SBC certificate chain and client auth changes

Hello Readers, I hope you’re well.

Welcome to Episode 69 of the UCStatus Podcast. This episode features me (@randychapman), Mark Vale (@markvale) and Shawn Harry (@shawnharry).

Since the last one we did was July, I got a bunch of stuff from the Message Centre on Teams general, phone and rooms and meetings stuff. Here’s the list…

Phone and Other Teams

• Introducing Express setup for auto attendants and call queues in Teams admin center – Voice Apps Express Setup in Teams Admin Center is now generally available, offering a simplified, guided setup for Auto Attendants and Call Queues with minimal configuration, built-in testing, and easy transition to classic setup. Ideal for SMBs, quick deployments, and first-time admins, it requires no activation.
• Microsoft Teams: Microsoft Graph APIs for Teams administration now available in beta – Microsoft Graph beta now offers Teams administration APIs for user configuration, number management, and policy assignment. These enable automation and integration for Teams management, accessible with delegated or application permissions in commercial environments.
• Microsoft Teams | Know Your Customer (KYC) onboarding required for new phone number requests – Teams admins must complete a one-time KYC onboarding in the Teams Admin Center by submitting business info and documents before provisioning new phone numbers. The process, taking up to two days, applies globally and does not affect existing numbers.
• Microsoft Teams Premium will introduce ultra-low latency (ULL) for town hall attendees, reducing delay from 20-30 seconds to near real-time. Available from September to October 2025 for tenants using Microsoft eCDN or no eCDN
• Microsoft Teams will introduce a default setting allowing users to view incoming calls in a small, resizable window to reduce disruption.
• Microsoft Teams Premium: SMS support expands to Australia
• Rollout Pause – Line Key Configuration via Teams Admin Center
• Noise suppression for dial-in participants in Teams audio conferences
• Microsoft Teams is shortening meeting URLs by removing parameters to improve sharing and security
• Improvements in call transfer experience on Teams Phone devices – Microsoft Teams Phone devices will receive improved call transfer features by October 2025, enhancing speed, reliability, and UI clarity for blind and consult transfers across touch and non-touch devices
• Microsoft Teams Premium or Microsoft 365 Copilot: New translated recap after multilingual meetings
• Session Border Controllers (SBCs) acting as TLS clients towards Microsoft Teams infrastructure: Due to recent changes in Google’s Chrome root program, many public Certificate Authorities (CAs) will stop issuing certificates with the clientAuth Extended Key Usage (EKU).
  • Source Post

Rooms and Meetings

• Admin settings for Original Equipment Manufacturer (OEM) camera controls for Teams Rooms on Windows – Microsoft Teams Rooms on Windows will introduce an admin setting to disable OEM camera controls
• Microsoft Teams Rooms on Windows: Native PTZ controls – delayed to December
• Manage voice and face recognition for rooms (MTR-W/MTRA) via device settings – Microsoft Teams Rooms (Windows 4.19+, Android 3.6+) will have new admin UI for managing voice and face recognition, replacing PowerShell configuration. Voice recognition defaults to off. Rollout starts mid-October 2025. Enrollment requires user consent and is completed on-device. Surface Hub and Teams displays are not supported.
• Teams Rooms on Windows: Support for facilitator agent in scheduled and ad hoc meetings
• Simultaneous role-specific Teams Town hall and Webinar views in Teams Rooms on Windows
• Multi-stream IntelliFrame, Cloud IntelliFrame and Multiple camera view support in Webinar and Structured Meetings
• People count captured by Cloud IntelliFrame in the Pro Management portal reports
• Recommended actions page in the Teams Rooms Pro Management portal
• Room Recommender – Starting mid-November 2025, Microsoft Teams will auto-suggest meeting rooms via AI in chats if no room is booked, considering attendee location and room availability
• Cloud IntelliFrame now available on Teams Rooms for Android
• Enhanced peripheral data in Pro Management portal reports for BYOD spaces – Microsoft Teams is adding peripheral health reporting in the Pro Management portal for BYOD rooms and desks, enabling admins to detect device issues proactively. Room reports need a Teams Shared Devices license
• Microsoft Teams Rooms on Android: Town hall attendee experience
• Microsoft Teams: Multiple camera switching in Teams Rooms on Windows as a receiver
• Teams Rooms on Android and Teams Phone devices face calling and pairing failures due to Continuous Access Evaluation (CAE) policies affecting token validity. To ensure device stability and reliable calling, disable CAE on all Conditional Access policies for these devices, as this does not significantly reduce security.

Copilot Recap

Back by popular demand. Keep in mind that this was generated by AI and may not capture exactly what we said or the sentimenmt and context around it accurately.

• Microsoft Teams Admin and Voice Feature Updates: Randy, Mark Vale, and Shawn discussed recent updates to Microsoft Teams admin features, including the introduction of Express setup for auto attendants and call queues, the release of Teams admin Graph APIs in beta, and enhancements to phone number management and policy assignment, with Mark providing technical insights and practical experiences.
  • Express Setup for Auto Attendants: Randy introduced the new Express setup for auto attendants and call queues in the Teams admin center, and Mark explained that while it allows for quick basic setup, more advanced configurations like call back in queue still require the classic editor. The Express setup is a three-step process for initial configuration, after which full editing is available.
  • Comparison of Setup Methods: The group compared the Express setup, classic editor, and PowerShell approaches, with Mark noting that Teams admin center’s UI is improving and PowerShell’s role is diminishing for most users, though PowerShell remains useful for automation and complex scenarios.
  • Graph API for Teams Admin: Randy highlighted the release of Microsoft Graph APIs for Teams admin center in beta, enabling user configuration, number management, and policy assignment without PowerShell. Mark shared that these APIs were previously available to select providers and now allow for easier automation and provisioning, reducing resource requirements and enabling integration with tools like Power Automate.
  • Device and Policy Management via API: Shawn inquired about device management capabilities, and Mark clarified that the APIs focus on user accounts, allowing policy assignments to users, but device-specific management is still evolving. The discussion touched on the ongoing consolidation of management portals and the desire for a single pane of glass.
• Regulatory and Security Changes in Teams Telephony: The team, led by Mark and Randy, reviewed new regulatory requirements such as Know Your Customer (KYC) for phone number provisioning, discussed the global rollout of SMS features, and examined upcoming changes to certificate management and security policies affecting Teams telephony and devices.
  • KYC for Phone Number Requests: Mark explained that Microsoft now requires KYC checks for new phone number requests to comply with carrier regulations, involving identity and address verification to prevent fraud. Shawn linked this to Microsoft’s broader Secure Future Initiative, and Randy noted the process applies globally and takes about two days.
  • SMS Feature Expansion and Limitations: The group discussed the availability of SMS in Teams, with Mark noting that SMS is currently limited to the US and Australia, is text-only (no MMS), and subject to regulatory constraints. Mark shared experiences with the lengthy approval process for SMS enablement in the US.
  • Certificate Management Changes: Mark and Randy detailed upcoming changes to certificate requirements for SBCs (Session Border Controllers), including the need for client authentication parameters and shorter certificate validity periods, which will require more frequent renewals and potentially new automation or manual processes for customers.
• Conditional Access and Device Code Flow: Randy and Shawn discussed the impact of Conditional Access Evaluation (CAE) policies and device code flow on Teams devices, recommending that service accounts for Teams Rooms be excluded from CAE to avoid disruptions, and describing the technical details of device authentication and policy exclusions.
• Teams Rooms and Meetings Feature Enhancements: Randy and Shawn explored a range of new and upcoming features for Teams Rooms and meetings, including OEM camera control settings, delayed PTZ controls, room-level voice and face recognition management, multi-camera and multi-stream support, and AI-driven room recommendations, with practical commentary on deployment and management challenges.
  • OEM Camera Controls and PTZ Delays: Randy described the new admin setting to disable OEM camera controls in Teams Rooms on Windows, questioning the rationale behind making smart cameras ‘dumb.’ The group noted that native PTZ (pan-tilt-zoom) controls for Teams Rooms on Windows have been delayed again, impacting vendors who waited for Microsoft’s implementation.
  • Voice and Face Recognition Management: Randy explained the shift from user policy-based to room-based management for voice and face recognition in Teams Rooms, allowing more granular control but potentially increasing administrative complexity. The settings are now available at the device level for both Windows and Android.
  • Facilitator Agent and Note-Taking: The facilitator agent, now labeled ‘Take Notes,’ can be invoked in both ad hoc and scheduled meetings, providing a transcript and recap in Microsoft Loop. The team discussed the overlap with transcription features and the evolving naming conventions.
  • Multi-Camera and Multi-Stream Support: Randy highlighted the introduction of multi-camera view and multi-stream Intelliframe support for Teams Rooms on Windows, webinars, and town halls, noting that Android support lags behind and requesting parity across platforms.
  • AI-Driven Room Recommendations: Randy introduced the upcoming Room Recommender feature, which will use AI and location data to suggest available meeting rooms in Teams chats, leveraging the Places infrastructure for improved user experience.
• Teams Device Management and BYOD Challenges: Randy and Shawn discussed advancements in Teams device management, including enhanced configuration profiles, partial config for Android, and the complexities of managing BYOD (Bring Your Own Device) rooms, highlighting barriers to adoption and the need for better integration and automation.
  • Configuration Profiles and Partial Config: Randy described improvements in configuration profiles for Teams Rooms, including the ability to use partial config on Android, which allows central and local settings to coexist without overwriting each other, simplifying multinational deployments.
  • Device Health and Reporting Enhancements: The team noted the addition of health reporting for BYOD spaces and desks, enabling proactive device detection and issue management, provided the rooms have a shared device license.
  • BYOD Room Onboarding Barriers: Randy explained the cumbersome process required to onboard BYOD rooms into the Pro Management Portal, which involves multiple users plugging into each device, and Shawn emphasized that this is a significant barrier to adoption that Microsoft needs to address.
  • Integration with OEM Tools: The discussion covered the limitations of OEM management tools, which cannot provide full meeting telemetry, and the need for Microsoft to offer APIs for better integration, though the group agreed that using two tools is manageable for now.
• Security, Compliance, and Organizational Challenges: Shawn and Randy addressed the organizational complexities of managing security and compliance for Teams Rooms and devices, emphasizing the need for coordinated policies across IT silos and the risks of overly restrictive or uncoordinated conditional access policies.
  • IT Silos and Policy Coordination: Randy and Shawn discussed how different IT teams (Exchange, Intune, AD, etc.) often operate in silos, leading to misaligned policies that can inadvertently disrupt Teams Rooms functionality, and stressed the importance of cross-team collaboration for effective device management.

It was a fun discussion as always. Thanks for listening! Catch you next time.

As always, we’d love to hear your thoughts. Leave a comment below.

You can listen in-line in this post, or if you prefer, Spotify, Apple Podcasts, Amazon Podcasts, TuneIn or iHeartRadio. The links are below.

If you’ve enjoyed this or any other episodes of the UCStatus Podcast, why not take a second to subscribe, like and share.

We’d love to hear your comments and suggestions for future episodes so why not leave a comment.