handset to an end user that already uses Teams, they can use the same account and licensing to login to their Teams phone.
If you’re setting up a Common Area handset, be sure to assign a “Shared Devices” license to the account.
If you’re setting up a meeting room phone, right now you’ll want to assign a Teams Meeting Room Pro license to it.
Of course, to actually make calls to/from the PSTN you’ll either need a Microsoft Calling Plan license (if you’re in one of the countries supported by Microsoft Calling Plans), A Direct Routing or Operator Connect solution, or if you’re in Australia you can also use Telstra Calling.
You can enroll Teams handsets in Intune, and apply conditional access policies to them (e.g ensuring they are compliant, and have MFA enforced).
If your Enrollment Restrictions policy blocks personal device enrollment for Android devices, be sure to add the serial number of your Teams handsets under Devices > Enroll Devices > Corporate Device Identifiers to allow the phone to enroll.
If you’re having issues enrolling Teams Phones, check out my guide here: Teams Phone – Intune Enrollment Issues – Blog – Chiffers.com
Enforcing Multi-factor Authentication
Teams handsets do support multi-factor authentication, and will support sign on either directly from the phone screen itself, or via https://microsoft.com/devicelogin
Keep in mind that if the phone is a common area phone, or meeting room phone, enforcing MFA could become problematic if the phone needs to be signed back in and the administrator who’s device is registered to receive the MFA prompt/authenticator code isn’t around. Because of this, i’d recommend not enforcing MFA for common area or meeting room phones if you can get away with it in your environment.
Changing The Look And Feel Of The Phone
Teams phones support three different operating modes:
- Normal “User sign in” mode
- Common Area Phone mode
- Meeting Room mode
The sign in mode affects how the interface looks on the phone handset, and what features and functions are available to the end user. You set the sign in mode via a Teams IP Phone Policy.
To create a new Teams IP Phone Policy:
- Connect to Microsoft Teams in Powershell:
- Run the following command to create a new Teams IP Phone Policy
New-CsTeamsIPPhonePolicy -Identity ‘CAP’ -Description ‘Common Area Phone Policy’ -SignInMode CommonAreaPhoneSignIn
SignInMode can be: CommonAreaPhoneSignIn, UserSignIn, MeetingSignIn
- Finally, run the following command to assign the newly created profile to a user:
Grant-CsTeamsIPPhonePolicy -Identity email@example.com -PolicyName CAP
Let’s take a look at what each sign in mode looks like to the end user when the policy is assigned to the users account that’s used to sign in to the phone:
User “UserSignIn” Mode
UserSignIn mode is the typical desk phone experience. The handset displays Calls, People, Calendar, and Voicemail. You’d typically assign this policy to an end user who’d have the phone sat on their desk to make/receive calls.
In this mode, you can choose to enable Hot Desking (sign in and sign out) and set a HotDesking Timeout value that automatically signs the phone out after a set timeout period.
Set-CsTeamsIPPhonePolicy -Identity ‘DeskPhone’ -AllowHotDesking $true
Set Hotdesking timeout value (minutes):
Set-CsTeamsIPPhonePolicy -Identity ‘DeskPhone’ -HotDeskingIdleTimeoutInMinutes 480
Common Area “CommonAreaPhoneSignIn” Mode
In Common Area Phone mode, the phone displays a dial pad on screen (if using a touch screen device), and provides no access to calendaring, call history, manual status changes or voicemail. As the name suggests, this mode is suitable for phones that are placed in common areas like hallways, or publicly accessible areas.
You can choose to enable or disable directory search when in this mode if you wish. The advice here is that if the phone is in a publicly accessible area, I’d recommend disabling directory search to stop someone searching your internal directory for contact information.
Set-CsTeamsIPPhonePolicy -Identity ‘CAP’ -SearchOnCommonAreaPhoneMode Disabled
You can also add speed dials that are displayed on the handset by default. You do this via the desktop Teams client, or via a web browser. The phone will show the display name of the account, along with the presence of the user (if the user is a Teams user). You can add phone numbers as speed dials too, if you wish.
Meeting Room “MeetingSignIn” Mode
In Meeting Room mode, the phone displays any upcoming meetings the account has been included in. This makes joining these Teams meetings from the phone super simple – you simply tap the meeting and tap join. If the phone has a built in supported camera (such as Crestron’s range), you’ll be able to see and show video too.
In addition to the TeamsIPPhonePolicy settings that you can set in PowerShell, there are also a number of settings available to you within the Teams Admin Centre for Teams Phones.
You can configure a number of different settings include a device lock, which will ask the user for a PIN after the set timeout value to unlock the phone.
Here is also where you set the correct time zone for the phone, so that it displays the right date / time information.
Device settings let you set display settings like setting a screensaver, backlight brightness and backlight timeout, as well as accessibility features like enabling high contrast mode.
Silent mode mutes the phone so that it doesn’t ring when called.
Network settings let you set IP, Hostname and DNS information, as well as the device’s local admin password and if the PC port on the back of the phone is enabled (useful if you want to daisy chain the users PC to the phone to share a single Ethernet port at their desk.
Note: You cannot set Proxy information here.
Assigning Phone Numbers
To assign a phone number to a desk phone, regardless of if its in meeting room mode, common area mode, or user mode can easily be achieved via PowerShell:
If you’re using Direct Routing:
Set-CsUser -Identity HandsetUserAccount01@chiffers.com -OnPremLineURI tel:+12058461934 -EnterpriseVoiceEnabled $true -HostedVoiceMail $true
If you’re using a Microsoft Calling Plan or Telstra Calling:
Set-CsUser -Identity -Identity HandsetUserAccount01@chiffers.com -HostedVoiceMail $true
Set-CsOnlineVoiceUser -Identity HandsetUserAccount01@chiffers.com -TelephoneNumber +12058461934
Note: The -HostedVoiceMail $true parameter can be left off if you’re configuring common area or meeting room phones.
Be sure to check that the account has either an E5 license, or the Phone System Add-on license.
Accessing the phone via HTTP/HTTPS
If you’re used to being able to view the phones settings via a web browser, you’ll be happy to hear that this is still possible on Teams handsets too, but you’ll first need to enable “Web Server” mode on certain handsets to be able to connect.
On a Poly handset, this is found under Settings > Device Settings > Admin Only (enter admin password) > Network Configuration > Web User Inferface (switch ON).
You can then browse to https://ip-of-phone and login as the admin.
Note: when running in Teams mode, a number of options are unavailable (greyed out) under settings.
Are you considering deploying Teams handsets in your organisation?
Hey great article, I love your descriptions of Teams Phone modes. I’ve not found anyone else explain the modes (and is how I found your post). Quick question though, why no reference of equipment accounts in O365? If you are setting up a device for a meeting room or common area Phone is an equipment ID + Common Area Phone licence not the recommended MSFT approach? Saying Teams handsets require a “user account- same as normal users” could be a bit misleading. (see: https://docs.microsoft.com/en-us/microsoft-365/admin/manage/room-and-equipment-mailboxes?view=o365-worldwide)
typically equipment mailboxes are used for shared things that need to be kept track of (think of maybe a screen on wheels for example). I’d be setting meeting rooms up as meeting rooms, and common area phones up as user accounts.
We just changed our phone system to Teams with Yealink handsets. It’s cool but one of the bigger problem is the user password expirations… Every 4 months, users have to re-enter their password on the handset, it’s not easy to understand for non-IT people. Of course we could set password expiration to never but it would be a very big security risk (because it’s AD on-prem sync to Azure-AD accounts).
Do you know a workaround for this ?
Hi, You can use passwordless login for the users so that they don’t have to type a password?
You certainly can for user-based desk phones. I wouldn’t recommend this for common-area phones, though.
This option is interesting.
How do set this “paswordless login” ?
We recently purchased Common Area Phone licenses, and Intune is (now) included in it, so no requirement to purchase it separately…
that’s right 🙂