Deployment guide Published 30 July 2026 · by Jack Worley, Operations Director & Jamie Murray, CTO

The Teams Rooms Pre-Install Checklist: What Your IT Team Sets Up Before We Arrive

A Teams Rooms install succeeds or stalls on work done in your Microsoft 365 tenant, not in the room. This is the checklist we walk every customer through before an engineer arrives.

Five steps: licence, resource account, calendar behaviour, sign-in posture, network. Every one last verified against Microsoft's documentation in July 2026, with the source linked.

The Teams Rooms pre-install checklist at a glance

Before a Microsoft Teams Rooms device can go live, your IT team needs to:

1Assign a Teams Rooms licence (Basic or Pro) to each room's resource account. Choose Pro for any managed, conditional-access-protected or calling-enabled room.
2Create one room-mailbox resource account per room with a sign-in account enabled, its UPN matching its SMTP address.
3Configure Set-CalendarProcessing on each room account: auto-accept bookings, keep the meeting subject and body, accept external organisers.
4Set the room account's password to never expire and exclude it from interactive MFA, securing it with a dedicated conditional access policy instead.
5Open the Microsoft 365 network endpoints from every room, then let each device self-enrol in Intune and the Teams Rooms Pro Management Portal.

Each step is broken down below, with Microsoft's source linked.

Teams Rooms prerequisites: Microsoft's deployment order puts prep first, install last

Microsoft's own deployment guide puts physical installation last. Before a device goes on the wall, it expects the customer side to have completed:

1Order equipment and confirm the spaces: certified devices chosen, rooms checked against the deployment dependencies
2Prepare the network: Microsoft 365 endpoints reachable from every room
3Create a resource account per room: the calendar people book and the identity the device signs in with
4Enable the Pro Management Portal: and assign admin roles
5Configure Intune: enrolment and compliance for the devices

Microsoft's planning task list assigns the three core prerequisites (site readiness, network readiness and resource accounts) to the customer's IT project team.

Source: Deploy Microsoft Teams Rooms and Plan for Microsoft Teams Rooms.

Step 1: choose and buy the room licence

Every room account needs a Teams Rooms licence assigned before the device can be used. There are exactly two:

	Teams Rooms Basic	Teams Rooms Pro
Price	Free with a certified device	£30.80 per room/month ex VAT (Microsoft UK list as of July 2026, paid yearly)
Limit	25 licences (25 rooms) per organisation	No cap
Teams panels	Not supported	Supported
Included plans	None	Intune, Entra ID P1, Teams Phone Standard, Defender for Endpoint P2
Management	Basic inventory and updates only	Full Pro Management Portal: remote config, health alerts, analytics
Best for	A handful of unmanaged rooms	Any managed, CA-protected or calling-enabled estate

Because Pro bundles Intune and Entra ID P1, it is effectively the prerequisite for the conditional access and device management steps below.
PSTN calling needs Teams Phone (bundled in Pro) plus a calling plan or operator connectivity on top.
Confirm the current price with Microsoft or your reseller when you buy; list prices change.

Sources: Teams Rooms licences (feature split) and Microsoft's UK pricing page (price). For what rooms cost end to end, see our Teams Room cost guide.

Step 2: set up one Teams Rooms resource account per room

The resource account is both the calendar people invite and the identity the device signs in with. One per physical room; if a room has several Teams devices (a room system plus a door panel), they all share it. Create it as a room mailbox with a sign-in account enabled, in the Microsoft 365 admin centre (Resources, then Rooms & equipment) or one line of PowerShell:

New-Mailbox -MicrosoftOnlineServicesID mtr-boardroom@yourdomain.com -Name "Boardroom" \
  -Alias mtr-boardroom -Room -EnableRoomMailboxAccount $true \
  -RoomMailboxPassword (ConvertTo-SecureString -String '<password>' -AsPlainText -Force)

Name accounts with a standard prefix like mtr- (Microsoft's own recommendation, and it makes dynamic device groups easy later).
Untick 'require this user to change their password when they first sign in' when setting the password; forcing a change breaks device sign-in.
The account's UPN must match its SMTP address.
Change the mailbox time zone: new resource accounts default to Pacific Standard Time, which displays every booking eight hours off until corrected.
Microsoft recommends cloud-only accounts. Exchange on-premises mailboxes need hybrid configured before the device can read the calendar.

Source: Create and configure resource accounts.

Step 3: tune how the room handles bookings

Exchange's defaults strip meeting subjects and bodies and reject external organisers. That is sensible for a projector and wrong for a meeting room. Microsoft's recommended Set-CalendarProcessing values for Teams Rooms are AutomateProcessing AutoAccept, DeleteComments $false, DeleteSubject $false, AddOrganizerToSubject $false, ProcessExternalMeetingMessages $true and DeleteAttachments $true. Here is what each one does:

Setting	Why it matters
AutomateProcessing: AutoAccept	AutoAccept makes the room accept or decline bookings automatically from its own availability, and it is the prerequisite for the settings below.
DeleteComments: $false	DeleteComments $false keeps the meeting body on the room calendar; the body carries third-party join links, so without this setting one-touch Zoom and Webex join buttons never appear.
DeleteSubject: $false	DeleteSubject $false keeps meeting titles on the room calendar.
AddOrganizerToSubject: $false	AddOrganizerToSubject $false stops the organiser's name overwriting the meeting title.
ProcessExternalMeetingMessages: $true	ProcessExternalMeetingMessages $true lets the room accept invites from external organisers; the default rejects them silently.
DeleteAttachments: $true	DeleteAttachments $true keeps attachments off the resource calendar; room devices cannot open them anyway.

Sources: Microsoft's recommended values and the Set-CalendarProcessing reference.

Step 4: get the sign-in posture right

Most failed installs and mystery sign-outs trace back here. Two rules, both Microsoft's own:

Password never expires

Stated by Microsoft as a requirement for shared Teams devices, not a preference.
An expired password signs the room out until an admin intervenes.
If policy prohibits it, Microsoft's guidance: create an exception for device resource accounts.

Turn interactive MFA off; secure with conditional access instead

The device signs in non-interactively; there is no user to approve a prompt, so interactive MFA, smart cards and client certificates must not be configured on room accounts.
Secure them with the factors Microsoft names, compliant device and known network location, via a dedicated conditional access policy.
Exclude room accounts from your other CA policies; CA requires Entra ID P1 (bundled in Pro).

Sources: Teams Rooms authentication and Conditional access and compliance for devices.

Step 5: network, then device management

Network

Wired connection for the room system wherever possible.
Allow the Microsoft 365 endpoint categories through your firewall and proxy. Use Microsoft's published, continuously updated list rather than maintaining your own.

Device management

Android rooms and panels enrol in Intune automatically at first sign-in; enrolment is mandatory for them to sign in at all.
Every device (Windows or Android) enrols itself into the Pro Management Portal once signed into Teams, with no manual agent installs. Older guides describing manual MSI installs are out of date.

Sources: Office 365 URLs and IP address ranges, Deploy Microsoft Teams Rooms and Enrol a device.

Running older Android devices? Microsoft extended Teams certification for Android 10 and 11 devices to 3 September 2026. Our certification guide lists which Poly and Neat models that covers.

What we need on install day

With the checklist done, install day is short. Our engineer needs:

The room account's email address and password, ready to sign the device in
The licence already assigned to that account
A network point in the room that reaches the Microsoft 365 endpoints
Someone from IT reachable if a conditional access policy blocks first sign-in

Then we mount, cable, sign in, commission, run a live test call from both ends and hand over. When the tenant work is not done, install day becomes a waiting game between your IT team and an engineer standing in a meeting room. That is what this checklist exists to prevent.

Take this checklist with you

Get the whole checklist as a branded PDF to hand straight to your IT team: every step and every Microsoft source from this page, in a format you can attach to a ticket.

Pre-install questions, answered

Microsoft offers exactly two current licences. Basic is free with a certified device but is capped at 25 licences (25 rooms) per organisation, cannot be used on Teams panels, and does not include Intune, Entra ID P1, Teams Phone or the Pro Management features. Any room you want managed, covered by conditional access, or able to make phone calls effectively needs Pro. Microsoft's UK list price is £30.80 per room per month ex VAT as of July 2026, paid yearly, and should be confirmed with Microsoft or your reseller at purchase.

Only if you allow it. The room account's ProcessExternalMeetingMessages setting defaults to rejecting invites from organisers outside your Exchange organisation. Microsoft's Teams Rooms guidance recommends setting it to true so that externally organised meetings, including external meetings forwarded by your own staff, land on the room calendar.

No. Microsoft states that Teams Rooms resource accounts must not be configured for interactive MFA, smart card or client-certificate authentication, because the device signs in non-interactively and there is no user to approve a prompt. Secure the account instead with the factors Microsoft names: a dedicated conditional access policy built on known network location and compliant device, with the room accounts excluded from your other CA policies. Conditional access requires Entra ID P1, which is bundled in the Pro licence.

Microsoft states that setting the password to never expire is a requirement for shared Teams devices. An expired password signs the room out and it stays out until an admin intervenes. If your organisation prohibits non-expiring passwords, Microsoft's guidance is to create an exception for Teams device resource accounts.

One resource account per physical room, created as a room mailbox with a sign-in account enabled (in the Microsoft 365 admin centre or via New-Mailbox with EnableRoomMailboxAccount). Its UPN must match its SMTP address, it needs a Teams Rooms licence assigned, a password set to never expire with no forced change at first sign-in, no interactive MFA, and calendar processing configured to keep meeting subjects and bodies. Microsoft recommends a standard naming prefix such as mtr- and cloud-only accounts where possible.

A wired connection wherever possible, with the Microsoft 365 endpoint categories allowed through your firewall and proxy from the room's network. Microsoft publishes and continuously updates the full endpoint list (Office 365 URLs and IP address ranges), and recommends using that list rather than maintaining your own. If a conditional access policy restricts sign-in by location, the room's network must be a known, permitted location.

By install day the tenant work should be done: the resource account created and licensed, its password set (never expiring, with the change-at-first-sign-in requirement unticked), calendar processing configured, and the network ready with Microsoft 365 endpoints reachable from the room. The installer then needs the room account's email address and password to sign the device in, run a live test call and hand over.

Planning rooms? See our Teams Rooms service or start a project. Rooms already installed but misbehaving? Our troubleshooting guides and support cover it, whether we installed your rooms or not.

All Microsoft guidance cited from learn.microsoft.com pages, last verified July 2026. Check the linked sources for changes before acting.