You set up a new Microsoft Teams Room, enter the room's account, and the sign-in fails. The screen may even say the sign-in worked, but that you don't have permission to access this resource.
The trap is that very different problems look the same on the device, and each one is fixed in a different place. Guess wrong and you can spend an hour in a settings page that has nothing to do with the fault.
So don't start with the settings. Start with the error code.
Where to find the code
You have two places to look:
- Microsoft Entra admin centre: open the room's resource account and read its sign-in logs.
- On the device: in Event Viewer, go to Applications and Services Logs, Microsoft, Windows, Microsoft Entra ID, Operational, and look for Event ID 1098.
What each code means
| Code | What's blocking the room | What to do |
|---|---|---|
| 530035 | Security defaults | They apply to the whole tenant and can't exclude one account. Move to Conditional Access first, then turn security defaults off. |
| 53003 | A Conditional Access policy | Open the failed sign-in to see which policy applied, then adjust that policy for your room accounts. |
| 50076 or 50079 | Multi-factor authentication | Room accounts shouldn't use MFA. Remove it for the resource account. |
| 50055 | Expired password | Reset it, update it on the device, and turn off password expiry for the account. |
| 50126 | Wrong username or password | Check both, reset if needed, and update the device. |
The one that's easy to miss
Code 530035 isn't in Microsoft's Teams Rooms sign-in troubleshooting guide at the time of writing, but our founder has met it on a real rollout.
Security defaults are a single switch for the whole tenant, so there's no way to exempt only the room. Don't simply turn them off, because that removes protection for everyone. Put Conditional Access policies in place that keep your people protected, exclude the room accounts on purpose, and only then switch security defaults off.
If the log shows success
A successful sign-in in the log with a failing room usually points somewhere else:
- Licence: the account needs a Teams Rooms Basic or Pro licence.
- Network: the device must reach the Microsoft 365 endpoints, and Teams Rooms doesn't support proxy authentication.
- Mailbox: the resource account needs a room mailbox.
If the log shows no sign-in attempts at all, check the username and the network first.
A quick order of work
- Read the code before you change anything.
- Fix only what that code points to.
- Update the password on the device if you changed it.
- Sign in again and confirm the log shows success.