Finding different types of Teams Phones in Entra ID

I don’t know if this is an exhaustive way of doing this, but here goes.

Fiddling around with Conditional Access policies at work, and was wondering how best to exclude Teams phones from being targetted. Came across this Microsoft article on excluding such devices from Conditional Access policies using device filters. Another one too says the same.

Here’s a screenshot from the second post on what needs doing.

How do I find the various manufacturers in my environment? Graph to the rescue!

The output of Get-MgBetaDevice (I didn’t try the non-beta one, that will probably do the trick too) contains the OS. So I do the following to begin with:

Then I can find the various Manufacturers using:

In my environment I see:

What’s all those blank ones? Do they have a model?

No output. So I can focus on just Manufacturer, for now, in my case.

Let’s get a sample device of each so I can confirm if they are mobile phones or Teams phones.

Whoa, that doesn’t work!

Ok, another way.

This creates an array containing up to 15 devices of each manufacturer. And then I get the manufacturer, model, and display name of these so I can take a look.

Now I can go through the list and identify the ones that look like Teams phones.

What else can I do?

I know that all the users in my environment with a Teams phone must have the Microsoft 365 Phone System plan. This is a part of the E5 license, or can be purchased separately as the Microsoft Teams Shared Devices license. So if I get a list of everyone with this plan, and then find the devices they have, I can tackle this problem that way too.

Thankfully I already have some experience working with licensing.

The following code will create two hash tables containing the license GUIDs and plan GUIDs.

Based on that, finding the user with the Microsoft 365 Phone System plan is straight forward.

Can I then get the devices of each of these users, and look for the Android ones that signed in in the last 10 days (no point looking at stale entries)?

Yup, that works. I can then do the following:

Which gave me the following:

Of course, this way will show any regular Android mobile phones of users with a Teams Phone System plan, that’s why I’ve got a few other manufacturers in there. Ferret out the mobile phones manually, and we are left with:

Compare that to what I got above (reproduced below again), and ‘rockchip’ and ‘Logitech’ are missing.

Turns out the ‘rockchip’ devices last checked-in in 2021, that’s why! :)

And Logitech is a Teams meeting room device. I am not concerned about Teams meeting room devices as they have separate accounts and don’t belong to users, so I can ignore that too. But something to keep in mind for anyone looking to both Teams meeting rooms and Teams phones (in which case you should also target the Teams meeting room license).

Update (17th Sept 2024): The code was updated to add -replace"\?\?\?","" because it looks like the Product_Display_Name column appears as ???Product_Display_Name in the downloaded file.