{
  "id": "CB-M365-COLLAB-034",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-034",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-034.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-034.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-034",
    "title": "Restrict Teams Rooms resource accounts to managed room devices",
    "finding": {
      "title": "Teams Rooms resource accounts can be used outside the room devices",
      "description": "A resource account, whose password is often shared with installers and rarely rotated, can sign in to Microsoft 365 apps from any device and keep access to meeting files."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams-rooms",
      "resource-accounts",
      "conditional-access",
      "device-compliance"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams Rooms devices"
      ]
    },
    "description": "The resource accounts used by Teams Rooms and other Teams devices are limited to what a room needs:\n\n- they do not keep access to Microsoft 365 files after a meeting (`RestrictResourceAccountAccess` =\n  `True`, Baseline security mode setting **Don't allow resource accounts on Teams Rooms devices from\n  accessing Microsoft 365 files**);\n- they can sign in only from compliant, organization-managed Teams Rooms devices (Conditional Access\n  with a device filter and compliance requirement, **Only allow endpoint managed, compliant devices\n  to sign in**);\n- they are blocked from signing in to other Microsoft 365 clients (**Block unmanaged devices and\n  resource account sign-ins to Microsoft 365 apps**).\n",
    "rationale": "Resource accounts are licensed user accounts with a mailbox and calendar, often created with a\npassword set by an installer and excluded from MFA because the device cannot prompt. If the\ncredentials leak, they open a mailbox, files shared to meetings and a foothold in Teams from any\ndevice. Binding the accounts to managed room devices and removing standing file access shrinks that\nexposure.\n",
    "impact": "Room devices must be Entra joined (or Android devices enrolled) and compliant in Intune before the\nConditional Access policies are enforced, otherwise rooms stop signing in. Teams Rooms Pro includes\nEntra ID P1 and Intune; Microsoft's procedure also uses Entra ID Governance access packages for the\njoin window. Content shared in a meeting is no longer reachable from the room after the meeting.\n`RestrictResourceAccountAccess` may still be in preview in some tenants.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global\n   Reader. Browse to **Settings** > **Org settings** > **Security and Privacy** > **Baseline\n   Security Mode** and check that the three **Room devices** settings are on.\n2. In the Microsoft Entra admin center, browse to **Entra ID** > **Conditional Access** >\n   **Policies** (Security Reader) and check that a policy targeting the resource account group\n   requires a compliant device with a filter on the room devices, and that another blocks those\n   accounts outside the room devices. Both must be **On**.\n3. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object RestrictResourceAccountAccess` must return `True`.\n4. In the Entra sign-in logs, filter on a resource account and check that recent sign-ins come only\n   from room devices.\n5. Fail if any of the three restrictions is missing or not enforced.\n"
    },
    "remediation": {
      "manual": "1. Put all Teams Rooms resource accounts in a group (for example a dynamic group on a naming\n   convention) and make sure every room device is Entra joined and compliant in Intune.\n2. Follow Microsoft's procedure to create the Conditional Access policies: require a compliant,\n   Entra joined device with a device filter on approved room devices, and block the resource\n   accounts everywhere else. Start in **Report-only**, check the sign-in logs, then switch to\n   **On**. Role: Conditional Access Administrator.\n3. Run `Set-SPOTenant -RestrictResourceAccountAccess $true` (SharePoint Administrator), or turn on\n   the matching Baseline security mode setting.\n4. Turn on the three **Room devices** settings in Baseline security mode once the impact report\n   shows no unexpected dependency. Role: Teams Administrator.\n",
      "rollback": "Set the Conditional Access policies to **Report-only** if rooms cannot sign in, and run\n`Set-SPOTenant -RestrictResourceAccountAccess $false` if rooms need file access back.\n"
    },
    "references": [
      {
        "title": "Restrict Teams resource accounts sign in to only Teams Rooms with Conditional Access",
        "url": "https://learn.microsoft.com/microsoftteams/rooms/block-non-compliant-teams-rooms-devices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Supported Conditional Access and Intune compliance policies for Microsoft Teams Rooms and Teams Android devices",
        "url": "https://learn.microsoft.com/microsoftteams/rooms/supported-ca-and-compliance-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Baseline security mode settings",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-020",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}