Key points to know about multi-camera support on MTR Windows

• Up to four single‑stream USB cameras; (multi‑stream intelligent cameras are not supported in this mode).
• Supported endpoints: Remote users on Teams desktop (Windows/Mac) can select the view they want while the meeting is running. In the future it is expected that other Teams Rooms on Windows endpoints will also be able select the view.
• Compute matters: Microsoft recommends at least an Intel Core i5, with 9th gen i5 minimum for 2–3 cameras, and 12th gen i5 minimum for 4 cameras. These requirements are about decoding/encoding multiple simultaneous streams and avoiding freezes. 
• Bandwidth matters: Microsoft recommends direct USB connections to the room PC where possible, and cautions against putting more than one camera per hub due to USB bandwidth limits. (You can use a USB hub but keep cameras one‑per‑hub branch.) 

Important distinction
Microsoft IntelliFrame Multi-Stream (multi‑stream intelligent camera hardware) is different: it relies on AI camera hardware that generate multiple people streams; Multiple camera view expects separate single‑stream cameras connected to the MTR PC and shows parallel feeds remote users can toggle through.

MTR Windows Conferencing PC best suited for multi-Camera support on MTR Windows:
The HP Poly Studio G9 Plus base kit (which includes the HP Mini IP Conferencing PC and the Poly TC10 controller) is purpose‑built for MTRoW. It provides sufficient collaboration‑oriented ports, supports pairing with up to four Poly TC10 controllers over Ethernet via its LLN port, and is built on Windows 11 IoT with 13th Gen Intel® Core™ i7—a meaningful margin above Microsoft’s minimum CPU guidance for four cameras. With the 13th Gen i7 spec in the G9 Plus, you’re at or above Microsoft’s Intel 12th Gen recommendation for four cameras, helping ensure smooth multi‑stream encode/decode in meetings and reducing the risk of frozen feeds while future proofing your investment in the PC hardware for additional AI features that will be introduced in the future. Below is the picture of TC10 controller peripheral camera settings with 4 cameras attached via USB:

During a Teams meetings, the Camera settings can be used to enable or disable multi camera view. Note that Enhanced framing must be enabled in order to enable multi camera. In addition, the different framing options - Intelliframe, Group framing and Active speaker are still available to be selected for the cameras that support these framing features. Below screen shot shows multi-camera enabled with no framing mode selected - this means each camera is using default position and zoom:

And the screen shot on what is shown on the main display with this MTR being the only participant in the call is shown below: 

Camera choices and roles: Poly Studio E70, Poly Studio E60, and Poly Studio V72
A successful multi‑camera design pairs complementary cameras for best room coverage. Think of each camera as covering a job:

• Presenter/lectern coverage (tight follow, high optical zoom): Studio E60
• People framing of the table (dual‑lens, wide + narrow, AI productions): Studio E70
• Room‑filling AIO bar for wide shots + integrated audio (and a large‑room option): Studio V72

Below is a quick technical characterization and usage guidance.

Poly Studio E60 (Smart MPTZ with 12× optical zoom)

• Dual‑lens design: a panoramic lens + an MPTZ lens with 12× optical zoom for detailed presenter tracking and long‑throw clarity. Field of view ~71° (PTZ) / 107° (panoramic); 4K capture.
• Poly DirectorAI framing modes (Presenter Tracking, Group Framing) and PoE+ power option via RJ‑45 make it flexible to mount and power.
• Suitable roles: lectern/presenter camera or rear‑of‑room zoom camera in training rooms and lecture spaces.

Poly Studio E70 (Dual 4K sensors; people framing champion)

• Dual‑lens camera with 120° and 70° HFOV optics and an electronic privacy shutter. Designed for people framing and whole‑table coverage in larger rooms. Specs list USB‑C and RJ‑45 (PoE), plus people counting. 
• HP/Poly documentation includes E70 Audio Service for MTRoW and integration guides (useful when fine‑tuning framing modes with Teams).
• Suitable roles: front‑of‑room main camera covering the table; pairs well with a secondary camera focused on presenter or whiteboard.

Poly Studio V72 (Premium USB video bar for large rooms)

• Dual 20MP 4K cameras (70° + 120° FOV), long‑range second‑order gradient microphones up to 25 ft, and high‑end stereo speakers—useful in large rooms that need integrated audio alongside multi‑camera video.
• While V72 is a USB bar (not an Android appliance), in PC‑based rooms it shines as either the anchor A/V device or a wide‑shot camera while E60/E70 handle special angles

Cabling & transport: getting USB where it needs to be (Cat6/7 extenders)
Since all four cameras must be connected to the MTR PC via USB, and the cameras are likely spread throughout large rooms for maximum coverage, USB cabling distance becomes the silent constraint. Native USB‑3 cables top out at ~3 m for reliable 5 Gbps. In real rooms, you’ll likely need USB extenders over Cat6a/Cat7. Below are some enterprise‑class USB 2.0 / 3.x extenders validated in the professional AV world. These are highly relevant for multi‑camera Microsoft Teams Rooms deployments, especially when using high‑bandwidth devices such as Poly Studio E70, E60, and V72.

• Icron Raven 3204C / 3204C Pro (USB 3‑2‑1, 100m, multi‑port) — 4 USB ports, supports full SuperSpeed 5 Gbps, isochronous traffic, and includes Ethernet pass‑through. Best for multi‑camera MTR designs needing USB 3 stability.
• USB Extender Plus Series for ProAV — Extends USB peripherals up to 1,980 feet (600 meters) through a Gigabit Ethernet network. Extends USB peripherals up to 330 feet (100 meters) point-to-point over one CATx cable. Supports USB 2.0 through 1.0 devices with data rates of up to 480 Mbps. Compatible with USB 3.0 devices that can operate at USB 2.0 data rate
• SoundControl SCT RCU3SL – USB 3.2 4K30 Extender (Up to 100m, single CAT6A) — Provides USB 3.2, 36W PD power, DC power, RS‑232, video, and audio over one CAT cable.Purpose‑built for video bars and PTZ cameras, including Poly Studio Series, Poly E60, Poly E70, Poly V72, Logitech Rally, Biamp Parlé, Sennheiser TeamConnect Bars, and more.
• Crestron USB‑EXT‑3 KIT — Extends USB 3.2 Gen 1 up to 100 m over CAT6a/7, supporting isochronous transport for UC cameras (isochronous bandwidth guarantees matter for steady video), with up to 4 USB devices at the remote end
• INOGENI U‑BRIDGE 3 — Extends USB 3.0 up to 100 m over CAT6A, with 2× USB‑A + 1× USB‑C device ports and RS‑232 passthrough. Designed for multi‑device camera scenarios and tested broadly for UC cameras.

​
Conclusion
Building a multi‑camera Microsoft Teams Room on Windows is ultimately about getting the fundamentals right: compute, camera roles, and USB transport. The HP Poly G9 Plus provides the processing overhead needed for smooth multi‑camera performance, while the Poly Studio E70, E60, and V72 work together to deliver clear table views, reliable presenter tracking, and wide‑room context.
Because USB distance and bandwidth are often the biggest constraints, choosing the right extender—whether from Icron, Sound Control Technologies, INOGENI, Crestron, or Extron—is essential to maintaining stable, high‑quality video across long cable runs. These extenders ensure each camera performs consistently, allowing Teams’ Multiple camera view to function as intended

How Teams noise suppression works (in short)
Microsoft’s model detects and attenuates non‑speech sources (keyboards, fans, traffic, dogs) while preserving the speaker’s voice. It’s available on desktop, mobile, Teams Rooms on Windows, and more, with adjustable levels like Auto, Low, and High depending on platform and version. Microsoft enabled ML‑based suppression by default after measuring substantial reductions in noise complaints and improvements in call quality. Its important to note that noise suppression is not a substitute for room design. It works best when the signal already has good SNR (signal‑to‑noise ratio) because of proper mic choice/placement and controlled reverberation. Microsoft’s room planning guidance emphasizes selecting the right audio devices per room size and treating acoustics first.

MTR on Windows offers centralized noise suppression configuration via XML (SkypeSettings.xml), device‑level settings, and Pro Management controls. In some app versions, turning off suppression in the UI didn’t fully disable processing until resolved in later releases so its important to reference the release notes for changes that affect audio processing interactions. Below is the screenshot of the Pro Portal settings for enabling/disabling noise suppression

An alternative method of configuring noise suppression on MTR Windows is to use the XML file SkypeSettings.xml. MTRW reads SkypeSettings.xml at startup. You can set a default for noise suppression and deploy it at scale using your preferred management method (Intune, Pro Management file push, etc.). The XML is processed at boot and deleted once applied.Typical values use by customers are:0 = Off, 1 = Auto, 2 = Low, 3 = High.

<SkypeSettings>
  <NoiseSuppressionDefault>1</NoiseSuppressionDefault>
</SkypeSettings>
​
It is also important to note that users can also enable/disable noise suppression during a meeting on MTR Windows using the audio settings menu. this only applies for the duration of the call and will revert back to its default settings once the meeting ends. This is shown in the picture below:

Avoiding double processing with external DSPs
Large rooms often use external DSPs (AEC, NR, automixing). If Teams noise suppression stays “on” while the DSP is already doing heavy lifting, you may hear pumping, speech artifacts, or reduced intelligibility. Experienced integrators note the following:

• Certified DSPs are designed to cooperate with Teams. When uncertified DSPs are used, Teams may still apply its own processing for safety—raising the risk of overlap. Prefer Teams‑certified DSPs and peripherals when possible, and coordinate which component does AEC/NR.
• If you must use an uncertified DSP, expect Teams processing to remain active per Teams’ policy logic; mitigate by dialing Teams suppression down (Low/Auto) or off where appropriate—and verify in listening tests.
• Vendors do publish known‑issue guidance for their bars/DSPs with MTRW (e.g., disable Teams suppression for HP Poly Studio X and G series MTR Android devices to prevent degraded audio). Always check the OEM's release notes and test thoroughly before rolling into production

Incorporating OEM AI Noise‑Block Technologies ( e.g. Poly NoiseBlockAI & Acoustic Fence)
Beyond Microsoft’s built‑in machine‑learning noise suppression, many Teams Rooms deployments benefit from OEM‑level AI audio enhancements that run before the signal reaches Teams. Vendors such as Poly (now HP | Poly) ship advanced noise‑blocking technologies—NoiseBlockAI and Acoustic Fence—inside their certified Teams Rooms devices. These technologies intelligently remove non‑speech noise and restrict pickup to a defined acoustic zone, dramatically improving the input signal that Teams receives.
Poly’s official documentation highlights that Poly NoiseBlockAI prevents distracting noises and side conversations from interrupting meetings by intelligently blocking out disruptive room sounds, while Acoustic Fence creates a virtual audio perimeter that blocks voices or noises occurring outside the meeting area. These capabilities ensure that only intentional speech from inside the defined pickup zone reaches remote participants. It also states that the latest version of NoiseBlockAI v2 also removes reverberations or echo in the room, which is especially useful in meeting rooms surrounded by glass walls or large sound reflective surfaces.

Why use OEM's AI Noise suppression over Teams Rooms built-in?
Room systems face more challenging audio environments than personal devices—open doors, hallway chatter, HVAC noise, clattering chairs. Having OEM technologies operate at the hardware/DSP level directly inside the video bar or room kit provides several advantages:

• Device‑side noise elimination happens before Teams receives audio, so the ML model has a much cleaner input to refine rather than repair.
• OEM DSPs can apply spatial awareness, using multiple microphones to identify where the sound originates — something cloud‑based suppression cannot do alone.
• Boundary enforcement (Acoustic Fence) lets you literally “draw” an allowed audio zone so that only in‑room participants are heard.
• Better suppression of transient noises like rustling papers, keyboards, or chair squeaks, which are notoriously hard for cloud suppression models.
• Reduces need for aggressive Teams suppression, lowering the risk of over‑processing and choppy speech.

For these reasons, it is best practice to always enable OEM's device manufacturers noise suppression technology whenever available while disabling the built-in noise suppression in Teams Rooms. Below is an example of enabling HP Poly's NoiseBlockAI on the StudioX72 MTR Android certified video bar:

Summary: The Golden Rule
Use OEM noise‑blocking (e.g. Poly NoiseBlockAI + Acoustic Fence) as the first line of defense, and leave Teams Noise Suppression disabled. This delivers the cleanest, most stable audio for hybrid participants while preventing the choppy audio that comes from stacking multiple aggressive layers.

Prerequisites: Licensing and Hardware Setup
Before diving into configurations, ensure your environment meets these foundational requirements. AI features like Copilot and Cloud IntelliFrame demand specific licenses and hardware.

Licensing Requirements
User Licenses: Participants (including remote attendees) need a qualifying Microsoft 365 subscription (e.g., E3, E5, Business Premium) plus a Microsoft 365 Copilot add-on license for advanced features like meeting insights and recaps.

Teams Rooms Pro License:
Essential for room resource accounts to access pro-level AI, including Copilot in Teams Rooms and Cloud IntelliFrame. Assign this to each room's console account. Steps to Assign Licenses:

1. Sign in to the Microsoft 365 admin center.
2. Navigate to Billing > Licenses and purchase/assign Microsoft 365 Copilot for users.
3. Go to Users > Active users, select the Teams Rooms resource account, and under Licenses and apps, assign the Teams Rooms Pro license

Hardware Prerequisites

• Both Windows and Android Teams Rooms now fully support Intelligent Speaker and Facilitator
• BYOD Rooms: Intelligent Speakers available in rooms where the room host has either a Microsoft Teams Premium or Copilot license.
• Cameras without built-in AI features supports Cloud IntelliFrame features. Eg. Poly Eagle Eye 4 USB, Logitech Meetup
• Microsoft Intelligent camera with ability stream up to 4 participants simultaneously are only available on selected hardware Eg. Panacast 50 and Yealink SmartVision 60
• Multi-camera streaming for up to 4 cameras is currently only supported on Teams Rooms on Windows but will come to Teams Rooms on Android at a later date. Requires a PC with higher spec CPU to stream 4 cameras
• Always refer to the official Microsoft documentation for the detailed list of supported peripherals: https://learn.microsoft.com/en-us/microsoftteams/rooms/certified-hardware?tabs=Devices

Configuring Core AI Policies on the tenant
​Most AI features are managed via the Teams admin center or Teams PowerShell. Below are the relevent meeting policies for global or per-room application.

Step 1. Enable Copilot features for Teams Users
Voice and face enrollment is a feature in Microsoft Teams that allows users to create a voice and face profile. Voice and face enrollment is used to improve the audio quality and user experience of Teams meetings and calls. This feature helps to reduce background noise and secondary speakers and provides speaker attribution and Microsoft Copilot accuracy in meeting rooms equipped with Microsoft Teams Rooms devices​

• Assign Teams license & Copilot license to the user
• Turn on Voice and Face recognitio​n
• [Optional] Voice isolation policy is on by default. Check to make sure or use PowerShell to turn on for all of your users

• Note: Voice and face enrollment settings will be moving over to TeamsAIPolicy cmdlet.

​Step 2. Enable Copilot & Transcription for Teams Meetings
Copilot can summarize key discussion points—including who said what and where people are aligned or disagree—suggest action items, and answer any questions you have, all in real time during or after a meeting. Copilot helps you stay on track by reasoning over the discussion and meeting chat to answer to your questions about the meeting. Copilot can be used without turning on transcription if the organizer sets up Copilot only during the meeting. Otherwise, the meeting must be transcribed to use Copilot.

Copilot won't work in meetings that are hosted outside the participant's organization.

• Turn on Copilot for Teams Meetings
• Turn on meeting transcription
• Assign Teams Room Pro license for the Resource Account
• Teams Admin Center -> Meetings -> Meeting Policies

Alternatively, using powershell:

​Step 3. Enable Intelligent Speaker
Intelligent Speakers for Microsoft Teams Rooms allows the meeting transcript to distinguish between different speakers in the room and also identify them and attribute them to the correct person. Intelligent Speaker enables critical use cases for Copilot and intelligent recap.

Note: ​Speaker recognition is enabled by intelligent speakers certified for Teams but also extended to existing hardware. However, it's important to note the quality in existing hardware that is not intelligent speaker certified may not match that of an intelligent speaker certified device. So, it's essential to evaluate the advantages of incorporating a certified intelligent speaker, especially in meetings where attaining the highest quality transcription and attribution is vital.
​

• ​Assign Teams Rooms Pro license to the room resource account
• Turn on Voice recognition and Transcription for Rooms

• Speaker and face identification supported only when the meeting organizer’s mailbox is in Exchange Online. Not supported for on-premises Exchange or 3rd-party calendars
• To ensure best precision for transcript limit number of in person attendees 10 max
• People identified in the room must be enrolled with their voice profile and invited to the scheduled meeting
• The limitation for people invited with voice profile is currently 20
• To support high-quality audio and video during meetings, we recommend that the meeting room has an upload speed of at least 7 Mbps.​​

​Step 4. Enable Facilitator for Teams Meetings
Facilitator is an AI-powered agent that is available in Microsoft Teams that is used to automatically take notes of the conversations that happen during a meeting. Facilitator in Teams is used in meetings that are scheduled by a user. A Teams Room console can also be added to the meeting invite as a participant if there is a one available in the meeting room. The meeting participants in the room can view Facilitator interactions in chat and navigate to notes to view AI notes taken during the meeting.

• Sign in to the Teams admin center 
• In the left rail navigation, select Teams apps > Manage apps.
• In the apps list's search box, search for Facilitator.
• Select Facilitator from the app list.
• In the actions menu, select Allow

Conclusion
Enabling all AI features in Microsoft Teams Rooms isn't just about flipping switches—it's about creating equitable, insightful hybrid experiences that boost productivity. With Copilot recaps, IntelliFrame, and noise-free audio, your Teams enabled-rooms become AI allies rather than mere video endpoint.

What is Device Code Flow—and Why Block It?
Device code flow is an OAuth 2.0 authentication method designed for devices with limited input capabilities (e.g., smart TVs or CLI tools). While it enables sign-in without a browser, it lacks modern security protections like phishing-resistant MFA and device compliance checks.
Microsoft recommends blocking or restricting device code flow wherever possible to bolster your security posture. If your organization doesn’t rely on this flow, it’s best to disable it entirely. At the same time, DCF allows for Teams Room on Android devices to be provisioned remotely as well as an simple method for signing into Teams on these devices. For MTRA devices the DCF login screen below should be a familiar scene:

What we want to achieve in this blogpost is to secure DCF from the rest of the organization while still allowing Teams Room Android devices to leverage DCF for sign-in and remote provisioning. To begin, we first want to create a security group to contain all the MTRA devices in the tenant. We can obviously create a security group in Azure AD and manually add all the devices, but a better method would be to use an Azure AD dynamic security group that will always be updated with newly added or removed over time. In the EntraID admin center, we go to Entra ID -> Manage -> Groups ->New Group window, we select the "Security" Group type, give the Group a name and description, and select "Dynamic Device" for Membership Type as shown below:

Next we need to click on "Edit dynamic query" to specify the attributes of the group that will match the MTRA devices deployed in the tenant. In the example below, the attributes matching the HP Poly family of Gen1 and Gen2 Teams Room Android devices are specified:

The Rule Syntax is as follows:

(device.deviceManufacturer -eq "Poly") and (device.deviceModel -in ["PolyStudioG62","PolyStudioX72","PolyStudioX52","PolyStudioX32","PolyStudioX70","PolyStudioX50","PolyStudioX30","PolyG7500","PolyTC10","PolyTC8"])

To verify that the attributes are properly matched, we can go to the newly created group and click on Manage -> Members and there should be a list of devices that are shown (assuming) that there are actually HP Poly MTRA devices deployed in the tenant:

The next step is to create a Conditional Access policy in inTune/MEM portal and navigate to Devices -> Manage Devices -> Conditional Access and then click on "Create new policy:

And now the policy is created. DCF login will be blocked for all users except for Teams Room Android devices from HP Poly. Before enforcing the block, we use Report-only mode to monitor how the policy would affect users. This helps identify dependencies and avoid disruptions.

Conclusion
Blocking legacy authentication flows like device code flow is a proactive step toward a zero trust security model. With Microsoft Entra’s Conditional Access, you gain granular control over how users authenticate, ensuring only secure, compliant methods are used.
If you're not already auditing or restricting device code flow, now is the time to start.

1. BYOM for Teams Rooms on Android
​HP Poly Gen-2 Android Teams Rooms devices are certified for Microsoft Teams Rooms on Android and includes the Studio X32, X52, X72 all-in-one video bars and the G62 modular room codec. All these devices have a built-in BYOM USB-C port that makes BYOM setup simpler and easy to use. The diagrams below show the BYOD USB-C port on these devices

For the Studio X series videobars paired with a TC10 touch panel, users can left-swipe the right edge of the panel screen to reveal a menu overlay that allows users to activate BYOM mode and connect their laptop to the USB-C port using a USB-C cable to take over the videobar's camera, speaker and mic. Then connect the HDMI output of the laptop to the room TV display HDMI input and proceed to start a meeting on their laptop using the videobar and the room TV display. The connection diagram for this setup is shown below:​

For rooms that require wireless BYOM capability, third party add-on solutions such as Barco CX-series can be deployed. The connection diagram is shown below:

These third-party add-on solutions may require some configuration in order for the Poly Studio X series to work seamlessly in BYOM mode. For example, the Barco CX-30 may require the "SmartFocus" setting to be enabled so that the system will not display the Barco home screen when no content is being shared or no laptop is connected via USB-C :

For the G62 modular room Teams Room on Android solution, the setup is similar with the exception that only a single USB-C DP-Alt cable is required from the laptop to the G62 USB-C port. This port will carry both data and video so there is no need to connect the HDMI cable to from the PC to the G62. Do note that DP Alt mode on Poly Studio G62 only supports using the following cable:USB Type-C 1.83 m (6 ft) part number L07087-002. The laptop must also support USB-C Alt-DP for this to work. With this the connection diagram is simplified as show below:

If the laptop computer doesn't support Alt DP, then is required to connect the computer to both the USB Type-C and the HDMI In port on the Poly Studio G62 in the same way for the Studio X72/52/32.
​

2. BYOM for Teams Rooms on Windows
The HP Poly Teams Rooms on Windows solution comprises the HP G9 Plus Mini Conferencing PC with a TC10 touch panel. BYOM setup for this solution requires a third-party USB Host switcher such as the Acroname USB Switching Hub. Fortunately this device is available to purchase directly from HP Poly at the time of this writing. To start a BYOM meeting the user will connect both the USB-C and the HDMI cable from the laptop to the HP G9 Plus Mini Conferencing MTR compute PC. A USB extender such as the Icron Ranger 2311 can be used to bridge the distance from the MTR compute PC to the users' laptop on the conference room table. The setup diagram is shown below:

Another possible setup is using the Extron UCS 313 Collaboration Switcher that can provide the user more control over when to switch between the MTR Host PC and the user's laptop. The 313 front panel provides selector buttons for this purpose. Also the Extron USB Extenders can be used for extending the USB connection betweeen the UCS313 and the laptop. The setup diagram is shown below:

An alternative to using Extron is the Inogeni Toggle Rooms for MTR for the same BYOM functionality in MTR Windows. The setup is very similar but with slight variations in the connections. Below is the sample connection diagram:

This is referenced from the connection diagram provide by Inogeni here: INOGENI_TOGGLE-ROOMS_Barco-ClickShare_UC-Systems-Partners-diagrams.pdf

3. Conclusion
Hopefully the above configuration setup diagrams will help AV integrators in building BYOM solutions for both Teams Rooms on Android and Windows.

1. Migrating Microsoft Teams Android Devices to AOSP Device Management

Microsoft Teams Android devices are transitioning to Intune Android Open Source Project (AOSP) device management. This migration aims to enhance reliability, improve deployment experiences for admins, and pave the way for future innovations in managing Teams devices.The migration will occur in phases:

• Validation Phase: 0-15 days
• General Phase: 16-45 days
• Final Phase: 45-60 days

For example, if the auto-update starts on May 15th, devices in the Validation phase will update first, followed by the General phase starting May 30th, and finally the Final phase starting June 28th.Do note that this update is mandatory and cannot be postponed indefinitely.

Prerequisites for Migration
To ensure a smooth migration, complete the following prerequisites:

• Create Enrollment Profiles: Set up new enrollment profiles and configuration/compliance policies in Intune.
• Install Firmware Updates: Once the AOSP-compatible firmware is available, install updates for each supported Teams device.

Step-by-Step Migration Process
Step 1: Create Enrollment Profiles
Create new enrollment profiles and configuration/compliance policies in Intune. This step must be completed before the firmware updates is completed. Please note that only few policies are supported at this time. Failure to create enrollment profiles will result in devices failing to enroll properly in Intune. Ensure the AOSP Device Management enrollment profile is created with an extended enrollment token and the Teams Devices option enabled. For step-by-step guidance, refer to the earlier blog post on AOSP device management Preparing for AOSP Enrollment on Teams Android Devices - UCPrimer

Step 2: Install Firmware Updates
When the AOSP-compatible firmware is released, install the updates for each Teams device.
The firmware update will automatically unenroll the device from Device Administrator and re-enroll it with AOSP Device Management.

HP Poly has released the latest firmware 4.5.x supporting AOSP Device Management and recommends all owners of Poly Teams Room Android devices to update to this latest version.

Best Practices for Conditional Access Policies
To avoid issues during migration, follow these recommendations:

• Device Compliance Requirement: Ensure enrollment profiles are created in Intune.
• Multi-factor Authentication (MFA): Not supported for shared devices.
• App Protection Policies: Not supported.
• Terms of Use (ToU): Not supported for shared devices.
• Sign-in Frequency: Avoid using "1 hour" or "Every time" for Teams devices undergoing migration.

Important Update for Teams Phones with MFA
Teams Phones updated to AOSP ready firmware, such as PVOS 9.1.x, do not supported device code authentication when MFA is enabled. Users must login on the device itself in order to be able to trigger the MFA process. Please see this link for more information Some Poly phones may sign out after migration to Microsoft AOSP | HP® Support

For further guidance on AOSP migration, please refer to this Microsoft post ​Moving Teams Android Devices to AOSP Device Management | Microsoft Community Hub

For HP Poly specific video and phones, the following table shows the update timings:

​2. Policy Changes for Microsoft Teams Devices Using Device Code Flow Authentication
Microsoft has introduced new policies to enhance the security of Microsoft Teams devices using Device Code Flow (DCF) authentication. This section will guide you through the recent policy changes, their implications, and how to manage these policies effectively. Device Code Flow (DCF) authentication is a method used by devices to authenticate without requiring user interaction on the device itself. This is particularly useful for shared devices like Microsoft Teams Rooms, IP phones, and other Android-based Teams devices.

Policy Changes Overview
First announced in February 2025, Microsoft is rolling out new policies to secure tenants against potential threats to accounts using DCF authentication. The rollout began in February and will continue until May. These policies will initially be in report-only mode, allowing administrators to review their impact before enforcement.

Key Points of the New Policies:

• Report-Only Mode: Policies are initially created in report-only mode, giving administrators at least 45 days to evaluate and configure them before they are automatically enforced.
• Exclusion Lists: Administrators can create exclusion lists for accounts that sign in on Android-based shared Teams devices. This ensures that these devices can re-authenticate with DCF after sign-out.
• Impact on Shared Devices: Without exclusions, devices cannot re-authenticate with DCF, leading to a loss of remote sign-in and management capabilities.

Steps to Manage the New Policies

• Evaluate the Policies: Use the report-only mode to understand the impact of the new policies on your organization.
• Create Exclusion Lists: Identify and exclude accounts that need to sign in on shared devices. This can be done in the Microsoft Entra admin center.
• Configure Policies: Customize the Microsoft-managed policies according to your organization's specific needs.

The exclusion lists for this policy should be created by tenants that have deployed Android-based Teams devices in shared spaces like:

• Microsoft Teams Rooms on Android front-of-room displays and consoles
• IP Phones (licensed as Teams Shared Devices)
• Panels
• Displays

Why Remote Access is Critical for MTR Management
Imagine a scenario where a display issue arises in a conference room on a different floor, or an MTR device in a remote branch office needs a critical software update. Without remote access, an IT technician would need to physically travel to each location, consuming valuable time and resources. Remote access empowers IT teams to:

• Troubleshoot and diagnose issues: Quickly identify and resolve problems like audio/video glitches, network connectivity issues, or application crashes.
• Perform routine maintenance: Conduct updates, clear cache, and optimize settings from a central location.
• Provision and onboard new devices: Streamline the deployment process for new MTR installations.
• Monitor device health and performance: Proactively identify potential problems before they impact meetings.
• Provide remote support and training: Guide end-users or new IT staff on device usage.

General Principles of Remote Access
While specific implementations vary between Windows and Android, the underlying principles often involve:

• Secure Connection: Utilizing encrypted protocols to protect sensitive data during transmission.
• Authentication: Verifying the identity of the user attempting to access the device.
• Authorization (RBAC): Ensuring that users only have the necessary permissions to perform their tasks.
• Network Accessibility: Devices must be reachable over the network, potentially requiring firewall rules or VPN connections.

Remote Access on Microsoft Teams Rooms on Windows
For MTR devices running Windows, the primary and most recommended method for remote administration and console access (especially with a Teams Rooms Pro license) is through the Microsoft Teams Rooms Pro Management portal. Traditional Remote Desktop Protocol (RDP) can be enabled for deeper OS-level access, but it's generally superseded by the Teams Rooms Pro Management portal for day-to-day MTR-specific tasks.The Teams Rooms Pro Management portal, accessible via the Microsoft Teams Admin Center, offers a dedicated, secure, and integrated way to manage your MTR Windows devices. This method provides console-level remote access (view or modify) directly within your browser.

Prerequisites:

• Microsoft Teams Rooms Pro License: This feature typically requires a Teams Rooms Pro license assigned to the MTR device.
• Tenant-level Enablement: Remote Access must be enabled at the tenant level in the Teams Rooms Pro Management portal.
• Custom RBAC Role: A custom role with "Remote Access view" or "Remote Access modify" permissions must be created and assigned to the administrators who will be performing remote access.
• Supported MTR Windows Version: The MTR device must be running a supported version of Windows (e.g., Windows 11).

Step-by-Step Guide to Enable and Use Remote Access:

1. Enable Remote Access in Teams Rooms Pro Management Portal (Tenant Level):

1. Sign in to the Teams Rooms Pro Management portal (e.g., https://portal.rooms.microsoft.com) with appropriate administrator privileges.
2. Navigate to Settings > Remote Access.
3. Set Enable Remote Access to Enabled.
4. Enter an email address to acknowledge the enablement and select Save.

After a few seconds, the remote session will start as shown below:

Important Notes for Teams Rooms Pro Management Portal:

• Remote access sessions are logged for auditing purposes.
• Audio is not enabled during remote access sessions.
• A red ring is displayed on the console in the room when a remote access session is active, alerting anyone in the room.
• The console must not be in an active call to initiate a remote session.
• Avoid entering privileged account passwords during remote access sessions for enhanced security.

Remote Access on Microsoft Teams Rooms on Android
Remote access is crucial for managing and troubleshooting Microsoft Teams Rooms (MTR) on Android devices. Here we focus on how to remotely access and control Poly TC8 and TC10 touch controllers used with Poly Android video bars through the Poly Lens platform.

What is Poly Lens?
Poly Lens is a cloud-based device management platform developed by Poly (now part of HP) that provides IT administrators and users with enhanced visibility, insights, and control over their Poly communication and collaboration devices. It's designed to simplify the management of various Poly devices, from headsets and desk phones to video conferencing systems and Microsoft Teams Rooms.

To use remote access with Poly Lens, you need:

Supported Devices:

• Poly TC8 or TC10 touch controller.
• Paired with a Poly Android video bar (Poly Studio X series, Poly Studio G62, Poly Studio G7500).

Device Requirements:

• TC firmware version 6.4 or higher.
• Remote access enabled on the TC device under Settings > Poly Lens > Remote Access.
• The device must be onboarded to a Poly Lens cloud account.

Poly Lens Cloud Requirements:

• A Poly Lens cloud account (Premium Enterprise is recommended, or you can use the trial version).
• A Poly Lens Admin or Device User Role in the account.
• A supported browser (Safari, Edge, or Chrome; Firefox is not currently supported).

Step-by-Step Guide to Remote Access with Poly Lens

Log in to Poly Lens: As an IT admin, log in to your Poly Lens account with a Poly Premium license.

Select a Supported Device: Choose the TC8 or TC10 device you want to access. You can find devices under:

• Manage > Inventory and select the device.
• Manage > Rooms and select a room that includes a supported device.

Initiate Remote Access:

1. On the device details page, click Remote Access

​End Session: To end the remote session, click the End Session button in the upper right-hand corner of the remote access window.

​Important Considerations

• Device must be online: Remote access will not work if the touch controller is offline. The Remote Access button will be grayed out with a tooltip indicating the device's offline status.
• User Awareness: The end user will be notified when a remote session is active.
• Security: Ensure your Poly Lens account is secure and use strong passwords.
• Poly Lens App: The Poly Lens Room app is required for managing PC-based conference rooms.
• Poly Lens Desktop: Poly Lens Desktop must not be installed on the Microsoft Teams Room on the MTR Windows PC.

Conclusion
Remote access is no longer a luxury but a necessity for efficient and secure management of Microsoft Teams Rooms. By leveraging the powerful capabilities of the Microsoft Teams Rooms Pro Management portal and integrating with comprehensive OEM management solutions like Poly Lens, IT administrators can maintain optimal performance and availability of their MTR fleet, regardless of geographical distribution. Always prioritize security, adhere to best practices, and stay informed about the latest management features and updates from Microsoft to ensure a seamless collaboration experience in your organization's meeting spaces.

Teams Application Version Requirements
​Microsoft Teams applications on Android devices operate under the Modern Lifecycle Policy. Updates for these applications are distributed through the Teams Admin Center (TAC) or Teams Rooms Pro Management Portal (PMP). It is strongly recommended that devices are set to auto-update to ensure uninterrupted functionality. Customers who opt for manual updates must ensure that they install the latest application versions to maintain stability and security. The support for Teams applications is limited to the latest and the penultimate (latest-1) versions. Customers encountering defects must update to the latest version to obtain fixes. In the Teams Admin Center (TAC), automatic updates cannot be turned off and can only be deferred to a maximum of 60 days depending on which update phase is selected for the device: 

• Validation: This option is best for lab or test devices on which you can carry out any validation you need to perform. Devices in this phase start updating as soon as the latest software version is released and finish updating within the first 15 days (0 to 15 days).
• General: This is the default option for newly onboarded devices and is best for most of your general-purpose devices. Devices in this phase start updating as soon as 16th day since latest software version was released and finish updating by 45th day (16 to 45 days).
• Final: This option is best for devices used by VIPs and in large settings after large-scale validation is complete. Devices in this phase start updating as soon as 46th day since latest software version was released and finish updating by 60th day (46 to 60 days).

Android OS and Firmware Support
Teams devices on Android rely on operating system and firmware updates provided by OEM partners. These updates undergo Microsoft certification before being made available in TAC or PMP. Devices must operate on certified versions to remain eligible for technical support and defect rectifications. The support cycles for Android operating system versions are aligned with Google's support cycles. Below is an overview of the supported Android OS versions for Teams devices:

HP Poly Teams Rooms on Android Support Lifecycle
​As technology evolves, so do the products and solutions OEMs rely on for seamless video collaboration. HP's Poly VideoOS has been at the forefront of this evolution, offering robust solutions for video conferencing through its first and second-generation Teams Room on Android devices.

First Gen vs. Second Gen Devices

• First Generation Devices: Released between 2019 and 2021, these devices include Poly Studio X30, Studio X50, Studio X70, and G7500 as well as the TC8 touch controller. They all share a common processor and run Poly VideoOS, which uses Android 10 as its core foundation.
• Second Generation Devices: Launched in 2023, these devices feature a more powerful processor and include Poly Studio X32, Studio X52, Studio X72, and Studio G62 as well as the TC10 touch controller. These devices will support a future Poly VideoOS version which uses Android 13 as its core foundation.

Transition to Android 13
Why Android 13? Android 13 offers a longer runway for maintaining certification with video app partners like Microsoft Teams, and other meeting platforms. This is important since Microsoft has already announced end-of-certification dates for devices running Android 10. Poly VideoOS 5, based on Android 13, will be accessible through Poly Lens, the support portal, or the management platforms of certified app partners once released planned in mid-2025.

Certification and Customer Impact
End of Certification: Devices running Android 10 will no longer be certified by partners like Microsoft after September 2025. However, this change does not impact the performance or registration capabilities of first-gen devices. Organizations who have already purchased first-gen devices should note that these devices will continue to operate normally for an additional two years following the expiration of certification as Microsoft is committed to supporting the latest version of the Teams devices applications on certified devices for a span of two (2) years after the certification period concludes. Therefore first-gen devices will continue to work and be supported until September 2027. Beyond this date, it is highly recommended to replace these devices to ensure ongoing Teams meeting experiences and hardware/software support.

What about MDEP?
The Microsoft Device Ecosystem Platform (MDEP) is an Android-based platform built on the Android Open Source Project (AOSP). It enables device manufacturers and developers to create innovative solutions while leveraging Microsoft’s security, trust, and management features. Key highlights include:

• Introduction of hardware-based attestation for enhanced device security.
• Integration with Microsoft Intune to enable zero-trust principles.
• Support for diverse hardware configurations, making it highly adaptable.

​With its modular design, MDEP supports a wide range of System on Chip (SoC) models, showcasing its adaptability to various devices and solutions. Currently, HP Poly's first and second gen Teams Rooms on Android devices utilizes both Qualcomm and NXP SoCs which are known to be supported on the MDEP platform. At the time of this writing, HP is still working closely with Microsoft on how it can integrate MDEP into its devices in the future.

HP Poly Teams Android Phones
The CCX and Trio C60 phones have moved to PVOS 9.x.x and will focus support on primary app partners Microsoft and Zoom. These phones will update to Android 12 and provide a current-gen platform for partner application development. The PVOS 9.0 update is supported from any previous PVOS or UC Software version, but downgrading to pre-9.0 PVOS or UCS versions will become unavailable.

Additionally, the certification end dates for Android OS versions are based on the release date plus five years. For example, the certification end date for Android 12 devices is now August 15, 2027. The Microsoft support end date for CCX and Trio C60 phones on Android 12 will be August 15, 2029.

Note that PVOS 9.1.0 is the version that supports the new AOSP Intune device management replacing Android Device Administrator. After upgrading to PVOS 9.1.0, it becomes the new minimum software version due to changes in the phone’s Android OS and the introduction of new Teams applications for AOSP device management. Refer to this earlier blogpost for more details on how to prepare for this new capability.

Important! Before updating to PVOS9.1, it is strongly recommended to update the Teams App to version 1449/1.0.94.2025084203
using the Teams Admin Center as shown. This fixes issues that were present prior to this app release. For more information, please refer to ​https://info.lens.poly.com/blog/2025/03/18/ms-aosp ​

Pre-requisites
To get started managing BYOD rooms effectively in the Teams Pro Management Portal, there are several pre-requisites:

1. Teams Pro Management Portal Access - administrative access to the portal to configure settings, associate peripherals, and generate reports.
2. Required Licenses - at least one Teams Room Pro license or Teams Shared Device license, which is essential for accessing usage reports and room data.
3. Device Compatibility - Peripherals like cameras, microphones, or speakers must support association through unique identifiers (e.g., Product ID, Vendor ID, or Serial Number).
4. Data Collection Policies - Device data collection must be enabled if you want detailed usage insights or performance reports.

Onboarding BYOD devices
Admins can enable or disable the feature that allows devices (e.g., cameras, microphones) to be automatically recognized and associated with specific BYOD rooms. Adjusting the threshold for automatic associations ensures only non-personal peripherals are linked to rooms. Not that the threshold minimum is 5 and can be adjusted upwards. This means that at least 5 unique users have to use these BYOD peripherals for Teams meetings before it will be automatically associated with a room resource account. These settings are available in the Settings-General tab of the PMP as shown below

Another way to onboard BYOD devices to PMP is to manually add them to your inventory using a PowerShell script provided by Microsoft. The script has to be run on a laptop or PC that will be connected to the devices and the user needs admin rights. Its important not to connect the room peripherals before running the script. When run, the script will prompt for the peripherals to be connected, only then will it collect data about connected devices (like USB devices, monitors, cameras, speakers, microphones) for inventory and management in Microsoft Teams Pro Management Portal.

Steps to Use the Script:

1. Download and prepare the Get-TeamsBYODSpaceDevices.ps1 script.
2. Open the script in PowerShell, run it, and follow the prompts to gather device details.
3. Connect external peripherals when prompted and provide account and folder path details for saving the results.
4. Review the output, save it as an .XLSX file with the first sheet titled PERIPHERALS. Ensure appropriate sensitivity labels (e.g., non-business, public, or general). Sensitivity labels and sheet names must meet specific requirements to avoid import errors.
5. Checking for accuracy of exported data is essential before upload.

Once the import is complete, we can view the BYOD room in the inventory and start to manage it via the PMP as shown below:

Enabling automatic work location updates
​You can choose to activate the automatic work location update feature for your entire organization or specific user groups. This feature improves the user experience by simplifying the process of keeping work locations current and helping colleagues connect when they’re in the office. Top enable this we use the New-CsTeamsWorkLocationDetectionPolicy and Grant-CsTeamsWorkLocationDetectionPolicy Teams powershell cmdlets as example shown below:

Once the policy is enabled, users can turn on automatic updates via the Teams desktop app under Settings > Privacy > Sharing your work location. After opting in, their work location will switch to "In the office" automatically when they connect to a BYOD room—as long as their previous status was "Unknown" or "Remote." The detected location will remain active until their working hours end. If they connect outside working hours, the location will update and stay active until 11:59 PM that day.

Conclusion
BYOD management in PMP ​​allows administrators to enhance room functionality, analyze usage data, associate peripherals, and ensure smooth user experiences. With features like automatic peripheral association, detailed usage reports, and customizable policies, organizations can optimize meeting spaces while maintaining control over data and privacy settings.

1. Direct Guest Join (DGJ)
Direct Guest Join is a feature in Microsoft Teams Rooms that allows users to join Zoom and Webex online meetings from their Teams Rooms devices with a single touch. This is the most basic form of interop and requires no additional license other than Teams Room Pro. Direct Guest Join uses WebRTC technology to transcode audio video and content share between Teams and the other platforms and comes with a few limitations, notably:

• Video Quality: The maximum video quality for Direct Guest Join is up to 720p at 30 frames per second, which might be lower than what some users expect
• Content Sharing: While you can receive shared content, sending content from Teams Rooms to third-party platforms is limited. For example, you can't send content using an HDMI or content camera.
• Display Support: Direct Guest Join supports only one front-of-room display
• Feature Availability: Some advanced features like breakout rooms, reactions, and content annotations are not available when using Direct Guest Join

Configuring Direct Guest Join is simple and the detailed steps are provided in the Microsoft website: https://learn.microsoft.com/en-us/microsoftteams/rooms/third-party-join and therefore will not be repeated here

2. Cloud Video Interop (CVI)
Cloud Video Interop is a paid Microsoft qualified 3rd party solution that enables traditional SIP and H.32 VTC devices to join Microsoft Teams meetings seamlessly. This technology is an enhanced option compared with DGJ and participants using non-Teams devices can enjoy features like HD video, audio, and content sharing, as if they were native Teams clients. It also supports functionalities like scheduling meetings via Outlook or Teams, joining meetings hosted by external organizations, and using layouts similar to the Teams experience. The HP Poly CloudConnect for Teams powered by Pexip one of the available CVI solutions in the market today. For those who are interested in the details, Microsoft provides a detailed comparison table between DGJ and CVI here: https://learn.microsoft.com/en-us/microsoftteams/rooms/third-party-join?tabs=MTRW

HP Poly's CloudConnect for Teams stands out for its seamless interoperability with SIP and H.323 video conferencing systems, offering a native Teams experience with 1080p30fps HD video, audio, and content sharing. Some feature highlights include:

• Ease of Use: Poly CVI simplifies workflows by allowing trusted devices to bypass the Teams lobby and directly join meetings. Other CVI solutions also provide interoperability but may require additional setup steps.
• Layout Options: Poly CVI offers dynamic layouts, including a "Teams-like" experience, multiscreen displays, and presentation views.
• Integration Features: Poly CVI supports bi-directional content sharing and localized welcome screens, enhancing user experience.

Below is a diagram showing the solution overivew:

2.1 CVI - SIP Guest Join
The core functionality of CVI allows an organizations SIP/H.323 VTC systems to join Teams meetings that are scheduled and hosted by themselves since they have purchased and deployed the CVI solution. For Teams meetings that are scheduled and hosted by other organizations that do not have CVI deployed, there is the option to enable SIP Guest Join (SGJ) which allows the CVI-enabled organization's VTCs to join these non-CVI enabled Teams meetings. There are no additional licenses that are required to enable this other than enabling One Touch Join (OTJ) on these VTCs. Details on how to configure OTJ are provided in this link:  https://help.pexip.com/service/otj-configure.htm Below is a diagram showing a sample OTJ configuration on my lab tenant

Once OTJ is configured and working, we can enable SIP Guest Join on our CVI tenant and since we are using the CVI OTJ service in the cloud, no additional configuration is required and the VTCs are automatically able to use the guest join feature. Do note that Teams for Home or Small Business and Microsoft Government cloud are not supported for SGJ. The diagram below shows the difference between the core CVI interop and the SGJ interop:

2.2 CVI - ​Microsoft Teams Rooms SIP/H.323 calling
The latest addition to CVI functionality known as MTR SIP/H.323 calling allows Microsoft Teams Rooms devices on Windows to make audio, video, and screen-sharing calls with other endpoints supporting SIP or H.323 protocols. It is available only for Teams Rooms devices with a Microsoft Teams Rooms Pro license and is not compatible with Teams Rooms on Android. Basic requirements for enabling this feature are

• Teams Rooms resource accounts need a Pro license.
• An agreement with a certified Cloud Video Interop (CVI) provider offering SIP and H.323 dialing is necessary.
• Configuration details like the “AreaCode” must be obtained from the CVI provider
• A SIP & H.323 Video Teleconferencing Policy must be created and assigned to Teams Rooms resource accounts.

We use the Teams Powershell commands New-CsTeamsRoomVideoTeleConferencingPolicy and Grant-CsTeamsRoomVideoTeleConferencingPolicy to create and assign the policy to the resource accounts used by the VTC for Exchange calendaring. Below is a screen shot of the cmdlets used on my lab tenant which simply uses the existing TurnOnSIPH323 policy globally:

Another requirement to enable this capability is to grant consent to the cloud app in our M365 tenant. To do this you will need to get an email from your CVI provider and have global admin permissions to click on the link to activate. After signing-in with global admin credentials, accept the permission pop-up screen as shown:

Once the policy takes effect, we can start to make and receive SIP/H.323 calls from Teams Room on Windows For calling by a meeting ID (Teams meetings or meetings with other third-party providers): on the Teams room touch console, select Join with an ID, select the meeting provider (for example Teams, Zoom, Cisco Webex, Google Meet), and then enter the meeting ID and passcode. To call a VTC directly: select Call, then select SIP or H.323 as appropriate, and enter the address of the VTC. Example screenshots of both scenarios are shown in the diagrams below

In conclusion, Teams interop with other meeting platforms has evolved much over the years and hopefully this post helps readers to understand the latest offerings at the time of this writing and provide guidelines on the features and configuration steps.

Overall, network cameras offer a more robust, scalable, and secure solution for Teams Rooms, providing high video quality with easier management, and greater flexibility in deployment.

​Poly Studio E70 and E60 camera support for IP connectivity
In the latest PolyOS 4.4 release, HP Poly supports connecting one Poly Studio E60 or E70 camera to a Poly G7500 LLN port or up to three Poly Studio E60 or E70 cameras to the Poly Studio G62 LLN port using a supported Ethernet switch. However, only one IP connected camera is officially supported in Teams provider mode at this time of this writing, but more is planned for future releases.

Note: Poly Studio G62 and Poly G7500 systems don't support mixing IP LLN and USB-connected cameras. To connect multiple cameras to the codec, note the following:

• Poly Studio G62 systems support connecting up to three IP LLN cameras using a supported Netgear switch.
• Zoom Rooms and Poly Video mode support up to three IP LLN cameras. Teams Rooms supports one IP LLN camera.
• Poly G7500 supports connecting one IP LLN camera only. To connect multiple cameras, use USB connectivity.
• Poly Studio E60 IP LLN connectivity is supported in Teams Rooms, Zoom Rooms, and Poly Video Mode. Poly Studio E60 IP LLN connectivity is not supported in other provider modes. 

Which Network Switch to use for LLN
For connecting IP network cameras and other peripherals the codec's LLN, HP Poly supports the Netgear ProAV line of switches, specifically the M4250-9G1F-PoE+ (GSM4210PD) and M4250-26G4F-PoE+ (GSM4230P) models. These switches are chosen for their compact size, cost-effectiveness, and ability to support PTPv2 timestamping. This timestamping is crucial for maintaining synchronization in audio use cases, ensuring that audio and video signals remain in sync. These switches are trusted by AV integrators worldwide and provide a stable and reliable experience for IP-connected peripherals.

The Netgear switch configuration steps involve downloading the necessary files from Poly Lens, connecting a laptop to the switch, update the firmware and load the configuration files. This process ensures that the switch is set up with all the features and functions enabled to provide a stable and reliable experience for video and audio peripherals.

Step-by-Step guide
1. Download the latest supported firmware and configuration file from Poly Lens under the Manage->Software Version menu and search for "Modular Room Switch". Then download the zip file:

2. Unpack the zip file into any folder in the laptop and connect the laptop to the AV management network and connect the Netgear switch OOB (Out-of-Band) port to the same network.On the new Netgear switch that I had, the OOB port was set to DHCP so I simply obtained the IP address of the switch from the list of address leases on my DHCP server. Note that on some older firmware, the Netgear switch OOB port has a static IP of 192.168.0.239. If this is the case, set a static IP address on your computer for the ethernet interface of 192.168.0.200 with a subnet mask of 255.255.255.0. Leave the default gateway blank. Open up a Command Prompt and make sure it can ping the IP of the switch at 192.168.0.239. 

3. Open a web browser and navigate to http://<IP Address of Netgear OOB>.  Type 'admin' in the Login Name field, leave the password field blank, and click AV UI Login. When prompted, change the password as desired. Re-login to the switch with the new password. You should be presented with the home page as shown below:

7. On the top right corner of the page, click Reboot.  When asked if you want to save the configuration settings and are given the options of Cancel/No/Yes, choose No.

8. After a few minutes refresh the web browser window and login again to the switch and check the screen for the following things:

• In the Device Details section, the firmware version should be 13.0.4.19.
• In the same section, you should see a system name that begins with Poly-MR - if those match, then your switch is upgraded to the correct firmware level and has the appropriate configuration loaded, and you can proceed to connect the IP cameras.
• Note that after uploading the configuration, the admin password is changed to "Poly!4567". 
  

Connecting the IP Cameras
Once the switch is configured, you can connect your peripherals to the powered ports on the switch. These include various peripherals, such as IP table microphones, IP ceiling microphones, E60 and E70 cameras. The switch can be paired with a G62 or X72, or an X52 built-in RJ-45 port which would require a USB to Ethernet adaptor for the corp network. 

Connect one end of an ethernet cable to port 9 on the switch, and the other end to the codec. We recommend port 9 (or port 26 on the large) as it is a non-powered port, so that you can use the left 8 (or 24) powered ports to connect your IP peripherals On a G62 or X72 system, connect to the second port that is not labeled POE, this is the leftmost of the 2 RJ-45 ports on the back right of the system.

Connect your IP cameras or other peripherals to any of the powered ports (ports 1-8, or 1-24 with the large).  If you have Dante peripherals you'd like to connect, you can also connect those at this time too.  The build & configuration steps you followed earlier pre-configured this switch to support Dante traffic with the appropriate treatment for a stable experience.

Below shows a line diagram of a sample IP camera setup:

Finally, we can pair the cameras and other IP peripherals to the codec. This is done the usual way via the device's Web Admin UI under the Device Management section. The screen capture below shows 2 IP Cameras paired to the system along with the touch panel and speaker/mic. Note: Do not connect the cameras via USB to the codec!

Conclusion
In today's fast-paced digital world, ensuring seamless connectivity and reliable performance for video and audio peripherals is crucial. The HP Poly Modular Room technology allows IP cameras and other network peripherals to be connected to Teams Room on Android. In this blogpost, we have provided a comprehensive guide to setting up and configuring the Netgear ProAV line of switches, specifically the M4250-9G1F-PoE+ (GSM4210PD) and M4250-26G4F-PoE+ (GSM4230P) models for a supported configuration.

1. Microsoft Places
One of the most exciting announcements at this year's Ignite is the general availability of Microsoft Places. This AI-powered workplace solution is designed to enhance flexible work by integrating with Microsoft 365 Copilot and Teams. Microsoft Places facilitates coordination among hybrid teams, modernizes employee interactions, and optimizes space management. 

• Recommended In-Office Days with Copilot: Deciding whether to go to the office can be challenging. Copilot in Places simplifies this decision by recommending if today is a suitable day to be in the office based on your scheduled meetings, your coworkers' attendance, and any guidance from leadership.
• Managed Booking with Copilot: Managing room bookings can be a hassle, especially with constantly shifting schedules. Copilot in Places helps you manage room bookings seamlessly, ensuring you always have the right space to work and avoiding last-minute rushes.
• Places Finder: Not all meeting rooms and desks are the same. Use Places Finder, your booking helper, to save time and find the right space and technology you need.
• Workplace Presence: Workplace presence helps you coordinate meetings and teamwork in the office. It updates automatically when you connect your laptop to in-office devices. Users can also manually set their location and see who is nearby in chats to plan lunches or meetings.
• Space Analytics with Copilot: Optimizing space for a hybrid workforce can be challenging without proper visibility into employee attendance and space usage. Space analytics leverages occupancy and utilization insights along with Copilot recommendations derived from intent data, check-ins, and device signals to make better space decisions.
• Team Guidance: Creating the right in-person cadence for your team can be challenging. Use team guidance to identify the purpose of office days, meet group needs, establish expectations, and adjust the rhythm accordingly.
• Quick Book: Forgetting to book meeting rooms can cause a last-minute rush. Places helps by prompting room bookings and offering recommendations. You can view suggested rooms and quickly book them in bulk for the day, ensuring all meetings have a space.

2. Microsoft Teams Meetings, Webinars, and Town Halls

Copilot in Teams: Analyzing Content Shared On-Screen: Copilot provides a 360-degree view of meetings by analyzing spoken words, chat messages, and on-screen content. This comprehensive data enables users to ask Copilot to summarize or find specific information from screen-shared content, consolidate insights across both the conversation and presentation, and draft new content based on the entire meeting.

3. Microsoft Teams Phone: Enhancing Communication
Survivable Branch Appliance (SBA) – 7-Day Token: The Survivable Branch Appliance (SBA) update allows users to make PSTN calls during network outages by using expired tokens for up to 7 days. This ensures connectivity for an extended period during outages

Delayed Simultaneous Ring Settings: Delayed simultaneous ring helps teams by reducing noise and distractions. It ensures calls reach the intended recipient first, which is particularly beneficial for roles like delegates and customer service teams.

Queues App Available on Teams Phone Devices: The Queues app for Microsoft Teams is now available on phone devices. Agents can manage customer interactions, opt in or out of queues, and access detailed call history, ensuring they provide personalized and effective customer service.
​
Speed Dial Support on Line Keys: Configuring line keys for speed dial can greatly enhance the calling experience, especially for high call volume users. This setup is ideal for busy office environments and multitasking, improving efficiency and productivity.
Collaborative Call Delegation on Teams Phone Devices: Teams phone device users can now share their phone line with a specific group. This feature allows group members to receive and initiate calls on behalf of others, enhancing communication and collaboration.

4. Teams Room and Devices

Digital Signage in Teams Rooms on Windows:Admins can now configure Teams Rooms on Windows to display dynamic content when not in use. Settings can be managed tenant-wide or room-specific from the Teams Rooms Pro Management portal. Integrations with third-party providers like Appspace and XOGO are supported.

Speaker Recognition: Speaker recognition will be available for Teams BYOD rooms in early 2025. It allows intelligent recaps and Copilot value in any Teams meeting space, recognizing participants' voices. A Teams Premium license is required for the meeting host in BYOD rooms.

Automatically Set Workplace Presence in a BYOD Room: Connecting to peripherals in a BYOD room will now automatically set your workplace presence to 'In the office', with required permissions. This feature enhances connectivity with co-workers and supports future intelligent booking solutions.

Microsoft Device Ecosystem Platform: Based on the Android Open-Source Project (AOSP), the Microsoft Device Ecosystem Platform allows device makers and developers to design secure and dependable solutions, supported by Microsoft’s focus on trust, accessibility, and easy management. New partnerships include AudioCodes, Lenovo, MAXHUB, SHURE, MediaTek Genio 50, AmTRAN, and Thundercomm.

5. Fundamentals & IT Admin

Copilot in Teams admin center: simplifies administrative tasks such as setting up protected meetings and assigning phone numbers to users. It also provides valuable insights into configured policies, helps troubleshoot poor meeting quality, and offers configuration recommendations. These features are designed to enhance and optimize the overall Teams experience.

Important
Note that MC665936 is not the same as other messages MC674247, MC726113 and MC902778 which are related to Intune ending support for Android device administrator on devices with GMS. Note that Teams Android devices do not use GMS and therefore are not impacted by these other notifications.

Preparation Steps
​The shift to AOSP Device Management is driven by the need for a more robust and flexible mobile device management (MDM) method. AOSP Management offers several advantages over the traditional Device Administrator, including better support for new features, improved security policies, and a more streamlined enrollment process. In preparation for the migration to AOSP, it is important to keep Device Administrator enrolment enabled until AOSP enrolment is released by both Microsoft and the ODM firmware. Below is a step-by-step guide on preparing the environment:

Step 1: Set Up New AOSP Management Enrollment Profiles
In the Intune Management Console:

1. Select Devices > Enrollment > then Android.
2. Under Enrollment Profiles, select Corporate-owned, user-associated device.
3. Select Create policy.

Use the following settings for the profile configuration:

• Name Give the profile a name like 'AOSP – Teams Devices'.
• Description Put in a description so others in the organization know what this enrollment profile is used for. Use something like 'This AOSP Management enrollment profile is to allow Teams Android Devices to enroll in Intune'.
• Token expiration date This defaults to 65 years into the future and is best left at 65 years to avoid policy expiration which would block enrollment.
• Wi-Fi Select Not configured.
• Microsoft Teams devices Select Enabled"

Step 2: Set Up AOSP Intune Configuration Policies
Although not mandatory, setting up configuration and compliance policies can enhance device functionality and security. These are not automatically migrated from Device Administrator and we need to re-create AOSP policies for device restrictions and compliance settings like device health, OS version, and data encryption. Teams Android Devices that are enrolled in AOSP Management support both Intune configuration policies and Intune compliance policies

Currently, the only supported configuration policy for Teams Android Devices enrolled with AOSP Management is the Device Restrictions profile and only the “block screen capture” restriction inside of that profile. Support for more configuration policies is planned in the future. To create AOSP Management Configuration Policies, in the Intune Management Console:

1. Select Devices > Configuration.
2. Select Create > New Policy.
3. For Platform select Android (AOSP).
4. Under Profile type select Device Restrictions, then select Create.
5. Provide a name and description for the policy, then select Next.
6. Under General set Block screen capture to Yes, then select Next.
7. Assign this profile to all devices or an Entra ID group of devices, select Next, then select Create.

Step 3: Set Up AOSP Intune Compliance Policies
There's currently a limited set of supported compliance policies for Teams Android Devices enrolled with AOSP Management but more are planned for in future releases:

• Device Health Rooted devices (Block).
• Device Properties Minimum OS version.
• Device Properties Maximum OS version.
• System Security Require encryption of data storage on device.

​To create AOSP Management Compliance Policies, in the Intune Management Console:

1. Select Devices > Compliance, then Create policy.
2. Under Platform > Android (AOSP), then select Create.
3. Provide a name and description for the policy.
4. Select Next.
5. Enable the desired compliance settings from the supported list.
6. Select Next, then select Next.
7. Assign this profile to all devices or an Entra ID group of devices.
8. Select Next, then select Create.

What's next?
Now that the environment is prepared, the next phase is to wait for the release of AOSP capable firmware from ODMs for Teams devices. Until then, Device Administrator is still required and used for Teams devices signing-in to company portal for Teams.

What is SCEP?
SCEP is a protocol used for managing digital certificates. It automates the process of certificate enrollment, renewal, and revocation, reducing the administrative burden and enhancing security. SCEP is particularly useful in environments with a large number of devices, as it streamlines the certificate management process. PolyOS, the operating system powering Poly's range of Teams Room on Android devices, has integrated SCEP to enhance security and simplify certificate management. Here are some of the key features:

1. Automated Certificate Enrollment: SCEP automates the process of enrolling devices for digital certificates. This means that devices running PolyOS can automatically request and receive certificates from a SCEP server, reducing the need for manual intervention
2. SAN Generation: PolyOS can automatically generate the Subject Alternative Name (SAN) based on the configured hostname and domain. This feature is available for PolyOS versions 4.3 and 6.3, making it easier to manage certificates for devices with multiple hostnames
3. Network and Web Server Authentication: On voice devices, the certificates obtained through SCEP are used for network authentication. On video devices, these certificates are used for both network authentication and web server authentication, ensuring secure communication across different platforms
4. PolyOS is compatible with a wide range of SCEP servers, including Microsoft NDES, Cisco ISE, OpenSCEP, and more. This flexibility allows organizations to choose the SCEP server that best fits their needs1.
5. Easy Configuration: Configuring SCEP in PolyOS is straightforward. Users can enable SCEP through the system web interface or provisioned via Poly Lens and specify the SCEP server URL and challenge password along with the necessary certificate attributes.

Things to Note

• The TC8/10 touch controller syncs settings automatically from its paired Poly G7500 system or Poly Studio X video bar. Therefore, it is strongly recommended to configure or pair the touch controller in a staged network before moving to an 802.1x enabled network. Note that SCEP Settings can't be configured via the touch controller which displays SCEP and 802.1x settings as read-only. The touch controller syncs all SCEP and 802.1x settings from the paired codec.
• Only HTTP SCEP server URLs are currently supported. The SCEP challenge password must be configured as a static password. Only a single set of credentials is shared between the Poly G7500 system or Poly Studio X video bar and the Poly touch controller.
• A 3072-bit encryption certificate is a more secure type of digital security key compared to shorter 2048-bit keys, ensuring better security for sensitive information. The 3072-bit certificate identifies the device for network access such as 802.1x, Simple Certificate Enrollment Protocol (SCEP), and web proxy.
• We can provision 3072-bit certification for all devices via SCEP in Poly Lens. When the 2048-bit certificates expire, the SCEP server sends 3072-bit certificates.
  
• The default Common Name (CN) attribute is the serial number of the device. Customize this setting in the system web interface or via provisioning. The Subject Alternative Name (SAN) must include the host name or Fully Qualified Domain Name (FQDN). The other name attribute is the email address
  

For this deep dive we have setup Microsoft NDES on Windows Server 2022 standard as the SCEP server. This server also functions as a Domain Controller and an Enterprise Root CA but in production environments, it is recommended that the Enterprise CA, Domain Controllers and NDES servers be run on separate servers. Setup instructions for NDES is beyond the scope of this blogpost but can be referenced here:https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip---how-to-configure-ndes-for-scep-certificate-deployments-in-intune/455125

For the configuration of our NDES Lab server, we have the following roles installed:

After installing the roles, we configured the NDES server with the default settings. To configure the SCEP challenge password as a static password, we need to modify the following registry setting

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\UseSinglePassword = 1

To confirm that the NDES SCEP service is running, we can navigate to the URL http://<NDESServerFQDN>/certsrv/mscep and we should get the page as shown below:

With this password, we can now proceed to enroll for a SCEP certificate. This can be done either via the system web interface or provisioned via Lens. For the system web interface, navigate to Security->Certificates and we enable the "Enable SCEP" checkbox under the SCEP section, we click on "View and Update" to input the SCEP parameters.

In the SCEP configuration page, we need to input the necessary parameters. The SCEP challenge password needs to be copied from the MSCEP_Admin webpage. Note that the SCEP Server URL needs to have the mscep.dll appended. eg http://<serverFQDN>/certsrv/mscep/mscep.dll. Not all fields are necessary and we only need to fill in those marked as required:

When ready, click on the "Save" button at the bottom of the page and the system will submit the request to our NDES server to enroll for a certificate. When successful, the web browser will logout and refresh with the newly acquired certificate used for the https connection which will display a warning that the connection is not private. Simply ignore this and click to proceed to login: We will now see that the certificate is shown along with the CA Root certficate and that the SCEP Status states "SCEP Certificate is installed" as shown below:

Similarly, we can see the certificates installed on the TC8 touch controller as well as shown below:

As mentioned earlier, SCEP can also be provisioned in a similar manner via Lens. To do this, navigate to the Lens portal inventory page, select the device required, then go to Security->SCEP and enter the required parameters and click "Apply":

​In conclusion, the integration of SCEP in PolyOS enhances security and simplifies certificate management for organizations. By automating the process of certificate enrollment and renewal, SCEP in PolyOS provides a robust and flexible solution for your certificate management needs.

What is Speaker Recognition?
Speaker recognition technology analyzes the unique vocal characteristics of each participant, creating a “voiceprint” similar to a fingerprint. This allows Teams Rooms to identify and attribute each speaker accurately during meetings which in turn allows Copilot to generate responses to chat questions on what each participant in the room has spoken. Without speaker recognition and attribution in the transcript, Copilot can only respond to queries on what someone in the room has said, and not who specifically has said it. 

Benefits of Speaker Recognition

• Noise Suppression: Background noise is minimized, making conversations clearer.
• Intelligent Recap: Copilot can provide detailed summaries and insights by identifying who said what.
• Enhanced Transcripts: Meeting transcripts are more precise, attributing comments to the correct individuals.

How to Enable Speaker Recognition
Firstly, users who have a Copilot license can create a voice profile in the Teams desktop app. But first IT admins need to enable this feature for their organization using Teams meeting policies and PowerShell scripts. The powershell cmdlet to enable this at the global level for all users is:

​set-CsTeamsMeetingPolicy -EnrollUserOverride Enabled -identity Global -RoomAttributeUserOverride Attribute -RoomPeopleNameUserOverride On -AllowTranscription $True

The output of this is shown below:

Once this is done, users can now access the Recognition tab in their Teams client and record their voice profile as well as their facial profile which is then securely stored in the Teams cloud. This is shown in the screenshot below:

Users can update or remove their voice and face profiles at any time. Now that we've created the profiles, we can proceed to join a meeting from an MTR on Windows device and see if the new AI powered speaker recognition can correctly identify the speaker in the room. Below is a recap of the short 5min meeting where I am joining from my HP G9 MTR PC connected to a HP Poly Studio R30 speaker bar: Note that it already has identified me correctly from my voice as can be seen in the timelines below the video as I playback the meeting:

It's worth nothing that there's a small <1% of the transcript where it did not recognize my voice and showed "Speaker 1" instead, I've attached the full transcript of the meeting at the bottom of this blogpost for anyone who wishes to see the details.

Security and Privacy
Microsoft ensures that voice and face data are encrypted and stored securely, complying with GDPR and other privacy regulations6. Users can unenroll their profiles at any time, with data automatically deleted if not used for a year.
​
Future Developments
This exciting new feature will soon be available for Teams desktop in BYOD meeting spaces and Teams Rooms on Android devices later this year. While hardware based intelligent speakers offer the highest quality, this update makes advanced speaker recognition accessible to more users on any MTR device, without any special hardware.