Introduction
Microsoft Teams provides a growing portfolio of devices that can be used as desk and conference room phones. These IP phones run on Android 8.x or 9.x and are required to be enrolled in Intune. By default, these devices are enrolled as personal devices, which is not ideal as users should not be able to enrol their own personal Android devices.
Microsoft Teams and Intune Application Protection Policy
Intune app protection policies are used to secure and manage corporate data on mobile devices. These policies allow you to specify restrictions on how corporate data can be accessed and used and can be applied to specific apps or groups of users. Intune app protection policies can be used in conjunction with other mobile device management (MDM) policies to provide a comprehensive approach to mobile device management.
Microsoft Teams IP phones do not currently support application protection policies. However, you can use other Microsoft Teams features, such as data loss prevention (DLP) policies and compliance policies, to help protect and manage corporate data within Microsoft Teams. These policies can be used to prevent the accidental or unauthorized sharing of sensitive information, and to ensure that data is handled in accordance with your organisation’s policies.
Microsoft Teams Device Intune Enrollment
To properly enrol and manage these devices in Intune, follow these steps:
- Allow the enrollment of corporate (platform) Android Device Administrator type devices. This will enable users to enrol their Poly Teams devices as corporate-owned devices. Personal device enrollment should remain blocked.
- Add the serial numbers of the Poly Teams devices to Intune as corporate device identifiers. This will ensure that the devices are labelled as “Corporate Owned” in Intune. The serial numbers can be added manually, with a description of the device, through a delegated capability as needed.
- Exclude the Teams devices from the “App Protection CA policy” using a filter that specifies the manufacturer. In the image below we have created one for “Poly.” As we have mentioned earlier MS Teams.
- Devices do not support Application Protection Policies and must be excluded from this policy in order to function properly. Note: Negative filtering must be used for the exclusion device filtering to work in case of unmanaged devices.
- Have users sign in and enrol their Poly Teams devices. The device status will update in the Corporate Device Identifiers once the enrollment process is complete and the device will be classified as a corporate device.
By following these steps, you can effectively enrol and manage Poly Teams devices in Intune. This will ensure that these devices are properly represented as corporate-owned and can be properly managed and secured within your organisation.
