Provisioning and managing Teams Phone is an extensive challenge to overcome. However, with the correct planning, operational procedures, and tooling you can achieve a consistent experience for your users and support teams.
It’s important that your first task is to plan the Teams Phone experiences your business needs and expects for seamless operation.
To do this, you need to create a profile for each user type within your business that matches the expected Teams Phone experience.
This is called a user persona. To be able to create a user persona, you need to first understand the business requirements along with the functional needs of each user so that you can create the required policies.
User Analysis
It’s tempting when moving from your old system to Teams to just create what you have today. You might think this is a guaranteed way to ensure migration success.
It isn’t. It’s a guaranteed way to create significant amounts of tech and management debt in your IT organization.
Following your original PBX configuration, users have become more comfortable with internet-based chat, calling, and meetings. Their reliance on phone features has greatly reduced.
Now is a good opportunity to discuss functional requirements with your department leaders so you get an up-to-date view of what’s important to them as a business unit to operate.
‼️ Don’t skip this step! In many cases, this step yields unexpected cost savings.
One way to collect this information is through an interview process. Setting dedicated time aside with each department leader to discuss their communication needs focuses the minds and will yield better engagement than sending out an email survey.
First, approach the leaders with your vision. Many department leaders won’t be aware IT is looking to transform their calling platform, so you don’t want this to be a surprise to them. Communicate with them early so they have time to come to terms with it and this will bring a more positive response during your interview process.
Schedule a meeting either face to face or virtual giving them at least two weeks to prepare. They’ll need time to reflect and evaluate their needs first, so giving them good notice will mean fewer meetings overall.
Be sure to send them a copy of the interview questions you’ll be asking along with some high-level information about how Teams Phone will work for them.
When creating your interview questions, be sure to ask the same questions to each department but leave room for them to bring additional information to your attention. The goal here is to align their needs with the native features of Teams to produce a gap analysis document.
| Question | Response |
| Basic Calling Needs | |
| How many of your users need to make external calls to suppliers or customers? | |
| How many of these users call international numbers? | |
| Do you know roughly how often your users rely on external calling? | Heavy | Moderate | Low |
| How many of your users receive incoming calls from external suppliers or customers direct to their own personal number? | |
| Shared Calling Needs | |
| How many of your users require infrequent / ad-hoc external calling? | |
| Could these users operate without access to such a feature? | |
| Advanced Calling Needs | |
| If a user is not available, what happens when a call is received on their number? | Goes to voicemail | Rings the office | Rings specific people | Rings out |
| Are there any users within your department who make or receive calls on behalf of others? | |
| Are there any numbers or places of origin that shouldn’t be able to contact your users? | |
| Service Functions | |
| Does your department have any call queueing needs? | |
| Do you know how callers reach your queue? | Call direct number | Via auto attendant(s) |
| How are calls in the queue distributed to your users? | Serial | Attendant | Round-robin | Longest idle |
| What hours is your queue open? | |
| What happens when someone calls outside those hours? | |
| Who are members of this queue? | |
| Who would be the owner(s) / managers of this queue? | |
| How many callers need to be waiting in the queue before you can’t accept any more calls? | |
| What should happen to any call that exceeds this limit? | Disconnect | Voicemail | Keep place in queue | Route somewhere else |
| What languages should your queue support? | |
| Do you have a custom greeting? | |
| Does this queue still function as you need or would you like to adjust it? | |
| What are your service numbers? | |
| If you have more than one queue, what caller options do callers have when they dial your number(s)? | Press 1 for. Press 2 for. Directory search, etc. |
| If you have an option to leave a voicemail, who currently receives this? | |
| Devices | |
| How many shared use phones within your department that can be used by anyone? | |
| If calls to these phones could be delivered to users’ PCs via the Teams client, would you still require a physical phone? | |
| All phone features can be provided using the Teams client on your PC. Can you think of reasons as to why some of your users still need a physical device? | |
| All users will be issued with a USB headset. Are there any users who might find using these difficult? | |
| Are there any users that require additional aids for communication? | |
| Other | |
| Do any of your users answer calls made from specialist devices like intercoms? | |
| If you control an intercom / door access solution, how is the door unlocked? | |
| Do you use a fax machine? | |
| Do you have a paging / Tanoy system? | |
| Do you have a requirement to send broadcast messages to phones? | |
| Compliance | |
| Do any of your users need their calls to be recorded for compliance purposes? | |
| Do you need any form of sentiment analysis on call recordings? | |
| Do you need access to workforce management features like analytics and reporting of usage? | |
| Other | |
| Any other information that might be important to discuss goes here. | |
MoSCoW Analysis
When you have your requirements, score them using the MoSCoW grading.
Use the table below to list every Teams Phone feature and decide whether you need to enable it. If you’re planning for the long term, introduce a “Could” column so you can refer back to this in a few years’ time.
| Feature | Must | Should | Won’t |
| Domestic calling | |||
| International calling | |||
| Shared cost number calling | |||
| Toll-free numbers | |||
| Extension dialing | |||
| Customized dial plans per location | |||
| Customized voice routing for least cost | |||
| Outbound call restrictions based on user and destination | |||
| Simultaneous ring with policy control to prevent | |||
| Delegate call management | |||
| Silent notification of delegate calls waiting | |||
| User controlled voicemail | |||
| Call queuing | |||
| Auto Attendant services with IVR and time of day routing | |||
| Directory search by name | |||
| Directory search by extension | |||
| Group call pickup with customizable delays | |||
| Keep my place in the queue with auto call back | |||
| PSTN call agents in queue (mobile device) | |||
| On call distribution | |||
| Historical call analytics with key metrics | |||
| Call disposition in analytics | |||
| CRM integration with auto screen pop | |||
| Last agent routing | |||
| Unassigned number routing | |||
| Private lines | |||
| Executive call barriers | |||
| Anti-spam and call blocking | |||
| Caller ID masking | |||
| Custom hold music | |||
| Shared Calling for users | |||
| Emergency calling with E-911 compliance |
After this exercise, you’re able to identify:
- If Teams Phone can natively support your calling needs
- What types of policies and licenses you’re going to need to assign to users
Creating Your User Personas
Now you have the business requirements nailed, you can start to build your user personas.
A user persona is a collection of policies, settings, licenses, and features that are applied to a user that matches a specific job role within your business.
In sales, you want to ensure that all sales agents have a phone number, international calling plan, and open Salesforce when a call is received.
In addition, you want to ensure sales managers can report on the number of calls they make and the quality of the sales conversations.
In this example you have two user personas:
- The sales agent
- The sales manager
The sales agent will need a DID number, associated calling plan, and a custom calling policy that will launch Salesforce when Teams receives a call. They’ll also need a compliance recording policy so that the sales manager can evaluate their performance.
The sales manager may not need a direct phone number but needs access to the compliance recording and reporting solution you’ve added to Teams.
In your HR department, your officers may not need a direct dial number but need to be members of the HR call queue and can make domestic outbound calls from the shared HR number.
As you go through each user type, you will come across new policies and requirements you need to build into your user provisioning personas. Equally, you’ll come across policies that are reusable between different personas.
When you have a policy that can be used with multiple personas, best practice is to duplicate the policy for each persona type.
This may seem like needless complexity, but should your business requirements change in the future, that means you need to change a policy setting for one type of user and not the other, then sharing policies across personas will restrict your ability to implement it.
How to Create Personas
A persona typically lives in an Excel document. This document outlines all the identified personas within your business and maps them to specific Teams policies and settings (e.g. number location and type to assign).
The persona document is the provisioning bible for technicians who are responsible for Teams user management. It should be revised at least once a year to ensure it’s up to date with your current business needs.
The following items should be included in a user persona:
- Persona name
- Persona description (who it is meant for)
- Country the persona applies to
- Microsoft 365 licenses required
- Security Groups the user must be added to
- Phone number type (area, tag, type) to apply to the user
- Dial Plan to assign
- Voice Routing Policy to assign
- Caller ID Policy to assign
- Emergency location and policy
- Other Teams policies to assign (voicemail, meetings, chat, calling etc.)
- Call Queues to add the user as an agent to
- Teams to add the user to
Create Your Policies
Now you have your personas defined, you can create your Teams user policies. Before jumping into the TAC, it’s important to decide on your policy naming convention.
Naming conventions make admin tasks a whole lot easier to follow. What convention you choose is up to you. However, if you’re going to automate this process with PowerShell scripting, it’s best to avoid using hyphens in your naming.
Using hyphens in PowerShell means the property is treated like a command, so you must escape the property with double quotes. If this is forgotten by technicians, it’ll result in failed processes and potentially unwanted outcomes.
It’s also recommended that you include the persona name in each policy so that it becomes easy to assign the correct policies without needing to trawl through pages and pages of procedural documents.
Use underscores instead or camelCase. For example: uk_standard_london or ukStandardLondon
Global Policies
Global policies are inherited by everyone. They are the default policy for each policy type. Out of the box, they have most of the Teams feature configurations enabled.
In many cases, global defaults will be enough for your users. However, depending on your business needs, these may need to be altered.
Review your user personas you created. Do you have a baseline experience every user should have when they start at your business? You should have.
Edit each global policy to apply your most common experience. This will help reduce the amount of administrative overhead you need to perform during each new hire. It will also guarantee a supportable and predictable experience for your users that’s in keeping with your basic business requirements.
Once you’ve established your baseline experience, you can then build your custom policies to match each additional user persona.
User Policies
You’ll need to create a user policy for each policy type where the persona expected experience differs from the default experience.
For example, you may have five offices based in the UK, each in a different location. You may have a persona that dictates that users in each of these offices need to dial local subscriber numbers without entering the area code in their dial plan. Or you may have internal shared service numbers that route to different sub-teams depending on the office location, e.g. 5555 routes to local IT support.
To meet these requirements, create a dial plan in Teams for each of the locations that include the required number transformations.
Example
| Dial Plan Name | Translate from | Transform to |
| uk_persona1_mcr | Local: ^(\d{7})$ | +44161$1 |
| Internal: ^5555$ | +441612300714 | |
| Domestic: ^0(\d{9,10}$ | +44$1 | |
| International: ^00(.*)$ | +$1 | |
| uk_persona2_bim | Local: ^(\d{7})$ | +44121$1 |
| Internal: ^5555$ | +441217415718 | |
| Domestic: ^0(\d{9,10}$ | +44$1 | |
| International: ^00(.*)$ | +$1 |
(Regex patterns simplified for the purpose of demonstration. For more detailed regex patterns please visit https://ucdialplans.com)
If you have a common set of policy settings between multiple user personas, it can be tempting to use one policy. Technically, there is nothing wrong with doing this if you’re sure that users in all affected personas requirements will never deviate.
However, if you want complete flexibility and to build a scalable provisioning solution, it’s best practice to duplicate the policy and name them specifically for each persona. This will allow you to affect change easier in the future.
Entra ID Security Groups
Using Entra ID security groups is an easy way to apply Teams policies and call queue memberships to users that requires no scripting or third-party automation tools.
For each persona you create, create an Entra ID security group with the same name.
Then, using Teams Group Policy membership, you can associate policies with security groups, target licenses allocation, and with call queues, you can assign the group as the call agent answering target.
All you’ll need to do then is to add the appropriate users to that group and they will automatically be assigned the persona experience.
When it comes to changing a user’s experience because they’ve moved roles, you simply need to remove them from one provisioning group and into the appropriate new one.
It’s important when defining your provisioning security groups that you don’t overuse the group in other areas of Teams. For example, enabling it for team collaboration or associating it with access to a SharePoint site collection, etc.
Keep the groups specifically for the provisioning of Teams settings. When it comes to user change, users may lose access to data they still need. This will cause users to drift away from provisioning and management compliance standards and slowly unravel all your hard work.
Although group-based provisioning does most of the heavy lifting when it comes to delivering Teams settings for users, it doesn’t provision a phone number. This is still a manual task for you to complete.
You could automate this using Power Automate with a SharePoint list or Excel Spreadsheet containing numbers and an Azure PowerShell Runbook.
If this is something that you would like to use, MVP Martin Heusser has created a package to deploy this.
Create Your Phone Number Spreadsheet
Phone number management in Teams is basic. You get a view of numbers that are available and assigned. You also get some basic filtering capabilities so you can find an appropriate number.
However, there isn’t a way to categorize your numbers for certain uses. For example, by office location, department, business use case, or other attributes that fit into your number allocation criteria.
If you use a mixture of Operator Connect, Calling Plan, and Direct Routing numbers, you’ll need to manage these off-platform, perhaps in an Excel spreadsheet.
With spreadsheets, however, comes a huge risk of data discrepancies as changes made to the live system aren’t reflected in the spreadsheet.
Fortunately, with Microsoft 365, you can take steps to dynamically keep that spreadsheet up to date using Power Automate and OneDrive.
This will help you keep on top of your phone number inventory when changes are made to Teams outside of standard processes.
Create Your Licensing Method
There are two ways to assign licenses to users in Microsoft 365: direct and group based. Typically, most businesses use group-based licensing.
Group-based licensing removes the need for you to manually assign licenses to users. Instead, you associate your persona provisioning security group to the Microsoft licenses you want to apply to members. Then, as soon as you add a user as a member to that group, they are assigned the associated licenses if they’re available.
When it comes to Teams Phone, if you haven’t purchased E5 licenses, then Teams Phone Standard license is a paid add-on. If this is you, then you’re probably cost conscious and only want to assign this license to users that require calling features.
When this is the case, you’ll need at least one of the following provisioning security groups:
- One for the base Teams persona
- One for the calling persona
- Potentially another for any department specific configuration like Call Queue membership
The user will need to be a member of both groups.
For example:
| Persona Group | Licenses | Teams Policies | Teams Queues |
| uk_standard_user | Microsoft Office 365 E3 | uk_standard_chat uk_standard_meeting uk_standard_calling uk_standard_app etc. | |
| uk_voice_mcr | Microsoft Teams Phone Standard Domestic Calling Plan* Communication Credits* | uk_voice_dialplan_mcr uk_voice_routing_mcr uk_voice_emcy_mcr | |
| uk_voice_mcr_hr | uk_voice_mcr_hr_cli | Manchester HR Call Queue Manchester HR Sickness |
(* if using Microsoft Calling Plans)
Users can be members of more than one licensing group. When they are, they will inherit the licenses of each group if they’re compatible with each other. If they aren’t, licenses won’t apply. You won’t receive an error alert, but this will be logged in Entra ID audit log which requires proactive monitoring.
If you have E5 licensing, then Teams Phone Standard is inclusive of this so it can reduce the number of provisioning groups needed.
Some administrators choose to deselect the Teams Phone license in E5 from users. Don’t do this. All you’re doing is creating unnecessary work for yourself.
As you’re already paying for the license in E5 and the features of Teams Phone only become available when you assign a number to a user, descoping the Teams Phone license from your base license provisioning group isn’t benefiting anyone. It’s better to assign it and leave the features dormant than not to.
When you come to activate a user for Teams Phone, it’s then much simpler than having to remember to move the user into another group to assign the license, then wait until that has taken effect, and then assign the number.
As you work through each persona iteration, the number of licensing and provisioning groups will increase. With this will come complexity in management of change.
You’ll need to be careful when moving users between groups. If you disrupt some features users still need access to, their new memberships could change or remove.
User Targeting
Building your personas, provisioning, and license groups are the core foundations of your provisioning solution. However, you do need to decide on how you’re going to identify users with those provisioning experiences.
Are you going to manually add users to the required groups and assign appropriate phone numbers? Or are you looking to automate some or all of this?
Chances are you’re going to want to automate a lot. Some items like phone number activation may still be a manual process because you have a business policy that requires manager approval.
In Entra ID, a user object has many attributes like job title, department, office location, country etc.
You can use these attributes to create dynamic membership rules for your provisioning groups so all you need to do is make sure the user account is created with the right attributes and Entra ID will take care of the rest.
Create Your Provisioning Solution
Now you’ve got all the pre-requisite tooling and personas defined, you can now think about putting these together to make a provisioning solution for your business.
In this walkthrough guide, we’re going to show you how to provision users using group-based targeting with some scripting and Power Automate to help assign and manage phone numbers. The principles used can be applied to your specific scenarios.
Step 1 – Create Your Entra ID Security Groups
Follow your persona template to create the required security groups for Teams provisioning.
To do this, go to https://entra.microsoft.com and head over to Groups > Create New Group.
Give the group a name. E.g. “Prov_UK_Standard_Baseline” and a description so other admins know what this group is used for.
In the membership type, change this to “Dynamic User”.
Now we’re going to add a dynamic query to match all users who have the country attribute set to the UK.
Click on Add Dynamic Query
Select the property ‘country’ and its matching operator and value.
The press Save. Then create the group.
Now we’re going to repeat the process to add another group that will target users for Teams Phone policy settings for the Manchester Office.
Next, add a dynamic query to target the office location of the user.
Now we’re going to do the same but for the London office.
Next, we need to create department-level provisioning groups. These will target users in specific departments and apply bespoke settings to them. E.g. make them call agents in call queues or assign department shared number caller identity.
Depending on your setup, you may need to localize these if you have a department in multiple locations that requires different call queue memberships and caller identities.
Assuming this is the case, let’s create two more groups to target the HR department in Manchester and London so they can have separate provisioning flows.
The query will now need to include two clauses: one for the city and one for the department.
Save and create the group.
Create another one for London in the same way but replace the city value to equal London.
You should now have the following groups created:
To recap what we have just done, we’ve created Entra ID security groups that will be used to assign the appropriate Teams licenses, policies, and queue memberships to users and created dynamic membership policies so that users get automatically added to these groups based on their user attributes.
Step 2 – Assign Licenses to Groups
Now the groups are created, we’re going to assign the Microsoft 365 and Teams licenses required to each of the groups as follows:
| Group Name | Licenses To Assign |
| Prov_UK_Standard_Baseline | Microsoft Office 365 E3 (No Teams) Microsoft Teams Enterprise |
| Prov_Teams_Phone_Manchester | Microsoft Teams Phone Standard |
| Prov_Teams_Phone_London | Microsoft Teams Phone Standard |
| Prov_Teams_Phone_Manchester_HR | No licenses required |
| Prov_Teams_Phone_London_HR | No licenses required |
Microsoft has changed the way group-based licensing is administrated. From Sept 1st, 2024, group-based licensing is now controlled in the Microsoft 365 Admin Center.
Go to https://admin.microsoft.com expand Billing > Licenses and then select the license you want to assign.
From there, click on the Groups tab and then Assign Licenses.
Add the group name you want to assign the license to using the matrix table and press assign.
Now repeat for each license combination you need.
Step 3 – Associate Your Teams Policies with Provisioning Groups
The next part of the process is associating the Teams Policies you’ve made for each persona type to the Entra ID security groups. You can do this in PowerShell or the TAC.
We’re going to be assigning the following policies to our group examples as follows:
| Group | Teams Policies | |
| Prov_UK_Standard_Baseline | None – use global policies as default | |
| Prov_Teams_Phone_Manchester | Dial Plan | UK Manchester |
| Routing Policy | UK Domestic Manchester | |
| Calling Policy | UK Manchester | |
| Prov_Teams_Phone_London | Dial Plan | UK London |
| Routing Policy | UK Domestic London | |
| Calling Policy | UK London | |
| Prov_Teams_Phone_Manchester_HR | Caller ID | UK HR Manchester |
| Prov_Teams_Phone_London_HR | Caller ID | UK HR London |
Head over to the TAC and then navigate to Voice > Dial Plans and select Group Policy Assignment.
Click on Add then choose the provisioning group to assign a policy to.
Example: Prov_Teams_Phone_Manchester and select the Manchester dial plan. Leave the rank as 1. We’re not making cascading policies.
Press Apply.
Repeat the step to apply the London dial plan to the London Provisioning Group.
Now go to the calling policy in the TAC and do the same.
Next, go to the voice routing policy and add the domestic routing policies for each.
Finally, we need to provision the caller identity policies for the HR users in London and Manchester. So, we repeat the process and assign the HR provisioning groups to the associated policies.
Now this is setup, users matching the group criteria we made with Entra ID dynamic group memberships will inherit the required licensing and Teams settings.
Let’s test it out.
We’re going to configure Christie Cline to be an HR representative in Manchester and Debra Berger to be a HR representative based in London.
We can check they’ve been dynamically added to the Teams baseline group that will assign the base licenses for Microsoft 365 and Teams.
They will also inherit all the global Teams user policy settings we have applied for the default Teams experience.
As Christie is located in Manchester, they will also be members of the Teams Phone Manchester group and Debra the Teams Phone London group.
And again, with the HR groups.
We can also check their Teams policy assignment in the TAC.
You can also check the policy assignment status in PowerShell by running the below command:
For your normal Teams users and Shared Calling users, this could be enough configuration. The next steps are purely for Teams users who require external calling in Teams.
Step 4 – Change Call Queue Memberships to Group Based
Now we need to add the users as agents to call queues. To do this we can use the group-based agent membership feature of the call queue.
Users will not become agents of the queue until they’re enabled for enterprise voice either through number assignment or Shared Calling.
Edit the call queue, navigate to Call Answering, then change the option to Add Group and add the provisioning group to the queue and press Submit.
Repeat for the London call queue group replacing the group membership to that of the other provisioning security group.
Authorized Application Users
Teams Auto Attendants and Call Queues can delegate their management capabilities to department / service managers. This reduces the reliance on IT admins to make operational changes to a call queue or auto attendant.
Authorized users have the right to change operational configuration like opening hours, agent queue membership, and IVR options. But they can’t delete or alter the underlying routing and behavior of the applications.
Delegation of these tasks to service owners is important for business productivity and something you should consider as part of your service offering.
Unfortunately, at this time, there is no way to group assign authorized users to either of these applications. They must be explicitly defined in the TAC.
To do this, open the call queue or auto attendant configuration and navigate to Authorized Users and add in the user accounts you want to grant access to.
Authorized users must be enterprise voice enabled even if they aren’t going to be agents of the queue they manage. Therefore, they need to have a phone number or be enabled for Shared Calling as a pre-requisite.
You can control the level of editing privileges they have using Voice Application Policies.
Navigate to Voice > Voice Application Policies and create a new policy for each admin experience.
When you have finished creating the policies, you’ll need to assign them to users individually. There is no group policy assignment method for these policies yet.
You can also assign this policy using PowerShell using the Grant-CsTeamsVoiceApplicationPolicy commandlet.
Step 5 – Assign a Phone Number
So far, we’ve managed to provision the Teams user automatically with their full Teams Phone experience without writing a single line of code or creating Power Automate tasks.
When it comes to assigning a number to a user, this task still requires some manual intervention.
There are two ways to assign numbers: using the TAC or Teams PowerShell.
If you’re using Microsoft Calling Plans or Operator Connect for Teams Phone, your numbers will show in the TAC under Voice > Phone numbers.
From this view you can assign users a number. Select a free number and press Edit.
Enter the user’s name, then select an emergency location, and press Apply.
This will enable the user for calling and their dial pad will show up in their Teams client.
The phone number management in Teams is a little basic but it’s functional for most mid-sized organizations.
When you’re managing hundreds of numbers in different countries and assignment states, you can find the numbers you need by using the filter.
To find available numbers to assign, use the filter Assignment Status and set the value to Unassigned.
Be sure to update your number spreadsheet with this assignment.
If the assignment fails, it will be due to one of two reasons:
- The user doesn’t have the Teams Phone Standard License assigned
- The number you’re trying to assign is already assigned to another user
Now your provisioning of Teams Phone users is complete, and 95% completely automated, without writing a single line of code or creating Power Automate tasks.
If you work in a small to mid-sized (100-1,000 users) organization, where assigning a Teams Phone number is always going to be a requested add-on that requires management / cost center approval, then you probably don’t need to spend time and effort automating the assignment of this.
Larger organizations will need to implement approval-based automation between their ITSM solution like ServiceNow or Salesforce so numbers can be activated and assigned as part of an automated self-service process.
For these organizations, implementing a dedicated number management and Teams provisioning solution makes sense.
Now you know what to include in your Teams Phone provisioning plan, the next step is to select your Teams Phone automation tool.
Jump to the automation section in our free 70-page Teams Phone eBook here.
