Restrict Teams Rooms resource accounts to managed room devices

Description

The resource accounts used by Teams Rooms and other Teams devices are limited to what a room needs:

• they do not keep access to Microsoft 365 files after a meeting (RestrictResourceAccountAccess = True, Baseline security mode setting Don't allow resource accounts on Teams Rooms devices from accessing Microsoft 365 files);
• they can sign in only from compliant, organization-managed Teams Rooms devices (Conditional Access with a device filter and compliance requirement, Only allow endpoint managed, compliant devices to sign in);
• they are blocked from signing in to other Microsoft 365 clients (Block unmanaged devices and resource account sign-ins to Microsoft 365 apps).

Rationale

Resource accounts are licensed user accounts with a mailbox and calendar, often created with a password set by an installer and excluded from MFA because the device cannot prompt. If the credentials leak, they open a mailbox, files shared to meetings and a foothold in Teams from any device. Binding the accounts to managed room devices and removing standing file access shrinks that exposure.

Impact

Room devices must be Entra joined (or Android devices enrolled) and compliant in Intune before the Conditional Access policies are enforced, otherwise rooms stop signing in. Teams Rooms Pro includes Entra ID P1 and Intune; Microsoft's procedure also uses Entra ID Governance access packages for the join window. Content shared in a meeting is no longer reachable from the room after the meeting. RestrictResourceAccountAccess may still be in preview in some tenants.

Applies when

Requires: Microsoft Teams Rooms devices

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader. Browse to Settings > Org settings > Security and Privacy > Baseline Security Mode and check that the three Room devices settings are on.
2. In the Microsoft Entra admin center, browse to Entra ID > Conditional Access > Policies (Security Reader) and check that a policy targeting the resource account group requires a compliant device with a filter on the room devices, and that another blocks those accounts outside the room devices. Both must be On.
3. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object RestrictResourceAccountAccess must return True.
4. In the Entra sign-in logs, filter on a resource account and check that recent sign-ins come only from room devices.
5. Fail if any of the three restrictions is missing or not enforced.

Remediation

1. Put all Teams Rooms resource accounts in a group (for example a dynamic group on a naming convention) and make sure every room device is Entra joined and compliant in Intune.
2. Follow Microsoft's procedure to create the Conditional Access policies: require a compliant, Entra joined device with a device filter on approved room devices, and block the resource accounts everywhere else. Start in Report-only, check the sign-in logs, then switch to On. Role: Conditional Access Administrator.
3. Run Set-SPOTenant -RestrictResourceAccountAccess $true (SharePoint Administrator), or turn on the matching Baseline security mode setting.
4. Turn on the three Room devices settings in Baseline security mode once the impact report shows no unexpected dependency. Role: Teams Administrator.

Rollback

Set the Conditional Access policies to Report-only if rooms cannot sign in, and run Set-SPOTenant -RestrictResourceAccountAccess $false if rooms need file access back.

References

• Restrict Teams resource accounts sign in to only Teams Rooms with Conditional Access Microsoft, vendor-doc, accessed 2026-10-24
• Supported Conditional Access and Intune compliance policies for Microsoft Teams Rooms and Teams Android devices Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-020 Require a compliant or hybrid joined device to access resources

People and lifecycle