Feature Overview

Synergy SKY's Teams Authenticated Device feature enables Synergy SKY configured endpoints to authenticate to Microsoft Entra ID using a client certificate (Certificate-Based Authentication, CBA) and enables these devices to behave as trusted meeting rooms within the organization's Microsoft tenant.

Teams Authenticated Device Feature works by giving each meeting room its own license and identity in Microsoft Entra ID, then enabling Certificate-Based Authentication (CBA) only for those rooms. You then provide the per-room certificate package (PFX and password shared securely) to the Synergy SKY cloud service. When a meeting starts, it authenticates using that certificate. As a best practice, Synergy SKY recommends a small pilot to validate end-to-end behavior before rolling out broadly within your organization.

Pre-requisites

Before deploying the Teams Authenticated Device feature, please prepare the following prerequisites to ensure secure authentication and a smooth rollout.

Microsoft Entra

To deploy the Teams Authenticated Device feature, you must have an active Microsoft Teams license and access to specific Microsoft Entra administrative roles.

License note:
Each meeting room must be assigned a Microsoft Teams capable license. Microsoft Teams Shared Device licenses are recommended for this scenario. Synergy SKY does not sell or supply Microsoft licenses.

The minimum required roles within Microsoft Entra are:

User Administrator
Authentication Policy Administrator
Conditional Access Administrator
Privileged Authentication Administrator

Please Note - These roles are only required during initial configuration or policy changes. Day-to-day operation of authenticated rooms does not require ongoing elevated administrative access.

For Federated Identity / Microsoft federated domain

As the Teams Authenticated Device feature rely on certification based authentication, and identity authentication through Microsoft Entra, it is important that the account for the Room is not behind a federated identity. If your organization are using a third party identity provider, we suggest to move the room account to username@company.onmicrosoft.com

Synergy SKY

Before enabling the Teams Authenticated Device feature, ensure you have administrative access to the Synergy SKY configuration interface for your deployment model (Cloud or Hybrid), and a secure method to deliver each room’s certificate package (PFX and password) for association with the corresponding room.

Cloud deployments: Certificates are uploaded and associated directly via the Synergy SKY Cloud Configuration interface.
Hybrid deployments: Certificate packages must be securely provided to Synergy SKY Support, who will complete the association within the customer’s environment.

Certificate Generation

A root certificate should be generated or an existing root certificate should be used. This root certificate is needed within the customer's Microsoft Entra tenant, when creating a Public Key Infrastructure (PKI).

A client certificate per meeting room would also need to be generated, based on the above mentioned root certificate. Crucial parameters for these client certificates are:

Below is an example for the licensed resource account "user@company.com"

-addext "subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:user@company.com"
-addext "extendedKeyUsage = clientAuth"
-addext "keyUsage = digitalSignature"

Configuration

Microsoft Entra Configuration

This configuration leverages Microsoft Entra Certificate-Based Authentication (CBA), a native Microsoft authentication mechanism designed for secure, non-interactive and shared device scenarios.

For reference, Microsoft’s official documentation on certificate-based authentication can be found here:
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication

To enable the Teams Authenticated Device feature, you will complete a short, structured configuration process that establishes a trusted identity for each meeting room. At a high level, this involves creating dedicated room identities, grouping them for policy scoping, issuing certificates, and enabling certificate-based authentication in Microsoft Entra.

The Entra configuration is completed in four stages:

Assign a teams license to each account to be used by the associated room resources
Place the room resources into a security group for policy targeting
Create a Public Key Infrastructure (PKI)
Enable certificate-based authentication for the room group

Licenses

Each room resource requires a MS Teams license (Microsoft Teams Shared Device licenses are recommended for this scenario). This license can be associated to the existing room resource already used for other features like Click-to-JOIN. Or a new resource can be utilized and associated to the room for this feature.

Groups

In this step, you will create a Microsoft Entra ID group that explicitly defines which meeting rooms are allowed to authenticate using certificates. This group will later be referenced by Certificate-Based Authentication (CBA) and Conditional Access policies.

To create a new security group and add all previously created meeting rooms to this group, navigate to the interface as illustrated below "Microsoft Entra admin center - Groups. - All groups. - New group"

Create a Public Key Infrastructure (PKI)

In Microsoft Entra, navigate to Identity Secure Score → Public key infrastructure (Preview) → Create PKI.

Naming is at customer discretion.

Next, Navigate to the PKI that was just created and press "Add certificate authority".

Then add a certificate authority and upload the root CA certificate that was used to issue the room certificates (or will be used to issue the client certificates).

If your PKI implementation includes a Certificate Revocation List (CRL), the CRL must be hosted on an HTTP-accessible web server. Provide the CRL URL as part of this configuration.

Enable certificate-based authentication for the room group

To enable certificate-based authentication, open Microsoft Entra ID, then navigate to "Authentication methods - Policies - Certificate-based authentication.

Assign the group created earlier to this policy, then click Configure to proceed.

Add a rule for Authentication binding, select your root certificate and make sure its set to multi-factor and low affinity binding.

Next, define a certificate authority scoping rule that scopes the certificate authority to the meeting room group created earlier. This step controls which resources are permitted to authenticate using certificates.

Synergy SKY Configuration

Once the Microsoft Entra configuration is complete, each room’s certificate must be associated with its corresponding room in Synergy SKY (either via the Cloud Configuration UI or by Synergy SKY Support for Hybrid deployments).

CONNECT Cloud Deployments

For Synergy SKY CONNECT Cloud deployments, certificates are uploaded and managed directly through the Synergy SKY Cloud Configuration interface.

Administrators can securely upload the per-room certificate package (PFX file and optionally the password if configured) and associate it with the appropriate meeting room. Changes take effect once the configuration is saved and propagated.

Hybrid Deployments

For Synergy SKY CONNECT Hybrid deployments, certificate association is completed with assistance from Synergy SKY Support.

Each room’s certificate package must be transferred securely to Synergy SKY using approved methods coordinated by Support. Once received, the certificate(s) are uploaded and associated within the customer’s hybrid environment.

To initiate this process, contact:
support@synergysky.com

Conclusion

By completing these steps, your organization has successfully enabled the Teams Authenticated Device feature for Synergy SKY CONNECT, allowing meeting room systems to join Microsoft Teams meetings as fully authenticated organizational devices. This configuration eliminates anonymous join limitations, improves reliability in large or restricted meetings, and aligns with Microsoft-recommended certificate-based authentication practices.

Additionally, this model aligns with Microsoft’s recommended approach for shared and non-interactive devices, and provides a future-proof foundation as Microsoft continues to evolve Teams authentication and security requirements.

Once deployed, this approach provides a secure, scalable foundation for enterprise and regulated environments, while preserving flexibility across both cloud and hybrid Synergy SKY deployments.