One of the most common questions asked when working among the array of available Skype for Business (SfB) audio and video endpoints is regarding what type of Lync or Skype for Business account can or should be used? The short answer here is that there typically is not only one right answer. Most of the phones and conferencing devices can work with either available types and generally do not have a single recommended approach due to potential behavioral differences. This article will go into detail on what those differences are as a way to help the reader understand which approach may be ideal, if not a mixture of both in the same environment.
While the detailed instructions shown later in the article focus on configuring meeting room accounts for Skype for Business Online be aware that most of the concepts explained throughout are also applicable to on-premises Lync and Skype for Business deployments. The only major difference is how the accounts are initially provisioned as the administrative process differs slightly between on-premises and online environments. Once configured though the behavior of these accounts are the same whether they are homed on-premises or online.
The steps for configuring these types of accounts for on-premises environments have been covered by multiple sources as well as on this blog so they do not need to be revisited in this article. Also another earlier article covered setting up remote PowerShell for Lync Online but those steps have been updated for Skype for Business Online as well as expanded upon for additional functionality in this article.
(For repeat visits there is quick reference on creating and configuring Skype for Business Online Meeting Room accounts using PowerShell in the last section of this article.)
Background
The two methodologies mentioned above are simply referring to the use of standard user accounts or special meeting room accounts. Much of the foundation of these two account types are identical; they are just handled and treated differently within the various products that leverage them.
- Active Directory – At the primary directory services level there is no difference between the two accounts models. They both utilize a standard Active Directory (AD) User Account object, meaning any and all of the attributes available to these object types are available to both. Whether this is a traditional on-premises deployment in Windows Server Active Directory, Azure Active Directory in Office 365, or a Hybrid of both leveraging some directory synchronization services then a standard user account object is always the core component.
- Exchange Server – Within Exchange Server there exists different mailbox types which for regular users and bookable resource accounts, the latter being meant for things like conference room equipment which can be fixed or mobile. Exchange treats a User Mailbox differently from a Resource Mailbox in terms of how mail is stored in those mailboxes and even what portions of the messages are retained or stripped. Mailboxes of either type will allow devices the same level of access to their calendar of scheduled meetings. A key distinction though is that while resource mailboxes still use the same type of standard user account in AD by default the account cannot actually be used for authentication as no password is defined and the account is disabled. This is because in the traditional workflow of booking meeting rooms in Outlook which leverage Auto Accept agents no one would typically need to login as the mailbox itself. This has changed with the addition of the Communications Server platform to this workflow though. When configuring room mailboxes as part of a Lync or Skype for Business workflow these meeting room mailboxes are enabled specifically to allow authentication using the account’s own credentials.
- Skype for Business – An AD account is created which allows for user authentication. That account is then mailbox-enabled within Exchange primarily to provide it an email address and calendar to accept and store meeting invitations. The final piece in the puzzle now is to SIP-enable the same account to provide all the desired capabilities of adding Lync or Skype for Business to the workflow. Just like in Exchange there are also two different types of Skype for Business accounts. A standard User which can be enabled using either the Control Panel or the Management Shell, or a newer Meeting Room which was first introduced in Lync Server 2013 with the advent of the original Lync Room System product. The meeting room account can only be enabled and managed from the Management Shell and is treated differently by Lync/SfB. Either approach can be used by devices to sign-in and interact with the SfB services and use the previous calendar access to perform actions like joining the scheduled Skype for Business meetings.
Differences & Guidance
As mentioned above Active Directory itself does not really know, nor care if the core user account object has been used by Exchange to provide either a user or resource mailbox, nor if SfB has enabled a standard SIP user or a meeting room. (Technically it can be aware of the Exchange Server and SfB Server configuration because much of that configuration is stored among various AD attributes defined on the AD account, but that point it moot as AD does not ‘act’ upon that information in anyway that makes a difference as to which approach to chose.)
Because Active Directory does not have different account types for this scenario and the AD account is automatically created during either the Exchange or SfB provisioning step then there is no decision to make here, hence no guidance. Basically, this is irrelevant.
Exchange Server will treat user and resource mailboxes differently. There are various additional customizations available to control the behavior of a room mailbox by using the Set-CalendarProcessing cmdlet in on-premises and online Exchange environments. There a several parameters available to adjust the default behavior of actions related to acceptance responses, handling time conflicts, meeting duration, or even the allowed reoccurrence scheduling window to name a few.
Another critical difference between user and resource mailboxes is related to licensing. Whether dealing with traditional Microsoft licenses or modern Office 365 licenses a standard mailbox user will consume one of these licenses, but a room mailbox will not. This is easy to see in Office 365 as license-consuming Users are sorted and managed separately from Resources like Rooms and Equipment which are not assigned any licenses.
When it comes down to the vast level of customization offered with a resource mailbox paired with no user-level licenses required then there is virtually no reason to opt to use a regular user mailbox over a resource mailbox. In short, always use a room mailbox.
Up to this point nothing new has really been covered as that is the way it has been for years across various releases of the Windows Server and Exchange Server products. As pointed out earlier it was not until Lync Room System created the need for new functionality in Lync Server 2013 that there was really any decision to be made here.
Using a Room Mailbox by itself for just calendaring in Office 365 does not require any licenses be assigned, but when that same room mailbox is also configured .as a Skype for Business Meeting Room then a license must be assigned. So there is no advantage to using a regular user versus a meeting room as both require SIP registration and authentication to function on a device. This need for a license also overrides the fact that the Exchange account does not need one as these are one in the same. For example the configuration shown in the second half of this article for creating a Room Account in Office 365 could be assigned an E1, E3, or E5 license, depending on the device type it was being used for.
There are two important distinctions regarding Meeting Rooms in Skype for Business which relate to the user experience.
Audio Behavior
Meeting Room accounts trigger special behavior when other participants are joining Lync and Skype for Business meetings. When any device or client registered with a Meeting Room account is already connected to a SfB meeting (ad-hoc or scheduled) then the server is aware of this and triggers a prompt to appear on any other Lync or Skype for Business clients registered as normal user accounts which then join the same conference.
Basically when a Skype for Business or Lync client joins a meeting if there is already at least one participant using a meeting room account in that meeting then the client prompts them to answer the question “Are you in the Skype Room?” before connecting to the meeting.
If the new participant is connecting from their desk or home office they simply answer ‘No’ and are connected to the meeting using the selected default behavior for each modality. If they happen to actually be in the same physical room as the already connected conferencing system then they would select ‘Yes’ and their client will connect automatically on mute. This helps to prevent any audio feedback loops which can occur with multiple systems in the same vicinity connected to the same conference.
This scenario can be common when in-room participants want to join the same meeting from their own device to share or control content in ways that may not be available directly via the in-room system controls. Obviously if using a regular SfB user account on these conference room systems would then prevent the above prompt from appearing and force users to learn to immediately mute their clients as they join meetings in the same room with their own clients.
Lobby Behavior
Meeting Room accounts are treated differently than other user accounts when joining a meeting in another important way.
A scheduled Skype for Business meeting that uses the default lobby option of “Anyone (no restrictions)” will allow all participants to immediately connect to the meeting and bypass the lobby. Thus devices using either a user or meeting room account will behave the same and connect directly to the meeting like any standard participant.
Where things get interesting though is when the individual meeting options have been customized to control specifically which participants are forced into the lobby. A scheduled Skype for Business meeting that is configured to allow either “Anyone from my organization” or “People I invite from my company” to bypass the lobby will behave differently between user and meeting room accounts.
The following table shows which account types will bypass the lobby and which will be forced into the lobby across the 4 different lobby settings.
Lobby Configuration | User Account | Meeting Room Account |
Only me, the meeting organizer | Forced into Lobby | Forced into Lobby |
People I invite from my company | Allowed Directly into Meeting | Forced into Lobby |
Anyone from my organization | Allowed Directly into Meeting | Forced into Lobby |
Anyone (no restrictions) | Allowed Directly into Meeting | Allowed Directly into Meeting |
- Clients or devices registered with a meeting room account are forced into the lobby when invited directly to the meeting in the two middle options above, even though it is registered as a corporate account from the same organization . This is because a Skype for Business Meeting Room account is not treated as someone from the organization or someone that was invited directly. This behavior is by design as one can imagine that anyone could walk into a conference room or up to a common area device and join a meeting on the calendar; employee or guest. This behavior allows actual authenticated users who are granted presenter rights to ability to curate the lobby list and only allow (or allow and then promptly remove) possibly unknown participants joining from shared endpoints.
- Obviously if this behavior is not desirable for specific devices then choosing to use a regular SfB user configuration instead of a meeting room configuration for that device will address this by always allowing the room to bypass the lobby (unless the meeting was configured for only the meeting organizer to be allowed). But as covered in the previous section registering a room system with a user account will omit the “Are you in the Skype Room?” prompt from appearing in those meetings.
Given the potential trade-off between audio and lobby behaviors described above there is no single right answer for selecting account types for all devices. Generally it would be best to use the vendor-preferred approach which is typically a Meeting Room account for most devices. But the desired lobby behavior could be one of the most critical items in making this decision.
Solutions like Skype Room Systems and Group Series video conferencing systems are best suited using the meeting room approach, but work equally as well (when properly configured) with a regular SfB user.
Remember that in either scenario an Exchange room mailbox is always recommended so the calendaring functionality is no different between them. Also Audio conferencing phones can leverage Common Area Accounts which do not support Exchange and thus have no calendaring and do not really apply here. Audio conferencing phones can also leverage Common Area Accounts which do not support Exchange and thus have no calendaring
Given that the overall guidance is to leverage Meeting Room accounts then the remainder of this article will cover exactly how to configure these in Skype for Business Online.
Office 365 PowerShell Setup
As mentioned earlier it is not possible to create Meeting Room accounts using the Skype for Business Online Admin Center so this configuration must be performed using PowerShell cmdlets. In order to leverage PowerShell for Online services the following workstation configuration must be addressed first.
Software Installation
In order to use Windows PowerShell to connect to Office 365 and manage any of the various online services a few software packages must be installed. The current Microsoft TechNet documentation covers how to do this but the required steps are also included here in this section. These steps only need to be performed once per workstation and can be skipped if this prerequisite software is already installed.
Additional steps may be required depending on the Windows and PowerShell version so if there are any problems getting these packages installed and working make sure to reference the official TechNet guide above as well as this previous article which covers this as well as modifying the workstation’s Execution Policy if needed.
If the older Lync Online PowerShell module is installed then it is highly recommended (although not mandatory) to uninstall that package from the workstation and reinstall the newer Skype for Business module covered below.
- Download and install the 64-bit version (msoidcli_64.msi) of the Microsoft Online Services Sign-in Assistant.
- Download and install the Windows Azure Active Directory Module for Windows PowerShell.
-
Download and install the Skype for Business Online Windows PowerShell Module
Now that the required software has been installed the next step is to create a simple PowerShell script to leverage all of these new components in a single command instance.
Management Script
The following basic script file can be used to initiate and authenticate multiple sessions into Office 365 for the purposes of leveraging any Azure Active Directory , Exchange Online, and Skype for Business Online PowerShell cmdlets. Note that the Skype for Business Online module must be installed on the local workstation first but this is not the case for Exchange Online. The Exchange session is created manually using the New-PSSession cmdlet and thus does not need any local installation files.
Follow the steps below to create a new script file. Make sure to pay attention to spacing and dashes in the cmdlets as the formatting on various browsers and display resolutions can change where the longer commands are wrapped to a new line in this article.
- Using either a simple text editor like Notepad or a more advanced tool like Windows PowerShell ISE create a new script file and select any desired name (e.g. O365.ps1).
- Enter the following text into this file, replacing the highlighted example user account name with the desired administrator account for the appropriate Office 365 tenant (e.g admin@mycompany.onmicrosoft.com)
$credential = Get-Credential admin@domain.com
Import-Module MsOnline
Connect-MsolService -credential $credential$exchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $credential -Authentication Basic -AllowRedirection
Import-PSSession $exchSession -DisableNameChecking
Import-Module SkypeOnlineConnector
$sfboSession = New-CsOnlineSession -Credential $credentialImport-PSSession $sfboSession
These 8 individual command lines above perform the following functions:
- Prompts the user to enter the password for the defined admin account and securely stores the set of credentials in a newly defined variable.
- The previously installed Azure AD module is loaded into the current PowerShell session.
- A secure connection is opened to Azure AD in the account’s online tenant.
- A new Exchange Online session is defined and stored in another new variable.
- The Exchange Online session is imported into the existing PowerShell session.
- The previously installed Skype for Business module is loaded into the current PowerShell session.
- A new Skype for Business Online session is defined and stored in a third new variable.
- The Skype for Business Online session is imported into the existing PowerShell session.
If the workstation still has the older Lync Online module installed and it was decided not to replace it with the Skype for Business module then simply edit command 6 to reference the LyncOnlineConnector instead.
- Save the file on the local workstation. Preferably save in a path that PowerShell can see by default (e.g. C:\Windows\) to make it easier to run the script from the command line.
- Open a new PowerShell session and then run the new script.
- Enter the Office 365 tenant administrator account password when prompted.
Once the script completes then the new Exchange and Skype for Business sessions should be displayed as seen below.
To validate a successful connection to all three services run the following basic cmdlets to verify AD, Exchange, and Skype for Business.
Get-MsolUser –UserPrincipalName user@domain.com
Get-Mailbox user@domain.com
Get-CsOnlineUser –Identity user@domain.com
If all steps are successful then the workstation preparation is complete.
Online Meeting Room Configuration
Now that the one-time workstation configuration is complete then the remainder of the steps in this article can be repeatedly used to create individual meeting room accounts at any time.
Exchange Room Mailbox
Using either the same or a new PowerShell session as established in the previous section define a new variable to store the desired User Principal Name for the new meeting room account and then create the new room mailbox.
- Replace the text in blue below with the desired details for the new meeting room and then issue the following New-Mailbox cmdlet to create a new Room mailbox and enable the account to allow authentication.
$newUser="chicago@jdskype.net"
New-Mailbox –MicrosoftOnlineServicesID $newUser -Name "Chicago Meeting Room" -Room -RoomMailboxPassword (ConvertTo-SecureString –String "P@ssw0rd1" -AsPlainText -Force) -EnableRoomMailboxAccount $true
It may take several seconds for this cmdlet to return any results and may also even report a replication request failure. This is normal as it can take up to 15 minutes before the mailbox provisioning is completed in Exchange Online. There is no need to wait that long though to complete the rest of the Exchange Online configuration steps.
- Run the following Set-CalendarProcessing cmdlet to modify some of the default behaviors of a standard resource mailbox which are critical to providing the proper in-room join experience
Set-CalendarProcessing -Identity $newUser -AutomateProcessing AutoAccept -AddOrganizerToSubject $false -RemovePrivateProperty $false -DeleteComments $false -DeleteSubject $false –AddAdditionalResponse $true –AdditionalResponse "Your meeting is now scheduled and if it was enabled as a Skype Meeting will provide a seamless click-to-join experience from the conference room."
- This optional step simply uses the Set-Mailbox cmdlet to define a custom Mail Tip message for when Outlook 2013 and newer users attempt to send messages to this mailbox.
Set-Mailbox -Identity $newUser -MailTip "This room is equipped to support Skype for Business Meetings"
Another optional step is to disable password expiration on this new account. By default, as with any AD account, the password defined in a previous step will automatically expire based on the account’s inherited password policy. When dealing with shared meeting devices it may not be desirable to be forced to administratively update the account’s password within that interval.
- To set the new account’s password to never expire simply run the following Set-MsolUser cmdlet and then optionally run the Get-MsolUser cmdlet to verify the change.
Set-MsolUser -UserPrincipalName $newUser -PasswordNeverExpires $true
Get-MsolUser -UserPrincipalName $newUser |fl userp*, passwordN*
Skype for Business Meeting Room
The final steps are used to create a Meeting Room account in Skype for Business Online. Just as with on-premises deployments of Lync Server 2013 or Skype for Business Server 2015 this configuration is only available via PowerShell and is not provided in the web-based user management tools like the Control Panel or Office 365 Admin Portal.
Just as was performed above some additional variables will be defined to be used by the actionable cmdlet. One difference here though is that in order to create a meeting room the online tenant’s registrar pool information must first be located. The first command is used to store the name of any existing Skype for Business Online user in the tenant as it will be used to query the proper registrar pool FQDN in the second command. The third and final command goes about creating the new meeting room account.
It is important to run these commands after the previous Exchange commands in the same PowerShell session it uses the previously defined $newUser variable which would still be cached in the command shell session.
- Define another variable which will be used to query and store up the proper Skype for Business Online registrar pool name for the specific tenant which will be needed to create the meeting room account. Enter the SIP URI of any existing Skype for Business Online user in the tenant below (e.g. jeff@jdskype.net) .
$pool=Get-CsOnlineUser -Identity "jeff@jdskype.net" | select -expand RegistrarPool
- Execute this final cmdlet to create the new meeting room account using the previously created Exchange room mailbox.
Enable-CsMeetingRoom -Identity $newUser -RegistrarPool $pool -SipAddressType EmailAddress
If the Enable-CsMeetingRoom cmdlet fails with the following error then replication of the previously created mailbox has not yet completed throughout the Office 365 environment. It may be necessary to wait anywhere from a few minutes to hours depending on the health status of Office 365. Typically it only takes a few minutes before this cmdlet is successful but in some scenarios this has taken up to 24 hours before it works.
Management object not found for identity chicago@jdskype.net.
+ CategoryInfo : NotSpecified: (:) [Enable-CsMeetingRoom], ManagementException
+ FullyQualifiedErrorId : Microsoft.Rtc.Management.AD.ManagementException, Microsoft.Rtc.Management.AD.Cmdlets.EnableOcsMeetingRoomCmdlet
+ PSComputerName : admin1a.online.lync.com
When the Enable-CsMeetingRoom cmdlet is reported as successful then wait a few additional minutes and then run the following cmdlet to return all available meeting room accounts to verify that the new account is listed.
Get-CsMeetingRoom | ft Disp*,SIP*
Office 365 License
The final step is to assign an Office 365 license to the meeting room account. This action can be performed in either the Admin Center or via PowerShell. Both approaches are included below but obviously the action only needs to be performed once for each meeting room account that is created.
To assign a license using the same PowerShell session perform the following steps.
- Enter the Get-MsolAccountSku cmdlet to return a list of the current tenant’s existing license types and units. The example tenant used here as 25 enterprise licenses available with a unassigned licenses available.
Get-MsolAccountSku
- Before assigning a license the new account will need to be assigned to a regional usage location. Use the Set-MsolUser cmdlet with the appropriate two-letter country code (e.g. US) for the tenant.
Set-MsolUser -UserPrincipalName $newUSer -UsageLocation "US"
- Then use the Set-MsolUserLicense cmdlet with the appropriate TenantName:LicenseName value which was queried for earlier to assign a license to the new meeting room account.
Set-MsolUserLicense -UserPrincipalName $newUSer -AddLicenses "Schertz:ENTERPRISEPACK"
Alternatively to assign a license by using the Office 365 Admin Center perform the following actions instead.
- Login to the Office 365 Admin Center and then browse to Users > Active Users.
- Either locate the desired account or use the Filters drop-down menu to quickly list only Unlicensed users.
- Highlight the new meeting room account and then click Edit to the right of the Product licenses option.
- Select a Location and then enable the desired license (e.g. Office 365 Enterprise E1) and then Save the changes.
The configuration is now complete and the new Skype for Business Online Meeting Room account can be used with the intended device.
Quick Reference
As with many of these articles once the concepts are understood then repeat visits are typically those occasions when the only the process is important. Thus once a workstation is configured and the script is saved then creating a new meeting room account is as simple as running a host of PowerShell commands, and then tidying things up by assigning a license.
The following block of text cleans up all of the detailed explanation and steps above into a straightforward process. The commands can be run in three individual groupings to allow for replication process to complete between some of the steps. Additionally a number of variables have been included to simply repeat usage of these commands. Simply populate the fields in blue with the desired details and then copy/paste the remainder of the individual cmdlets as shown below.
- Change the text in blue to the desired information and then execute these commands, waiting for the mailbox creation to complete.
$newUser="meetingroom@jdskype.net"
$name="Meeting Room"
$pwd="P@ssw0rd1"
$location="US"
$license="Schertz:ENTERPRISEPACK"
$existingUser="jeff@jdskype.net"New-Mailbox –MicrosoftOnlineServicesID $newUser -Name $name -Room -RoomMailboxPassword (ConvertTo-SecureString -String $pwd -AsPlainText -Force) -EnableRoomMailboxAccount $true
-
Wait about 30 seconds after the mailbox has been successfully created before running the next group of cmdlets to customize the user account and mailbox settings.
Set-MsolUser -UserPrincipalName $newUser -PasswordNeverExpires $true
Set-MsolUser -UserPrincipalName $newUSer –UsageLocation $location
Set-MsolUserLicense -UserPrincipalName $newUSer –AddLicenses $license
Set-Mailbox -Identity $newUser -MailTip "This room is equipped to support Skype for Business Meetings"
Set-CalendarProcessing -Identity $newUser -AutomateProcessing AutoAccept -AddOrganizerToSubject $false -RemovePrivateProperty $false -DeleteComments $false -DeleteSubject $false –AddAdditionalResponse $true –AdditionalResponse "Your meeting is now scheduled and if it was enabled as a Skype Meeting will provide a seamless click-to-join experience from the conference room."
- Given the aforementioned replication delays it may be required to wait up to 15 minutes (typically observed 5-10 minutes) in a healthy tenant before successfully running the next commands.
$pool=Get-CsOnlineUser -Identity $existingUser | select -expand RegistrarPool
Enable-CsMeetingRoom -Identity $newUser -RegistrarPool $pool -SipAddressType EmailAddress
The screenshot below shows all of these commands successfully executed in secession, with suggested interval timing.
Hi,
We have purchased some Polycom Trio phones with the visual+ devices. Currently testing on the firmware version 5.4.4.7609. The information here has been very useful, thank you. We are running Lync 2013 and Exchange 2013, exchange is Hybrid but the room mailboxes are onprem. I have created a Lync Room system account and I am able to login to the Trio, connect to the calendar and view the meetings. The join button is visible and I can see the Skype meeting details in the meeting details, however, when I press Join I am presented with one of the dialin numbers (Argentina, the first in the list) and the meeting is not joined directly
I have created the room account using these commmands:
Exchange
New-Mailbox -UserPrincipalName UKLRS01@domain.net -Alias UKLRS01 -Name “UKLRS-01” -Room -EnableRoomMailboxAccount $true –RoomMailboxPassword (ConvertTo-SecureString -String Password -AsPlainText -Force)
Set-CalendarProcessing -Identity UKLRS01 -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –DeleteSubject $false -RemovePrivateProperty $false -DeleteComments $false
Active Directory
Set-ADAccountPassword –Identity UKLRS01
Enable-ADAccount –Identity UKLRS01
Lync
Enable-CsMeetingRoom -SipAddress “sip:UKLRS01@domain.net” -domaincontroller dc01.domain.net -RegistrarPool lync.domain.net -Identity UKLRS01
Set-CsMeetingRoom UKLRS01 -domaincontroller dc01.domain.net -LineURI “tel:+44203111111”
Set-CsMeetingRoom -domaincontroller dc01.domain.net -Identity UKLRS01 -EnterpriseVoiceEnabled $true
get-CsMeetingRoom -identity UKLRS01 | Grant-CsVoicePolicy -PolicyName “VoicePolicy”
get-CsMeetingRoom -identity UKLRS01 | Grant-csdialplan -Policyname DialPlan
get-CsMeetingRoom -identity UKLRS01 | Grant-csconferencingpolicy -Policyname “Policy”
Has anyone seen this before?
Thanks,
Darren
Jeff, awesome post. The detailed walk-through is very helpful.
Thanks for sharing.
Awesome !
As your previous posts, the information and details are very helpful 🙂
Thanks a lot.
Great blog! Is it possible begin recording a meeting using only the interface available on the Polycom Trio phones? Trying to set up conference room phones and I would like to allow the people that are running the meeting to be able to record the meeting for future playback. So far I haven’t had any luck as it seems recording needs to be initiated from a PC-based Skype install.
That is correct, there is no way to record the meeting from the phone. SfB recordings are captured and stored by clients )not the server) so this is not something that can be performed by a common area device without the storage capacity to save large recording files nor the ability to transmit or export that data after the fact.
When looking at the configuration options for a Polycom Trio 8800, you will find that you can enable and disable recording from the phone to a USB flash device.
Hi Jeff,
Could you please point me to the site or licensing guide that covers your statement about Skype Meeting Room licensing? I had a different interpretation from the Lync licensing guides and didn’t know that there was a more current definition with O365.
…but when that same room mailbox is also configured .as a Skype for Business Meeting Room then a license must be assigned. So there is no advantage to using a regular user versus a meeting room as both require SIP registration and authentication to function on a device. This need for a license also overrides the fact that the Exchange account does not need one as these are one in the same. For example the configuration shown in the second half of this article for creating a Room Account in Office 365 could be assigned an E1, E3, or E5 license…
David, the “Licensing for Skype Room Systems v2” section of this site states the room system licensing requirements for Office 365:
https://support.office.com/en-us/article/Skype-for-Business-add-on-licensing-3ed752b1-5983-43f9-bcfd-760619ab40a7
hi,jeff
I have a question。I deployed a SBA in my branch office。Can users registered to SBA have access to LyncFE?In the case where the SBA user can not communicate with the SAB。I hope you can reply to me by mail. Thank you
I tested a bit, SBA users can not contact the SBA but can contact LyncFE case, still can not login.
Thanks so much for this detailed walkthrough. Since beta I have had a separate resource room and user accounts for the phone. Now with these steps I can consolidate to just a resource room account!
Hi Jeff, I would like to understand the differences, and if possible have your opinion, with a particular scenario.
The matters are related principally to licensing needs when I have:
– SFB OnPrem
– Trio as “Conferencing Room Device” that must be always connected and logged in OnPrem SfB env.
– Exchange Online
AFAIK the Exchange recipients like Rooms or Equipment don’t need license (correct?)
Can I use a CSMeetingRoom OnPremise and mapping it to a Resource/Room mailbox OnLine ?
What about licensing in this case?
Thanks in advance,
A.C.
That should work as the Trio supports on-premises SfB accounts with an Exchange Online mailbox. Exchange Online Resource Mailboxes do not incur an Office 365 license.
Do you know the minimum Office 365 Skype for Business license required to allow a TRIO to join meetings that were created by other licensed users? You show using E1 in your example, but will “Office 365 Business Essentials” level work?
For instance we have many E3 users that have the PSTN Conf bridge Add-On. Would like the E3 users to plan the meeting and invite the conference room (and the TRIO logged in as Room) to be able to join the SFB meeting at the touch of Join Meeting button on the TRIO base unit.
To simply join a meeting the minimum is Skype for Business Online Plan 1.
Once in the meeting with the Trio if you want to be able to invite other attendees during a meeting from the Trio interface then you’ll need SfB Online Plan 2 (to invite other Skype users, local or federated) or optionally a PSTN Conferencing Add-In License to invite PSTN participants as well.
Hi,
Thanks for overall setup explanation.
Question/topic i think is worth to consider.
Let’s say we have two different companies (A,B) using skype room account in O365.
I am wondering how to configure these account and overall O365 enlivenment, that these 2 companies see free/busy room status of each other. Company A see free/busy room status of Company B and vice versa.
Thanks.
That has nothing to do with the account setup itself, you’ll need to configure Federation between the two Exchange environments to share Free/Busy information between them.
Hi, I have one issue about room account with Lync client SDK. When organizer create one SfB online meeting which the permission is “Anyone in the user’s organization can enter”, the room account using SfB 2016 application can join the meeting room with organizer’s admittance. But the room account using Lync SDK in UI suppression mode can’t join the meeting room, even if the organizer already admit. Why room account always stay at meeting lobby, is there any settings I have to modify?
Any reply will be greatly appreciated.
Thanks.
Jeff, we are trying to determine the best practice for deploying a conference room which (in most cases) would include a Polycom Trio device. Should we be creating two resources? One resource for the room, and the other being the polycom unit if they would like to book a Skype meeting or should this all be one resource? One issue that we do have is that we already have many conference rooms created and in use. We are actually in the process of deploying these Skype enabled devices to the rooms. (replacing old analog devices) Your input would be appreciated.
Don’t use two objects. Just enable the existing resource mailbox in SfB as a Meeting Room account.
Hi Jeff,
you had mentioned that users joining a meeting will get a pop up asking them if they are in the room. in our testing we have found that the pop up only displays if you are actually in the room, if at your desk off off site no pop up. it sounded like you said that no matter the location that the invties would get his pop up but that is not the case with us. we were wondering how it knows that we are not in the room?
Sharon, it sounds like something is missing in your testing as not possible for SfB to know if you are physically in the room 🙂 If a single Meeting Room account is currently attending the meeting than all new attendees on supported clients will be prompted as you’ve seen.
Hey Jeff,
Great article!! I’m setting up a few conference rooms with PCs with Polycom 8800 Trios and wanted your thoughts as it relates to user experience and room licensing. I am having trouble separating the “user interface” with the PC (being able to use Office with rights to only their files) with utilizing Skype as the Conference Room user. I think the conference room user equipped with the Polycom must be licensed with Cloud PBX, PSTN and conferencing to be completely effective, as well as E1 or similar to allow the whole thing to work. Okay, with that, assuming the conference room user is logged into the PC, how can the user then log in as themselves to access their own files? thanks in advance.
Check out my latest article if you haven’t seen it: http://blog.schertz.name/2017/08/understanding-office-365-licensing-for-meeting-devices/
Hello Jeff,
Thanks for these detailled description. It opened my mind and made me understand a lot about Surface Hub that I deploy. I wondered if there would be the same behavior in scheduled meeting, as lobby, for Presenters option.
As from my test, I would select who would be presenters during my meeting but selecting a Surface Hub does not pop up on the top of the screen the Present button to share my screen.
I need from my SfB client to give Presentation rights to the Surface hub during the meeting. So the option in outlook does not seem to be properly used. Any idea ?
Thanks,
Cecile
The Surface Hub operates slightly different from the other clients and devices so that may be related to the Hub. I haven’t tested that specific scenario yet.
Jeff, I have problem with the “audio behavior” of skype room accounts. I posted a stackoverflow question. Will it possible for you to share your comments?
https://stackoverflow.com/questions/45796524/skype-for-business-room-account-uisuppresisonmode-audio-behaviour
Jeff,
After testing, it seems like SfB mac clients don’t prompt you as described while the Windows clients do. Think that will be changed soon? I didn’t know about the meeting room account functionality in SfB until I read your blog, and it’s exactly what we’re looking for.
Thank you for posting!
That appears to be a feature-gap in the Mac client today. I have not heard if Microsoft plans to add.
Hi Jeff,
When I try to create the user, I get an error – the domain is federated with adfs.
I can create a new adfs integrated user – but it is not a room account. If I create a room account using the federated domain for the primary email address, I cannot enable the csmeeting room, and still cannot enable the dial in options for pstn conferencing…
Any ideas?
Perhaps I just need a e1 licensed standard user?
If you have a Hybrid SfB deployment you may need to create the meeting room on-premises instead.
Very helpful post! Thank you very much!
Hi Jeff,
Thanks for all your help throughout the years. I have (2) 8800 Polycoms and cannot find the setting/config to allow the meeting organizer to remove a participant from a meeting via Skype For Business Conferencing. For example, the organizer books the conference room (Polycom phone) and joins the meeting from the phone UI in the physical room. They can see all the participants, etc. When they try to remove someone, a message is shown “cannot remove the participant from the call”. Aside from granting them full access to the resource (which I do not want to do), how can I grant the meeting organizer the access to do this?
This should function with the latest firmware on the phones (VVX and Trio). IF the device is registered as a meeting room account instead of a user then it may be prevented by receiving ‘Presenter” rights automatically when joining the meeting. The default meeting options should allow this though, but your environment may be customized differently.
Hey Jeff, you are the fountain of knowledge for all things SfB. I have found your posts to be spot and extremely helpful.. Keep up the awesome work!
Thanks!
Awesome post!
Online meeting software Skype for Business is very useful. My company used and very satisfied.
I’ve gone through the Skype setup for several of the Logitech Skype Room Systems now and I have an oddity with one of them. In the top right corner of the SRS, the room name and phone number are displayed. The issue is that the most recently configured SRS only displays the 4 digit dial extension rather than the full phone number like the others I’ve configured previously. I’ve check the AD object/attributes, Skype meeting room config, O365 room account, mailbox settings etc. and cant seem to find anywhere where the phone number is listed as only 4 digits. Any idea where/what controls the display number?
Thanks in advance!
That may be related to the use of the “;ext=1234” suffix which may be populated on the LineURI parameter of the registered SfB account.
Jeff, this is an awesome post and very helpful, however I am trying to find a solution and Im sure I’m not the only one who has had this issue. The company I work for has several conference rooms and in every room we have a PC and a Polycom Conference Phone, we have been moving away from Go2Meeting and are now using Skype Audio Conferencing. the issue that I am experiencing is when I setup room resource mailboxes for scheduling meetings I need to be able have those resources respond back to the attendants with the Dial in Conference phone number and conference ID. currently all of out AA’s have to setup the Skype Meetings using their assigned information. any help would be appreciated
Sorry, I not following what you are attempting to do. Initial guess is you probably can’t do what you are looking to as the customization of room account behavior is quite limited.
Hi Jeff,
I have some basic questions. We just wanted to equip our small office and test the meeting room functionality. So we thought it should be possible to setup a dedicated PC with a Jabra SPEAK 510 UC desk device.
So I configured our meeting room according to your manual, but how should the room connect to a meeting? For sure we are inviting the room to a meeting, but it does not join automatically.
Isn’t it possible with our POC solution?
Is Enterprise Voice necessary?
SfB is OnPrem btw.
Kind regards,
Christian
The Meeting Room accounts are meant for supported meeting room devices, if you use that account with the standard SfB Windows client than you’ll get some of the unintended behavior you are seeing.
Running Enable-CsMeetingRoom gives me an error;
Object reference not set to an instance of an object.
+ CategoryInfo : NotSpecified: (:) [Enable-CsMeetingRoom], NullReferenceException
+ FullyQualifiedErrorId : System.NullReferenceException,Microsoft.Rtc.Management.AD.Cmdlets.EnableOcsMeetingRoomCm
dlet
+ PSComputerName : admin0a.online.lync.com
Tried over multiple days. Followed your instructions above in order as well. Only difference is that all Global Admins have multifactor authentication and therefore when connecting to powershell you can’t use some of the “msol” type commands. You have to use the alternatives.
Any ideas?
Also, I’ve tried with your exact commands above by using an “app password” to sidestep MFA. Still get the same error message.
I figured out the problem. We require users to provide account recovery information before their accounts can be logged into (email and phone #). This is an Azure setting. The accounts weren’t being fully provisioned (ie. didn’t exist in Skype) until you attempted to login via a web browser and provided that information. An hour later the rooms showed up in Skype (Get-CsOnlineUser) and the Enable-CsMeetingRoom command worked. Might be worth noting that information. I spent days trying to figure out why it wasn’t working.
Hi Mate,
Having the exact same issue, we do not have MFA in place and do not require account information. I am able to login to web browser no problem.
i will leave it an hour to check again, very frustrating.
Cheers
Hi, followed all the instructions and I too am getting the dreaded….
“Object reference not set to an instance of an object.” when issuing the Enable-CsMeetingRoom -Identity $rm1 -RegistrarPool $pool -SipAddressType EmailAddress, which is a bit annoying….
I’ve logged into all accounts via office.com no problem and I’ve left it an hour but still I’m getting the same problem.
Any ideas anyone ?
I can leave it a bit longer but it is incredibly annoying.
ideas gratefully received.
I’ve noticed that accounts appear to be moved to different pools automatically and can cause problems setting up new meeting room. The trick I’ve used is to create a new regular user account and enable it for SfB Online. Lookup the Registrar pool for that new account, and then use that pool FQDN in the Enable-CsMeetingRoom cmdlet and it should work.
We are considering adding some conference room phones to O365 with SfB Online. Everything is online. I’ve read many blog pages but still have some general questions about how this actually works. I would really appreciate your help.
1. Is a Meeting Room account the same thing as a Room Systems account?
2. I understand that when adding a conference phone to a room, you need to create both a Room resource account for calendar functionality/scheduling, but because these accounts don’t have login credentials or a SIP URI, you also need to create either a User account or Meeting Room account for the device itself. You can’t simply use a User account or Meeting Room account by itself because they can’t automatically accept calendar invites like a Room resource account can. Do I understand this correctly?
3. When you schedule a meeting do you have to invite both the room and device account to the meeting? How do you start the meeting unless the device is the organizer? Or how does the device join the meeting so it can be used by the organizer?
1. Depends on the context, but really just different terminology for the same concept. A special account configuration that is not the same behavior/configuration as the standard user configuration.
2. There is only ONE account for all of this. That single AD Account is enabled for Exchange (which can be as a user mailbox or resource mailbox) and then enabled for SfB (which can be the normal user process or the Meeting Room process).
3. Because this is ONE account, then no. Only a single mailbox exists in the address book. The device’s calendar IS the room’s calendar. It’s the same mailbox.
Hi!
We are running SRSv2 3.1.104 on Surface 4 and Logitech dock. Worked great until we had to disable Legacy Authentication on the Exchange Online and Azure AD. We are running On-prem Skype for Business.
We can sign in and use the Room with all the Skype functionality, but it can not connect to the calendar. “Cannot fetch calendar”.
If I sign into the Skype Room account on a standard PC-klient I can log in to SfB and get prompted for user and pw for the Exchange connection. This works.
Does the SRSv2 support Mordern Authentication against Exchange online? If so, what has to be done on the Skype-server\ SRSv2-client?
The logs read error on Autodiscover and EWS.(but works from the surface on a standard Skype-client.)
Hope you got some tips here.
Brg.
Eirik
SRSv2 does support Modern Authentication and there is nothing to configure, but I don’t know if it’s applicable only to Skype/Teams and if Exchange is only using Basic Auth (although that seems unlikely given that Microsoft has created this new themselves).
Hello Jeff
We have ordered 4 surface hubs and looking to configure them, I was wondering if you have a step by step guide to do this.
Now our environment is slightly different, We have one forest, on- prem, Exchange and lync 2010 (I know this is not supported by Microsoft but I was just wondering if you know of a work around to help configure this.
Hi Jeff,
We have on prem Lync 2013 and all Skype users are in Office 365. The Trio Meeting room accounts are on prem. Do you know what reports we could create to somehow monitor the performance? Monitoring is likely to be not supported for hybrid with no Express Route.
Thank you in advance for your time!
The only thing I found is https://www.gsx.com/products/gsx-monitor-for-office-365-monitoring but if you have any other ideas will be highly appreciated!
Thank you!
Hi.
Thank you Jeff for you post.
I have one question. Who user can create meeting behind of meeting room with dial-in number and link from meeting room?
User don’t have license for conference number in Skype for Business Online, but meeting room has all license.
When user create meeting and choose meeting room as location. He send personal dialing number and link for connect to meeting. So, Who user can create meeting behind of meeting room with dial-in number and link from meeting room?
I’m not found way for issue.
The user which creates the meeting invitation must be licensed, not the rooms (or any other users) who may be invited to the meeting.
Wondering if you have ideas for SMR creation issue we’re having.
Great article, thanks for the details very helpful!
We have Hybrid Skype environment (small on-prem TB retired, most on O365 S4B) and attempting to create a meeting room resource. Successful for all above commands except:
———————
Enable-CsMeetingRoom -Identity $newUser -RegistrarPool $pool -SipAddressType EmailAddress
———————
We are getting the following error:
“Cannot move user in enable operation. Use the Move user cmdlet instead.”
New resource created in O365. Not really attempting any move action per se.
Google searching turned up nothing of consequence, hoping you have ideas.
Thanks!
Marc P
I’ve seen that error in PowerShell before when dealing with SfB Online but it seems intermittent and goes away after some time. I assume it’s some replication issue in the cloud.
Hi Jeff,
I’m struggling with getting some Polycom Trio 8800’s working with our fully on-prem Exchange 2013 and SfB 2015. I can get them logged in as a simple room mailbox account, but once I add their account into SfB server and follow the steps to enable it as as LRS account the Trio will no longer login at all, and the account disappears from SfB server. I have tried this by converting an existing room mailbox and with a fresh account created by using the PS commands in another of your blog posts.
Can you please just confirm I’m right in thinking that: –
1. I need to have the Trio’s (or any other devices) configured as LRS accounts in order for them to show up under rooms when scheduling a SfB meeting (none of the ordinary room mailboxes currently do)
2. Is the Polycom Trio 8800 actually compatible with using as a LRS account resource? When I search the MS lists it does not appear and lists devices which all have screens. We have the Trio kit which comes with Logitech webcams etc.
Thank you
A Meeting Room account, while preferred and is compatible with all Polycom devices, is not required. You would get the same functionality from a user account, except for the lobby behavior and the ‘are you in the room’ prompt I’ve covered in this blog. But yes, you need to use a ‘Room’ Resource mailbox if you want it to appears as a ‘Room’ in the Exchange GAL.
Jeff,
Created a room and calendar using a method above in 365.
1.When we dial into SfB meeting by using meeting Dial in number it doesn’t connect with Video and shows as a guest in Skype for Business with room name and audio only capabilities.
2. When we click on Join meeting button on a Polycom joins correctly with video and audio.
3. Is there an option needs to be triggered so Skype would recognize that Polycom Trio is joined when dialed via phone number, i have seen this working in on-premises scenarios before?
Thanks,
Serg
Dialing the audio conferencing number will only place a PSTN call, thus the connection will be audio only. The Join button needs to be used to join via the Conference URI which allows all modalities.
Whenever I execute Enable-CsMeetingRoom I get the following error:
Cannot move user in enable operation. Use the Move user cmdlet instead.
All of the steps up to this one complete without issue. I was able to add one online meeting room account. This is happening on all new attempts to add an online meeting room account.
Appreciate any assistance you can provide,
Mike
Hi Jeff,
We too are getting this same cannot move error on the Enable-CSMeetingRoom command, any ideas?
Regards,
Imran
You have to wait for some time to run this command after creating a new account. It’s typically around 15 minutes but sometimes it’ll take longer, sometimes less.
Hi Jeff,
We have waited nearly 24 hours and ran the Enable-CSMeetingRoom command again but are still getting the ‘Cannot move user in enable operation’ error, any further advice would be greatly appreciated.
Regards,
Imran
The source account you are using may be in a different pool. Try looking up the Registrar from a newer user account. Also updated instructions can be found on this newer article: http://blog.schertz.name/2019/02/creating-microsoft-teams-rooms-accounts/
I have following scenario, do you have any suggestions to achieve this?
– SFB OnPrem
– Requirement of moving existing sip and EV enabled (non mailbox enabled user) international VC rooms to resource mailbox with change in sip URI to be used on polycom or Audiocode phones.
– Exchange Online
Simply use Resource Mailboxes in Exchange Online (new or migrated) and leave the account enabled for SfB Server on-premises.
Hi Jeff:
Your articles were sent to me via a PolyCom reseller. I’d appreciate your advice on how to move forward.
I am new to my org. My org has 4 PolyCom Group Series devices. 2 in Washington and 2 in London. 310 and 500 series.
They are setup in a closed loop via the native PolyCom interface to video call each other via saved favorites. No integration with Skype has been attempted. In fact, only one of the units has a Polycom / Skype interoperability license.
I want to upgrade one of the less frequently used Polycoms with a Touch Screen and Skype Interoperability license and see if I can get it to work with SFB.
My question is this – if I enable the SFB interface on the unit – does that do away with the previously saved favorites in the native Polycom screen? I don’t want to be in a position where I have to configure all 4 of the devices at the same time.
While the existing system is quite closed – it works instantaneously. I don’t want to ruin that ease – by adding SFB capabilities.
I’ll probably have lots more questions beyond this, but I’ll start here. Thanks.
You can register via SIP to SfB Server (or SfB Online) and still place H.323 calls via another registration, or simply direct to other rooms via IP/FQDN. So you’ll need to (1) make sure your programmed favorites are using H.323 and not SIP addresses and (2) do not enable the “Skype Mode” interface on the Touch Screen as that will remove the favorites menu. Even when the Touch Panel is not in Skype display mode the system will still continue to work with SfB.
I apologize for my lack on knowledge here. The favorites are currently setup IP address to IP address. Am I correct when I interpret your answer as that I can leave that as is?
What I didn’t realize is that you can call someone via IP or that you can call someone via SIP or that you can call someone via H.323 extension number? This is all new to me.
[…] article revisits the topic of creating accounts which are used by Microsoft Teams Rooms (MTR), formerly known as the […]
Hi Jeff,
Great post again just like all others!
Let me have a question regarding calendaring on Group Series.
We are using O365 with Skype for Business online. Created room resources with necessary licenses assigned at O365 admin portal. Codecs are running on firmware 6.2
SIP and directory registration are just fine but Group Series codecs won’t get registered with calendar at all. Setup is done based on your previous post.
Are you aware of such issue?
Is there a Polycom/MS document out there which describes how to setup room resource calendar in terms of permissions and other?
What is the user-agent string that the Polycom devices use to connect to EWS?
Asking because EWS filtering is enabled in our O365.
Thank you in advanced!
Thanks for your superb article, even HP official website is not accurate. I like all the detailed explanations. Great work.
Hi Jeff
Is there any way to find if Skype conference room is being utilized for Skype meetings. There are no data available on HOW TO.
Jeff is there a way to suppress the prompt “are you in the Skype room?” On a non Skype room system?
The prompt comes from the account configuration, not the device itself. Use a regular user account instead of a room account to remove that prompt.
We have a Room mailbox account and the for some meetings the surface hub account gets into virtual lobby and there is no option to allow the account to join the meeting. I have setup the options in my meeting to allow anyone with no restrictions but the behaviour is same.
When some users create the meetings then it works but for most of the users meetings the surface hub gets into the lobby. Any pointers where could be the issue?
Not sure here as even if a MeetingRoom configuration is used in Skype it should still go through the lobby when the meeting is set to allow everyone.
[…] guidance related to using the MSOnline PowerShell cmdlets outlined having to separately install the […]