{"id":4076,"date":"2023-04-17T13:05:45","date_gmt":"2023-04-17T12:05:45","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=4076"},"modified":"2023-04-17T13:05:45","modified_gmt":"2023-04-17T12:05:45","slug":"dynamic-membership-rule-for-teams-room-accounts","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2023\/04\/dynamic-membership-rule-for-teams-room-accounts\/","title":{"rendered":"Dynamic membership rule for Teams Room accounts"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Teams Room accounts are usually excluded from conditional access. To do so, they have to be in a security group, which of course we don&#8217;t want to do manually.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most companies choose to use a naming standard and simply use that as a rule to create an exclusion group. This is easy to circumvent, I can create a guest user \/ get invited with the right name et voila zero CA policies!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A better way is to identify the accounts based on their assigned licenses, e.g. Teams Rooms Basic (6af4b3d6-14bb-4a2a-960c-6c902aad34f3). This, however, is not supported as an Azure AD group membership rule as this is stored in the AssignedLicenses property which will throw an &#8220;Unsupported Property&#8221; error. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The assignedPlans property however does contain the GUID we need. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The following Azure AD Group dynamic membership rule only matches users that have a Teams Room Basic, Teams Room Standard or Teams Room Pro license:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(\n\t(\n\t\tuser.assignedPlans -any (\n\t\t\tassignedPlan.servicePlanId -eq \"8081ca9c-188c-4b49-a8e5-c23b5e9463a8\"\n\t\t\t-and \n\t\t\tassignedPlan.capabilityStatus -eq \"Enabled\"\n\t\t)\n\t) -or \n\t(\n\t\tuser.assignedPlans -any (\n\t\t\tassignedPlan.servicePlanId -eq \"ec17f317-f4bc-451e-b2da-0167e5c260f9\"\n\t\t\t-and \n\t\t\tassignedPlan.capabilityStatus -eq \"Enabled\"\n\t\t)\n\t) -or \n\t(\n\t\tuser.assignedPlans -any (\n\t\t\tassignedPlan.servicePlanId -eq \"92c6b761-01de-457a-9dd9-793a975238f7\"\n\t\t\t-and \n\t\t\tassignedPlan.capabilityStatus -eq \"Enabled\"\n\t\t)\n\t)\n) -and not (\n\tuser.assignedPlans -all (assignedPlan.servicePlanId -eq \"\")\n)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">if you want to do something similar for other licenses, here are the options\/combinations:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/MicrosoftDocs\/azure-docs\/blob\/main\/articles\/active-directory\/enterprise-users\/licensing-service-plan-reference.md\">https:\/\/github.com\/MicrosoftDocs\/entra-docs\/blob\/main\/docs\/identity\/users\/licensing-service-plan-reference.md<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Teams Room accounts are usually excluded from conditional access. To do so, they have to be in a security group, which of course we don&#8217;t want to do manually. Most companies choose to use a naming standard and simply use that as a rule to create an exclusion group. This is easy to circumvent, I &hellip; <a href=\"https:\/\/lieben.nu\/liebensraum\/2023\/04\/dynamic-membership-rule-for-teams-room-accounts\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Dynamic membership rule for Teams Room accounts<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[7,18,21,27,32,43],"tags":[],"class_list":["post-4076","post","type-post","status-publish","format-standard","hentry","category-azuread","category-exchange-online","category-identity","category-microsoft-teams","category-office-365","category-security"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=4076"}],"version-history":[{"count":0,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4076\/revisions"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=4076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=4076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=4076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}