Common Area Phones in Microsoft Teams

April 29, 2020 by · 101 Comments 

The deployment and administrative experience for a Common Area Phone (CAP) across Microsoft’s UC platform has changed over the years as it has matured from an on-premises software release with Lync to hybrid offerings of Skype for Business only to eventually be replaced by the cloud-only Microsoft Teams solution.  Generally the ideal of a common area phone is just that: a phone located in a shared space which only needs to provide the ability to place phones calls to other users and/or phone numbers.  These are not meeting devices.

Thus a core trait of the common area phone scenario is providing basic calling capabilities and not much of anything else.  Essentially the requirement is just for ‘dial tone’ to facilitate placing outbound calls to other users in the same organization, other organizations, PSTN numbers, and/or emergency services.  Common spaces typically don’t have calls coming into them as usually no one would know who is in that space at a given time, less anyone at all.  These are phones which may be located in areas like break rooms, front lobbies, shared spaces, warehouses, factory floors, etc.  They are not tied to a specific person and thus features like contacts, voice mail, or a calendar are not really applicable.  Often the baseline requirement is for a phone that will always be registered so that emergency services can be dialed without issue or delay.  Then depending on the configuration and licensing of the account assigned to the phone various additional features could be made available, like searching for other users or placing non-emergency calls to local or even international numbers.

Throughout the Microsoft UC journey the common area phones have had a very deliberate distinction that there is no mailbox available to them.  This is the main reason that they should not be deployed in a typical conference room as without a mailbox there is no calendar, and without a calendar there is no way to invite that device to a scheduled meeting.  It would still be possible to manually dial into a meeting if the invitation includes an audio conferencing number, but the invite would still not be viewable on the phone itself to see the dial-in information.  In general common area phones should simply not be deployed in a space where users would need to join meetings.  Devices in those spaces should instead use a meeting room account configuration.

Background

Back when IP phones were first introduced with Office Communications Server a common area phone option was not yet available.  No account configuration was provided nor any phone models designed specifically for that use-case.  When Lync Server 2010 was released Microsoft added a special account configuration to allow basic calling features on a phone without the unneeded overhead and licensing costs associated with voice mail or other mailbox-related features included with a regular user account.  This configuration leveraged an Active Directory Contact object which could not utilize traditional authentication methods, nor could they be mailbox-enabled. Thus Microsoft created PIN Authentication for Lync Server to provide a way to sign into a phone using contact objects.  At the same time Polycom also released an IP handset designed specifically for the CAP scenario: the CX500.  This phone was slightly smaller than the standard phone designed for regular users and did not come with the USB-B port required to leverage the ‘Better Together’ pairing capability with a PC which allowed for basic user authentication.  This limitation meant that only PIN Authentication could be used on the phone.

The same capabilities and behavior were included in Lync Server 2013 and Skype for Business Server 2015 so there was no change to how common area phones worked with on-premises deployments.  There was a shift in the device options though as newer phones came to market leveraging Microsoft’s 3rd Party Interoperability Program (3PIP) and there were no longer any models built only for CAP use-cases by any of the partners.  The idea was that all phones in their product families could be signed in using any of the supported authentication models so in essence any phone could be a common area phone or an executive desktop phones.  Typically the lowest-cost handset, like the Polycom VVX200, would be selected to pull CAP duties.

A completely different approach was used for common area phones with Skype for Business Online though.  The method used for on-premises server deployments required a specific DHCP configuration for PIN Authentication to function which meant that common area phones could only be located on internal corporate networks or across site-to-site VPNs.  That authentication model could not apply to the cloud so a new solution was created for Skype for Business Online called Web Sign-In.  This addressed the main benefit of PIN Authentication in that it allowed users to sign into a phone without entering their user credentials (username and password) directly into the phone.  With PIN Authentication a user simply entered their phone number or extension and their PIN directly onto the phone via the keypad.  In contrast the Web Sign-In model a provides a login option on the phone which displays a unique code and instructions to go to a specific website on any other device like their computer or smartphone.  There they would enter their own credentials (if not already signed-in on that workstation) as well as a one-time use code provided on the phone’s screen.

Because capabilities in Skype for Business Online are based on Office 365 licenses more than the actual account configuration itself then Microsoft also added a new Common Area Phone license option which should be assigned to a regular user account; there is no special CAP contact user configuration available in the cloud like there was in the server platform.  This new license provides a more cost-effective option than purchasing the Skype for Business Online Plan 2 standalone license in addition to a Phone System (formerly Cloud PBX) add-on license. It is also much cheaper than using an Enterprise license on a phone which does not need 99% of what an E1 or E3 license includes. Note that there is no Exchange license provided which continues the theme of no mailbox-related capabilities for a CAP account.

image

With Microsoft Teams the same approach and the exact same Common Area Phone license is used.  Unlike with a Meeting Room license, Intune is not included and would need to be purchased as a separate add-in if these devices would need to also be managed from Microsoft Endpoint Manager.  (An Intune license is not required to manage devices from directly within the Teams Admin Center.)

Based on all of the detail provided thus far then the most important concept to understand here is what actually defines a Common Area Phone in Microsoft Teams?  The answer is multifaceted as it is not just a specific phone model, or user account type, or even the license applied to the account.  Minimally what makes a Common Area Phone is a phone policy assigned to a user account which drives the user experience on the device itself.

To illustrate this primary difference the three possible user experiences the phones can provide today are shown here.

  • The first is the default User mode which provides Calls, Calendar, and Voicemail screens used by regular user accounts.
  • The second is the Meeting mode which limits the phone to the calendar view, yet still allows for placing calls.
  • The third is the Common Area Phone mode which only provides phone calling features.

image      image      image

Note that any user account can be placed into a CAP experience by applying the appropriate policy, but if a user account assigned a Common Area Phone license is left to use either the default user mode or configured with the Meeting mode then the phone will display various errors due to lack of mailbox availability.

Thus, using a Microsoft-supported user account configuration, granting the correct phone policy, assigning a cost-effective license, and optionally limiting calling features are what really makes for a proper Common Area Phone deployment.

The remainder of this article will walk through configuring a Microsoft 365 tenant and then creating single user account to enable the Common Area Phone experience on a native Microsoft Teams phone.  Note that this is applicable to both Desk Phones and Conference Phones.

Tenant Setup

Before setting up a user account the tenant must have available licenses and an IP phone policy configured to enable the CAP phone interface.  The Microsoft 365 Admin Center and Teams Admin Center (commonly referred to as the ‘TAC’) are utilized throughout the configuration steps whenever possible, only reverting to using PowerShell for actions which are not currently available in any online admin center.  All PowerShell cmdlets used in this article are currently included in the Skype for Business Online PowerShell module.  (Nearly all of the steps shown in this article could be performed using PowerShell cmdlets if desired.)

Acquire Licenses

While the Common Area Phone license is ideal here, as explained earlier, it is not a requirement.  Any license(s) which include(s) Microsoft Teams and Phone System are sufficient.

If the Microsoft 365 tenant already includes the desired licensing then skip to the next section to begin configuring a user account.

  • In the Microsoft 365 admin center browse to Billing > Purchase services and then search for ‘Common Area Phone’ which should then appear under the Collaboration and communication section.
  • Select the Common Area Phone plan and then choose from either the Buy or Get free trial (if available) options.

image

  • Complete the ordering process for whichever option was selected and then go to Billing > Licenses to verify that the new licenses have been applied to the tenant.  (Normally this should apply immediately to the tenant but it can take a few minutes before seeing them listed.)

image

    Configure Phone Policies

    Simply assigning a Common Area Phone license to a user account will not apply the Common Area Phone experience as licenses only control what online services and features are available to the account.  A custom IP phone policy must be setup in the tenant and then assigned to this user account in order to control the user experience on any phone it signs into.  These policies are currently only configurable via PowerShell and are assigned to user accounts (not to devices) at the global level (by default) or the user level.

    Import-Module SkypeOnlineConnector      
    $sfbo = New-CsOnlineSession –UserName ‘admin@domain.com
    Import-PSSession $sfbo

    First determine if a common area phone sign-in policy has already been created in the tenant.

    • Execute the Get-CsTeamsIPPhonePolicy cmdlet to list any policies currently defined in the tenant.

    Get-CsTeamsIPPhonePolicy

    image

    The example results above show the default configuration for M365 tenants and is likely what will be seen if this is the first time going through this process.  Over time new parameters may appear in this policy as Microsoft adds more capabilities into Teams.  For example, the Hotdesking parameters seen in the output above did not exist at the time this screenshot was captured for a previous article.

    If a custom user policy with the SignInMode set to CommonAreaPhoneSignIn already exists in the tenant then skip this next step as there would likely be no need to create another policy.  If an appropriate custom policy does not yet exist though then one should be created as it is not advisable to change the existing global policy’s SignInMode parameter.  Doing so would lead to all users in the entire tenant by default being forced into the same limited CAP experience on any Teams IP Phones.

    • Create a new policy using the New-CsTeamsIPPhonePolicy cmdlet which enables the CommonAreaPhoneSignIn behavior.

    New-CsTeamsIPPhonePolicy -Identity ‘CAP’ -Description ‘Common Area Phone User Policy’ -SignInMode CommonAreaPhoneSignIn

    image

    There are additional parameters on this policy which can be customized if desired.  If common area phones are to be placed in spaces where non-employees may have access to them then it might not be ideal for them to be able to search for other users in the environment by name.  Or a phone might need to always be signed in with a specific user and phone number and never as a different user, so the hotdesking option should be hidden.  In Skype for Business some of these options existed and some could be controlled, but typically only at the global level.  With user-based phone policies available in Teams it is now possible to create multiple policies with different parameter configurations for a much more granular level of control.  For example, one policy could be created with CAP and search enabled for phones located in internal office spaces while another with only CAP enabled and with search disabled for phones in unsecure locations.

    As an optional example this step will disable user search by removing the Search icon from the CAP interface.

    • Edit the phone policy created above using the Set-CsTeamsIPPhonePolicy cmdlet to change the default search behavior.

    Set-CsTeamsIPPhonePolicy -Identity ‘CAP’ -SearchOnCommonAreaPhoneMode ‘Disabled’

    Configure Call Park

    A feature available by default to any phone sign-in modes is the ability to retrieve a parked phone call.  Yet in order for that behavior to actually function the Call Park service must first be enabled in the tenant as it is disabled by default.

    • To enable call parking go to the Teams Admin Center, browse to Voice > Call park policies and edit the Global (Org-wide default) policy.

    image

    • Turn on the Allow call park setting and click Save.

    image

    As discussed earlier with the phone policies it may not be desired to change the global default behavior on the call park policy, so a custom policy could be created here instead.  If that route is taken then make sure to assign that policy to the user account in the next section.

    Configure Calling Policies

    Another area worth reviewing is controlling calling policies for common area phone users to prevent unwanted behavior when a phone is not assigned to a specific person.

    image

    • Enter a name for the policy (e.g. CAP), add a description if desired, select the preferred options, and then save the policy.

    image

    Note that the options selected above are simply used as an example and are not necessarily indicative of an exact configuration applicable to a Common Area Phone.

    User Setup

    Now that the tenant has been configured a user account must be created and/or configured.  For the purposes of this article a new user account will be created.  If an existing account in the tenant is to be used instead then make sure that it is a user account and not a resource account.

    If a Common Area Phone license is assigned to a user account which previously was assigned a user license that included Exchange Online (like an Enterprise E1 license) then their mailbox will be automatically disabled, triggering that account to be removed form the Global Address List and preventing access to the mailbox, calendar, etc.  The mailbox is not deleted, it is just disabled.  If the assigned license is reverted back to something which includes Exchange Online then the Exchange configuration will be restored as will access to the mailbox and its previous contents.

    If a Common Area Phone license is assigned to a resource account then the mailbox will not be affected as resource mailboxes are allowed to be mailbox-enabled with no additional Exchange licensing.  While it is technically possible to assign a Common Area Phone license to a resource account this is not supported by Microsoft.  Their guidance is to use a Meeting Room (or an equivalent) license instead if the device requires use of an Exchange Online mailbox.

    Create User Account

    • Create a new user account in the tenant (e.g. cap@msteams.net).

    image

    • Select Common Area Phone license from the Licenses section.

    image

    Under the Apps section select Common Area Phone in the ‘Show apps for:’ menu to confirm which services are currently included in the Common Area Phone license. 

    image

    Assign Phone Number

    Technically this step is optional as PSTN calling is not required for a Common Area Phone to function as it still could be used to only place internal calls to other users and/or numbers within the same organization.  But given that is a fairly limited use-case then most likely PSTN connectivity will be included for a Common Area Phone.

    The two possible options for PSTN connectivity in Microsoft Teams are Direct Routing and Calling Plans.  The configuration steps for these differ but the individual processes are no different than when used to assign numbers to regular user accounts, so proceed to do so with the method which is applicable to the tenant at hand.  As an example this article will use Microsoft Calling Plans in the following steps.

    • Add an available calling plan license (e.g. Microsoft 365 Domestic and International Calling Plan) to the account.

    image

    • In the Teams Admin Center, browse to Voice > Phone Numbers, select the user account, and then click Edit under the Account > General Information section.
    • Assign an available Phone Number and Emergency Location then click Apply.

    image

    Assign User Policies

    Now that the account has been created the next step is to assign the IP phone policy created earlier so that the desired Common Area Phone user experience is provided when this user signs into any phone.  Without performing this step the user would leverage the global IP phone policy configuration which by default uses the standard user experience.  For this user with a Common Area Phone license that would mean that the phone would display the additional calendar and voicemail tabs but with error messages on them.

    • Using PowerShell run the Grant-CsTeamsIPPhonePolicy cmdlet to assign the CAP phone policy to the new CAP account (e.g. cap@msteams.net)

    Grant-CsTeamsIPPhonePolicy -Identity ‘cap@msteams.net’ -PolicyName ‘CAP’

      If a custom Calling policy was created in the previous section then that should also be applied to the user.

      • Using PowerShell run the Grant-CsTeamsCallingPolicy cmdlet to assign the CAP calling policy to the new CAP account (e.g. cap@msteams.net)

      Grant-CsTeamsCallingPolicy –Identity ‘cap@msteams.net’ –PolicyName ‘CAP’

        If a custom Call Park policy was created in the previous section then that should also be applied to the user.  (In this article the default Call Park policy was leveraged so this step was omitted in the example configuration.)

        • Using PowerShell run the Grant-CsTeamsCallParkPolicy cmdlet to assign the custom call park policy to the new CAP account (e.g. cap@msteams.net)

        Grant-CsTeamsCallParkPolicy –Identity ‘cap@msteams.net’ –PolicyName ‘CAP’

        • To confirm the policy assignment(s) use the Get-CsOnlineUser cmdlet to view the account configuration.  (It may take a few minutes before the changes applied above will be reflected.)

        Get-CsOnlineUser -Identity ‘cap@msteams.net’ | fl Teams*Policy

        image

        Sign In

        Now that the environment and first user account are configured the account can be logged into a Teams phone to see the resulting user experience.  A Poly CCX 500 IP phone was used in the following example.  Be aware that if the previous configuration was just completed then it may be required to wait several minutes before signing into the phone as all of the new policies and settings may still need to completely replicate throughout Microsoft Teams. 

        • Sign into a phone using the configured account (e.g. cap@msteams.net)

        image

          Once the process completes and any welcome screens are dismissed then the primary user interface will be displayed which should reflect the Common Area Phone interface outlined at the beginning of this article.

            image

            If the expected results do not appear then sign out and back into the phone again after additional time has passed.

            Note that the main screen shown above only shows the Call Park button and does not include the magnifying glass icon for the Search feature which was disabled in this example configuration on the IP phone policy currently assigned to this user account. 

            Sign Out

            To prevent a phone from simply being signed out by anyone and thus losing the ability to place calls the Sign Out option is hidden in an area only accessible by administrators.  (This behavior is true for both Common Area Phone and Meeting interfaces.)

            • Tap the Hamburger menu icon in the upper left corner and then select Settings.

            image     image

            • Select Device Settings > Admin Only and then enter the device’s administrator password.

            image     image

            • From the Admin Only menu select Sign Out and confirm the action.

            image     image

            About Jeff Schertz
            Site Administrator

            Comments

            101 Responses to “Common Area Phones in Microsoft Teams”
            1. Nate says:

              Hi, Jeff. I noticed in your screenshots that you were able to update the CCX 500 to the latest firmware with favorites displayed. How were you able to make this happen? Our CCX 500 phones all show “up to date” in the Team Admin portal, with no information published anywhere on how to force the update. Any help you can provide would be great. Thanks in advance.

              • Jeff Schertz says:

                The CCX firmware supporting these new features it not yet publicly available. It’s under internal testing and will be posted to the Poly support site and Teams Admin Center soon.

            2. Jarrod Beckman says:

              Great article, Jeff.

              I’m assuming that you must use Teams certified phones for any of this to work? A VVX201, for instance, would not work in this case (I’m assuming the 3PIP gateway scenario would not apply)?

              • Jeff Schertz says:

                You can still use the CAP license and user configuration with a Teams account and the VVX will register via SfB Online to leverage the 3PIP gateway. The phone interface will obviously not look anything like the native Teams client and the Teams phone policy will not apply.

            3. Szymon Bochniak says:

              Great article! It is extremely difficult to find any information about detailed aspects of Teams Calling services. Thanks for sharing.

            4. Jeff Brown Tech says:

              Hi Jeff, great article as usual. Are commands like Get-CsIPPhonePolicy & Get-CsUCPhoneConfiguration now legacy commands or only for Skype for Business Online IP phones? Just curious if settings in those policies affect Teams phones. I suspect not but wanted to get your insight.

              • Jeff Schertz says:

                Those are legacy cmdlets applicable only to devices registering to Skype for Business Online; they have no relation to the new Teams phones. So if you put a CCX phone into Skype base profile it’ll be no different than a VVX or Trio and those older cmdlet policies settings will still apply. If the CCX is in Teams base profile though then it’s communicating directly with Teams and only the new CsTeams* policies are applicable.

            5. Robert Denman says:

              Is there anyway to show the phone number on the CAP phones?

            6. James says:

              Great article, thanks for the insights Jeff!

            7. Christian Redgewell says:

              I just wanted to check if MFA is supported when signing in initially? With or without MFA enabled do you still have to sign into these phones once every 90 days or can you extend that token time? You specify that an Intune license is an additional requirement, so they can still be managed with compliance policies in Intune as well?

              • Jeff Schertz says:

                The Intune license is not a requirement so you don’t have to add it if you don’t plan to use Endpoint Manager to manage anything on them. You can use Microsoft’s built-in MFA (like phone call/SMS) but I don’t know if any other MFA platforms are officially supported. I know I’ve seen platforms like Cisco’s Duo or Okta have worked when signing in.

                • Ted Bass says:

                  Jeff,
                  We have a client with around 20 ccx 400s deployed as CAPs. We are experiencing that they have to be signed out and back in every 90 days. Is there a way to prevent this?

            8. David Graham says:

              Hi Jeff,

              Your article is so good. I logged a premier call to work out and issue with Common Area phones setup, Microsoft do not have any doco, and pointed me at this blog post. I am curious what licence is actually required for the CAP for Intune? Microsoft said I needed to apply an E3 which seems crazy to me. Is there a way to avoid Intune and just manage with Teams?

              We are struggling with Auto enrollment within Intune, and our CCx 400 phones show up in Teams, but not the CCX 500, very weird. Anyway, great post.

              • Jeff Schertz says:

                Thanks. I don’t know why 9 months later this is still not documented by Microsoft.

                The CAP license does not include Intune so you’d have add this separately or use a more expensive license (E1 would be cheaper than an E3, but still overkill).

                Personally though I just ignore Intune altogether for Teams IP phones as it doesn’t really add any value. The Teams Admin Center and PowerShell cmdlets provide all the possible management options. Intune is really for managing personal Android devices and I’ve yet to see a reason for using it with certified Teams devices, other than dealing with unblocking them (if needed).

            9. James says:

              Is there a remote deployment methodology?

              If I have 1,000 common area phones spread over multiple locations having to touch each one in order to provision it, well it’s not a great story,

            10. Chris Bailey says:

              In my speed dial list in my Teams client I have a PSTN number saved with a name, when I sign into a CCX it shows the number but no name – do you think the phone app will ever mirror the client experience ?

              • Jeff Schertz says:

                I think this may have changed with the new People app included in the latest Teams client version which will be supported on the CCX in the next qualified release targeted for next month.

            11. Andrew says:

              Hey Jeff,

              Just joined my company which uses a few different Trio devices, and your articles have been amazing for gaining some insight to their setup. A question if I may…we are in the process of migrating some Trio 8800’s (latest firmware) over to Teams but are struggling with the best method of account/device setup. All the old hands have left, and documentation here and on the web seems scarce. Essentially, we are setting up the devices with new users (internal account clean-up), assigning it either an E based licence, or a common area phone/meeting room licence plus a calling plan. The devices are in a shared mode, and things appear to function when logged in… the staff though want the devices listed as rooms (i.e. Meeting Room 12), and so bookable with a confirmation email through Outlook etc. What would you suggest is the best method for achieving a shared (Teams) trio phone system, with an accepted/denied calendar setup please? Any help would be greatly appreciated!

              • Jeff Schertz says:

                Use the same account setup approach as you would for a Microsoft Teams Room system by creating a Room mailbox but enabling the user and tweaking the CalendarProcessing settings accordingly.

            12. Shanuj Patel says:

              We purely just want to have an IP phone in the meeting room to make and receive calls, therefore we are looking to assign a CAP license and a calling plan.

              What type of number can be assigned to a CAP device?
              Is it user number or Service number? As we are porting out old numbers in and need to specify during the porting process.

              • Jeff Schertz says:

                You don’t assign numbers to devices, you assign numbers to users and then simply login on the desired device with that user account. Thus, just setup a regular Teams user account, enable it for Enterprise Voice, and then apply a User Sign In mode policy set to CommonAreaPhoneSignIn to that account. When they sign into the phone only the CAP experience will be provided.

            13. John Bamgboye says:

              Great article Jeff. Just wanted to check around dial plans for a Teams common area phone account signed into a VVX. Is the global tenant dial plan picked up by default? Does the VVX dialplan.1.digitmap need to be manually changed to the Tenant SimpleName (something like DefaultTenantDialPlan)?

              Many Thanks

            14. Mike says:

              Hello.

              I setup account and signin on VVX, I can make call in but can’t call out 🙁

            15. Steven Dunker says:

              Been trying to setup CAP for a while and have case open with MSFT but not making a lot of progress. Basically I am not able to assign a number to the user account with CAP license. One thing that is not clear to me in your example you added a domestic calling plan to the account. My other user accounts that just have 365 Biz Voice do not have a calling plan associated with them, I assume that is because it has a Phone System license.

              Thoughts?

              • Jeff Schertz says:

                The account can be setup no differently than a regular user in your environment other than the sign-in mode. It is not clear to me if your other users have PSTN calling capabilities or not though. A ‘Phone System’ license is not enough for PSTN access as the account also requires either a Microsoft Calling Plan or you need to have Direct Routing setup correctly for the account.

            16. Marc-Andre Drouin says:

              Great article!

              Any suggestions to configure a Common Area Phone or a generic user account as a Intercom system to allow people in a building? I would like to set a phone with a list of “Favorites” that would communicate with specific people in the building. Instead of having a receptionist, the client would come up to the CAP and press on a option within the Favorites list.

              thanks,
              Marc-Andre

            17. Dan says:

              Excellent article, as always. Makes you think why MSFT can’t come up with something like this, so kudos to you Jeff.
              One thing I’m not entirely clear about is with Intune. You mention that Intune is not required for CAP, and I agree. But how can I prevent the device from being enrolled in Intune in the first place. In my environment the device keeps on enrolling itself, which leads to failure due to non-compliance etc. I followed these hints but have had no success so far: https://techcommunity.microsoft.com/t5/microsoft-teams-blog/microsoft-teams-ip-phones-and-intune-enrollment/bc-p/1352257/highlight/true#M5422
              I was wondering if there is a more elegant way of keeping the device away from Intune.

              • Jeff Schertz says:

                That’s a good question as I can’t get any of my devices to appear in Intune in my own tenant and I have not identified why that is as the tenant is licensed appropriately. So far my experience is that the Microsoft Endpoint Management (MEM) + Intune portion of the Teams Android-based devices is a bit of a mess. In my opinion Microsoft should just omit all certified Teams devices from Intune (other than the Windows-based MTR) as it’s causing more problems than any potential benefit. The Android policies in MEM are really meant for smartphones and there’s nothing in MEM that really makes sense for handling IP handsets.

                • Dan says:

                  That’s interesting, as on my tenant I can’t keep the phones AWAY from Intune. When logging in with a regular user, the phone gets registered as a (non-compliant) Android device, but otherwise works as expected. However, when using the CAP-enabled account I created as per your instructions, it tries to register in Intune for a few minutes and then reverts back to the sign-in screen. I explicitly enabled the CAP-account as an Intune user, but it doesn’t change anything..

            18. Sergio F says:

              Does anyone know if this phones will have a screen lock feature at some point?

              • Jeff Schertz says:

                Phone Lock is currently available on the CCX phones, but it’s only applicable to User Sign-in mode. If you are using a phone with the CAP or Meeting experience then locking is not supported.

            19. ¨Brecht Simons says:

              Anybody has an idea if it’s possible to provision VVX phones with 3PIP via the Poly RPRM?

            20. Jeff,

              Amazing work. I have followed your guide and everything has worked out amazingly! The only problem I have is that is can receive calls from the PSTN, but I can’t dial out. It appears this CAP is using both MS calling plans and my direct routing.
              From the Power Shell Logs it shows this user having both MCOPSTN1 and MCOEV which is causing my Voice-policy to use business voice. I am trying to find documentation on how to 1) switch from MS Calling Plans to Direct Routing, or 2) How to provision/manage a user who has both Calling Plan & Direct Routing.

              Thanks again!

              • Jeff Schertz says:

                I don’t think you can leverage both a Calling Plan and Direct Routing at the same, you have to pick one approach and configure the account accordingly. You’ll still need the Phone System license with either approach.

            21. Genga says:

              It’s great article ! I’m bit unclear, Can CAP accounts be created on-prem AD and synced to cloud ? Also, does Teams support PIN based authentication to login CAP phone ?

            22. Sonny says:

              Hi Jeff do you know if there is a way to have call forwarding made available for a CAP license on the device itself?

              I’m using a CCX400 and 500 and cannot see it as an option on the phone, but if I sign into the Teams client on a Windows machine I can set it up that way. Preference would be to do it on the phone though.

            23. Sonny says:

              Hi Jeff, great article as usual! We just configured a bunch of CCX400’s with the CAP license today but I’ve had the realisation that there is no way to save the password on the device. Do you know if there is a way to keep them signed in? I asked Microsoft and they just directed me back to Poly. I’d hate to have to get someone to go around and sign these in every time the token expires, am hoping they are interpreted as a different device if we assign a CAP policy to it.

              • Jeff Schertz says:

                The account credentials are saved but it sounds like you may be hitting the inactivity 90 timeout for Azure AD accounts. This will be fixed in the next Teams phone client release.

                • Austin says:

                  Do you have any more info on the AzureAD timeout Fix?
                  With conditional access requiring MFA I get a IM from my team asking me to forward an SMS code every so many days…
                  In my case these devices ARE managed in intune and currently compliant. Is there a way to prevent the re-auth using a separate CA policy for these devices?

                  • Jeff Schertz says:

                    That was fixed in Update #6 of the Teams IP phone client which is currently available for all CCX phones and the Trio C60. It has not yet been made available for the Trio 8×00 models.

            24. Paul says:

              Hi. Can a CAP phone on this new firmware be restricted to not allow outbound calls except to those listed as favorites – i.e. certain pre defined phone numbers?

            25. Nathan Harwood says:

              Hi Jeff, Thanks for the great article.

              We are in the process of deploying Teams phones with CCX500 phones and come across a couple of issues that I’m hoping you may be able to assist with.

              On user phones there appears to be no way to search for a user in the directory and then view and call a users mobile number. On CAP phone we can click search and then search for a user and when we click on them we can see their profile and click on the mobile number to call it but this doesn’t work on a user phone.

              On a CAP phone when there is a missed call the light at the top flashes and the number of missed calls displays on the call button but there is no way to clear the missed call as you can’t view call history.

              • Jeff Schertz says:

                That’s how the limited CAP interface works at the moment. I don’t know if Microsoft plans to make any changes to improve this.

                • Mike says:

                  A bit late, but I was doing my first Phone system deployment for a customer this week.

                  Regarding the CAP phone missed calls led, I encountered the same issue with the Poly CCX400. I solved it by updating the firmware.

            26. Andrew Smith says:

              Hi Jeff,

              Do you know why my CAP are not showing in the common area phone header in Admin Center? I provisioned the UI and set the license properly.

              thanks,
              Andrew

              • Jeff Schertz says:

                Once again Microsoft is using the term ‘Common Area Phone’ inconsistently and confusingly. No devices yet appear in that section and I honestly don’t know what they plan to do with that. It may be reserved for future devices they categorized for ‘Core Calling’ which will be lower cost phones they’ve recently announced at Ignite that will run a non-touch client. I don’t think it will apply devices registered with Common Area Phone user accounts as the account itself is not different, it’s simply the phone policy applied to the user which drives this.

                • Kuru Kanagalingam says:

                  The Reason Phone not listed under common area phone is you are not login to the CAP phone in commonAreaPhoneSignin Mode once you do it will appears. Until then it will appears under user signin phones.

                  • Jeff Schertz says:

                    That is correct as this new behavior is now functional in the TAC. The signed-in user’s SignInMode setting drives if the phone also appears in the TAC’s “User phones”, “Common area phones”, or “Conference phones” device views.

            27. Ben Lockwood says:

              Hi Jeff,

              We are setting up CCX400 phones as common area phones and the sign out option is available to everyone. It is not hidden under the admin area. Is there a setting to force this into the admin area? We are using direct routing, would that have anything to do with it?

              • Jeff Schertz says:

                You’ll need to assign the user accounts on those phones to an IPPhone policy set to the Common Area Phone sign-in experience. The ‘User’ mode does not move the Sign Out option behind the Admin Only settings, that only happens for the ‘Common Area Phone’ and ‘Meeting’ modes.

            28. Nikka says:

              Hi Jeff – May i know what license will be required for polycom VVX phones to work with MS teams?

              We have some on-prem generic user accounts for vvx that we need to migrate on MS TEAMS.

              • Jeff Schertz says:

                The VVX can only interoperate with Teams via Microsoft’s audio gateway by registering to Skype for Business Online. The user account on the VVX phone would need to have at a minimum “Skype for Business Plan 1” and “Microsoft Teams” included in the assigned license(s).

                • Aaron says:

                  Hey Jeff

                  Our testing of Teams/Skype/VVX interop shows that we can use hybrid routing to call between Teams (i.e. TeamsOnly) users and Skype On Premise-registered VVXs – IF they are logged in as a ‘real skype on prem’ user. Full calling, no issues.

                  If the same device is logged in as a Common Area Phone with on Prem (AD contact based) we have problems.

                  Essentially, Teams does not know the CAP exists, and routes the call to our SBCs. If we want, we can make a call that goes to our SBC reach the correct device, of course, via the PSTN. So we could live with that…. maybe.

                  In the other direction – Skype routes it *somewhere* – the caller gets ringing, and correct name lookup, but it doesn’t land on the Teams user. Or anywhere.

                  Funnily enough, having someone at MS confirm whether this scenario should work, or should not, is taking more than the 5 minutes I thought that question *should* take to answer.

                  And – yup, migrating to phones to 3PIP/SFBO would also work; but that just has an annoying impact on our migration plans….

                  So I’m posting this in the hopes that someone knows!

                  Thanks

                  • Jeff Schertz says:

                    I haven’t tested that scenario but I’m not surprised that it does not work as the SfB Server CAP configuration is entirely different than what SfB Online uses and the contact-based CAP user may not be able to communicate through the 3PIP gateway. I would assume it’s not supported but hopefully Microsoft can confirm the supported status for you before too long.

            29. Matt Eden says:

              Is it possible to add a CAP user to a call queue? We have a fairly small business and have a rotating team of people that help our staff with answering the phones.

              • Jeff Schertz says:

                I don’t see why not as the only requirement for selecting call queue agents in Teams is that they are Enterprise Voice-enabled users. Remember there really is no such thing as a CAP ‘user’ in Teams. You simply take a regular user account or resource account and assign it a CAP ‘license’ which doesn’t change anything in Teams (only in Exchange) and/or assign the account to the an IPPhone policy with the CAP ‘sign-in mode’ enabled.

            30. Mike K says:

              Hello Jeff,

              Using Polycom Resource manager with VVX-501 phones I can push CAP setting to all my phones but I cannot enable CAP admin without physically doing so on the phone. Problem being if the skype user is logged out for any reason there’s no ‘sign in’ button on the touch screen unless they go through settings to enable CAP Admin mode. Do you know of a configuration parameter or way to enable CAP admin on multiple phones at one time using resource manager?

              • Jeff Schertz says:

                Mike, I believe you are referring to the configuration in this older article for Skype (this article is completely different as it’s related to only Teams). As far as I’m aware that ‘CAP Admin Mode’ setting is only available directly on the phone’s menu and does not have a UCS configuration parameter associated with it, meaning it cannot be controlled via a provisioning server nor from the phone’s web management UI.

            31. RSAdm says:

              Absolutely fantastic write-up. Thanks for taking the time to put something so detailed together. I echo the words of others here when I say that it really is a disappointment that Microsoft doesn’t (1) have comparable documentation and (2) hasn’t simplified this process. Teams is on fire and taking off rapidly as a traditional PBX replacement. I sure they get it together! Until then, we’re lucky we have you! Kudos!

            32. RS Admin says:

              Again, great write-up! Question — We set HotDesking to FALSE and assigend the policy. All the other policy settings took effect on our YeaLink T55A, but the HotDesking button is still there even though we set to FALSE. Any thoughts or is that a bug? Set-CsTeamsIPPhonePolicy -Identity ‘CAP-Internal’ -AllowHotDesking $False

              • Jeff Schertz says:

                Policy changes can take several hours to apply so make sure you aren’t testing immediately after making the change. I also suggest sign out and back into the phone after some time has passed to assist in picking up the change faster.

                • RS Admin says:

                  You’re 100% right… after 24 hours HotDesking finally disappeared.

                  Separate subject that I have already seen all over UserVoice as a gripe, but any ideas on how to get rid of SUGGESTED CONTACTS? We have a common area phone and someone added a speed dial via the Teams Desktop PC client then deleted. The Speed Dial entry dropped from the CAP, but we still have the “suggested” contact listed. So… the poor person keeps getting calls from people in our lobby because their name is stuck on the screen. Seems that it’s a “feature request” in User Voice to remove suggested contacts but figured I’d ask here in case any insight or backend (power shell) way to nuke those! Thanks !

            33. RS Admin says:

              Anyone else here experience the issue where they cannot make calls from their Common Area Phone even after assigning a CAP license and domestic calling plan license as well well as phone number? Our calls start then say quickly “We couldn’t complete the call.” We allow calling per our policies. Curious if there is a setting specific to CAP that we’re missing. All our standard users with desk phones work without issues.

              • Jeff Schertz says:

                Nothing that I’m aware of. If you replace the CAP license with a regular user license (like an E3 license) does the problem go away? I would take a look at the Calling policies assigned to the user as that controls the behavior more than the license does.

                • RS Admin says:

                  Waited 5 days and resolved on its own – go figure! Figured I’d post that follow-up in case anyone else experience. Have seen something like that once before but not on CAP so now I know! Thanks again!

            34. Bruce Lin says:

              Hi Jeff,

              I have a question, the account with CAP license can be sign into Teams APP from cell phone ?
              If not, what kind of license need for this purpose ?

              Thank you

              Bruce Lin

              • Jeff Schertz says:

                I haven’t tested that but the CAP license isn’t meant for use on anything other than Teams IP Phones. A regular user license (like an E1) is required to sign into client’s which support the entire host of Teams features (channels, calling, chat, meetings, etc.)

            35. Martin Littleton says:

              Great article – has been so useful to me the past few months.

              I recently deployed a number of Yealink T-55A Teams phones as Common Area Phones in our office. These are Licenced with Common Area Phone Licences, are deployed using InTune. I have created a custom CAP calling policy that has call forwarding enabled. When I first set them up, they worked just fine, call forward was an option, I tested it and it worked. I revisited the office recently and was told Call Fwding was no longer an option – I checked and the option has gone. Nothing has changed at my end. The only thing that has happened since the initial set up, was that I updated the firmware of the phones from the Admin Portal – this completed fine and the phones are now in a “healthy” state – albeit with no call fwding. I have tried (at the request of Microsoft) removing the policy (waiting) and re-adding it and waiting but this made no difference. Any ideas on what I may be missing here?

            36. Aaron says:

              Hey Jeff,

              Are you aware of a current limitation in Teams that prevents adding a common area phone to your contacts (favorites)? We are rolling out some CCX400 phones for common area phones, and there are cases where we call the common area phones regularly, and I wanted to make it easy by adding a favorite contact, but when I attempt to add a common area phone in the Teams client, it does nothing. I am able to add regular user accounts as favorites.

              • Jeff Schertz says:

                As explained in this article there is no such thing as a Common Area user or Common Area Phone. Only a Teams-licensed user who is assigned a phone policy that enables the Common Area Phone “experience”. Thus, user configured for CAP mode are regular users and can be added as Contacts/Favorites just like any other Teams user. For example I have several user accounts which are configured in CAP mode added to the Favorites list of my regular user account on my phone.

                • Aaron says:

                  Thanks Jeff, totally understand from your great article about it being a regular user account assigned specific policies and licensing. When I called it a Common Area User/Phone, I meant it in a generic sense and should have been more explicit that I was referring to a User account configured with the appropriate policies and a CAP license. In my environment, I am unable to add a user account configured this way as a Contact/Favorite. I can search and find the user, but when I click “Add”, the window does nothing and they are not added to my Contacts list. I was curious if anyone else was seeing the same behavior, and if it was possible having the CsTeamsIPPhonePolicy be set to CommonAreaPhoneSignIn would prevent adding that user as a Contact. Or perhaps one of the CsTeamsCallingPolicy settings is preventing it. You have confirmed you don’t see that behavior and are able to Favorite a CAP mode user, so that is helpful, and now I’m hopeful I can get it to work the same. I fully expected these user accounts to work like the rest in my tenant and be able to be added as a Contact/Favorite, but currently that is not the case. I will play with the policy settings and see if any changes make a difference, and open a case with Microsoft. Thanks for your reply, and all the support and insight you provide the community.

                  • Jeff Schertz says:

                    If those users have a CAP license assigned to them then they will not be Exchange-enabled, meaning they do not appear in the Exchange Global Address List and do not contain mailboxes. But that shouldn’t matter as adding the contact in Teams comes form the user’s Teams configuration, not Exchange. I don’t know what’s going on there as you should be able to do what you are attempting to.

            37. Cathy L says:

              Hi Jeff – very good information on this page, thank you!

              We have a CCX500 and have setup a new Teams user account and assigned it the Common Area Phone license. I’m testing and if I call the user and no one answers I get Voicemail and can leave a message, but so far no voicemail notification comes through on the phone. I logged into the Teams client as this user and it says “We can’t get your voicemail right now”

              I read above that an account with the Common Area Phone license will not get a mailbox, and we verified that it does not have one in Exchange. I’m not sure what to make of this ability to leave a voicemail – where is that going?

              • Jeff Schertz says:

                That is correct, the Common Area Phone license is intended for scenarios were a phone is used by anyone to place outbound calls or receive inbound calls, but not support voice mail. If you need voice mail, calendaring, or any other Exchange-based feature then you’ll need to use either a Meeting Room license or another user standard license (like E1) on the account.

                • Cathy L says:

                  Thanks Jeff. What is strange is that the account that we created and assigned the CAP license does present a VM greeting and allows you to leave a VM if the phone is not answered.

                  • Kim M says:

                    Cathy, That is I think is weird with CAP accounts / numbers are able to leave a voice mail, without the ability to check the voice mail.

                    • Jeff Schertz says:

                      Once thing worth reiterating is that if you assign only a Common Area Phone license to a user account which is a “user” mailbox type because the CAP license does not include Exchange licensing then the mailbox will automatically be disabled and the object hidden from the Global Address List. If you assign only a CAP license to a user account configured as an Exchange “resource” mailbox type then those are free in Exchange Online and the mailbox will be retained. Thus, make sure that you correctly configure any accounts you want to use as CAP accounts as Exchange resource mailbox if you need Exchange-related functionality for that account.

            38. Shyam R says:

              Hi Jeff,

              Do you want to disable MFA for the CAP accounts by using some sort of conditional access policy based on dynamic group membership and also using trusted network?
              How the CAP phone will do MFA if they don’t have any cell phone numbers associated with it and how the device management will look like if we have to do MFA for CAP accounts?
              Also can we use normal AD synced on prem account to use for CAP phones?

              Thanks.

              • Jeff Schertz says:

                You can use any user account which exists in AAD and MFA is also supported. Some multi-factor auth solutions will work when signing-in directly on the phone but any will work when you select the “Sign in on a different device” option on the phone.

                • Shyam R says:

                  Thanks Jeff. For migration of 2k CAP account from on prem to Teams what are the best practices?
                  1. Not having MFA would be better for the emergency calling reasons if this gets triggered on a particular time period- or what would be the approach to this?
                  2. Does it require to use MDM to enforce device compliance or this can be skipped?
                  3. CAP accounts even not having own email in case of a breach what risk does knowing CAP accounts credential would posses risk to tenant security?
                  4. Considering we have MFA getting triggered or not depending on being on trusted ip address so in that case is it fine to create exception for CAP accounts to not have MFA?

                  • Jeff Schertz says:

                    You cannot migrate the accounts directly as Common Area Phone accounts in Skype for Business Server are AD contact objects, but in Teams an AD user object is needed. If you assign a Common Area Phone license to a user mailbox it will deactivate the mailbox so the best practice is to use a resource mailbox in Exchange Online for any accounts you wish to assign a CAP license. It is recommended to disable MFA on these types of accounts but you can still use some MFA solutions as the Android client does support some directly and others can be used with the “Sign in on a different device” method.

            Speak Your Mind

            Tell us what you're thinking...
            and oh, if you want a pic to show with your comment, go get a gravatar!