Forum Discussion
Management of unsupported WFH Teams-certified desk phones
Hello, I'm looking for best practice or suggestions on management of unsupported WFH Teams-certified desk phones for company with Microsoft enterprise E3 and E5 licensed users. We're a Microsoft shop with Teams for messaging, but not for desk phones. So far, we've had only one employee buy their own Yealink Teams-certified desk phone for WFH use. It showed up as an incident in our MTR Pro Management portal for Account management Sign in (Teams) and we found out it was for a personal Yealink Teams-certified desk phone they setup and logged into at home.
I asked multiple IT groups at the company I work for, and this is the answer they gave me "This device was allowed to enroll into Intune/Entra/MTR Pro portal because the user is a user in our Microsoft Tenant. The Android AOSP enrollment does not have any method of limiting what devices are allowed to enroll or of identifying that it is either personal or corporate. I was unable to find any Microsoft documentation that would have prevented this from occurring. If another user finds a used Teams Room device at a garage sale and thinks it would be cool to have one at home, the same thing will happen again."
What are our options to manage unsupported Teams-certified desk phones in our environment?
TIA
1 Reply
The issue is that an employee-owned Yealink phone enrolled and appeared in management, not necessarily that its hardware certification has expired. Teams Android devices use a dedicated AOSP enrollment arrangement; successful enrollment does not establish that your company approved the purchase. First identify the exact device model, firmware, signed-in account, and corresponding Intune and Entra device records. Separate approved Teams hardware from employee-purchased devices in your inventory. Then evaluate a narrowly scoped Conditional Access policy using supported device filters and access controls, testing with a pilot account before enforcement. Do not rely solely on a personal-versus-corporate ownership label as your approval signal. Microsoft supports device filtering, blocking access, and requiring compliance for these devices, but several ordinary mobile-device controls are unsupported. Avoid applying smartphone app-protection requirements indiscriminately. Document your allowed-device policy and involve your identity team before changing tenant-wide enrollment or sign-in settings.
