Teams Rooms not signing in: MFA, passwords and policies

Most Teams Rooms sign-in failures come from security policies that a room can't satisfy. The usual culprits are interactive MFA, an expired password, a sign-in frequency policy or a Conditional Access rule. A Teams Room has no person to approve an MFA prompt, so Microsoft recommends excluding resource accounts from interactive MFA. Secure them with trusted network locations and Intune device compliance instead, and set their passwords to never expire.

Quick diagnosis

Symptom	Likely cause	Fix
Room signs out after weeks or months	Password expired	Reset password; set the account's password to never expire
Sign-in fails with MFA prompt	Interactive MFA on the resource account	Exclude the account; use location and device compliance
Signs out on a schedule	Conditional Access sign-in frequency	Exclude resource accounts from sign-in frequency
"Blocked by Conditional Access"	Policy requires something the room can't do	Review Entra sign-in logs and adjust the policy
Stuck at self-service password reset or "more information required"	SSPR or security info registration enforced	Exclude resource accounts from registration policies
Signed in but no calendar	Mailbox or calendar processing issue	See calendar sync failed
"No license found"	License missing or not applied	See license errors

Why MFA breaks Teams Rooms

Teams Rooms on Windows signs in without user interaction and doesn't support interactive second factors. Microsoft's guidance is not to use interactive MFA, smart cards or certificate-based authentication on resource accounts. Android devices and panels have the same issue: there's no second device to approve the prompt.

Recommended Conditional Access setup

Microsoft's guidance for resource accounts:

1. Put all room resource accounts in one Microsoft Entra group. A naming prefix like mtr- makes a dynamic group easy.
2. Exclude that group from existing Conditional Access policies that require user interaction.
3. Create a dedicated policy for the group that requires:
   • Sign-in from a trusted named location (your office IP ranges), and
   • A compliant device, enforced with Intune.
4. Limit the policy to the apps rooms need, such as Teams, Exchange Online and SharePoint, and block legacy authentication.
5. Exclude resource accounts from sign-in frequency controls.

Conditional Access requires Microsoft Entra ID P1 or P2. Device compliance on Windows rooms needs the device enrolled in Intune. See Teams Rooms with Intune and Autopilot.

For Android devices, the manufacturer and model are passed to Conditional Access at sign-in. You can use that to allow or block specific device models.

Password expiry

When a resource account's password expires, the room signs out and stays signed out until an admin resets the password and signs it back in. Set room account passwords to never expire, and use a long, unique password stored in your password vault.

Verification codes and remote sign-in

For Teams Rooms on Android and Teams panels, admins can sign devices in remotely from the Teams admin center using a verification code, so you don't have to share the room password with an on-site technician. See managing Teams Rooms in the admin center.

If a device shows a code to enter at a Microsoft sign-in page, the code expires after a short time. Request a new one if it does.

Passwordless sign-in

Resource accounts rely on a password plus non-interactive controls. Passwordless methods that need a person to approve sign-in, such as authenticator push or security keys, don't fit unattended rooms. Check Microsoft's current Teams Rooms authentication documentation before applying a tenant-wide passwordless policy, and exclude room accounts if needed.

Step-by-step fix

1. Open the Microsoft Entra sign-in logs and filter by the room's account.
2. Read the failure reason and which Conditional Access policy applied.
3. Adjust or exclude as above.
4. Reset the password if it expired, and set it to never expire.
5. Sign the room back in, on the device or remotely.
6. Confirm the license and calendar.

More: create a resource account, Teams Rooms requirements, Teams Rooms troubleshooting.

Rolling out rooms under strict security policies? Talk to us about deployment planning.

Related guides

• Teams Rooms "No License Found" and License Not Applying
• How to join a meeting from a Microsoft Teams Room
• Teams Rooms Basic vs Pro: license differences explained
• Teams Rooms End of Life and Unmonitored Devices
• Teams Rooms on Windows vs Android: which to choose
• Teams Rooms Pro Management portal explained

All troubleshooting →