Common area phones (CAP)
A shared handset with no owning human: its own account with the low-cost
Common Area Phone licence (Teams Phone included; add PSTN via your road),
signed in once, presenting a deliberately restricted interface. The control
plane is TeamsIPPhonePolicy (in your scan): SignInMode = CommonAreaPhone
strips the UI to dial-pad essentials (vs UserSignIn's full experience);
additional switches gate directory search and hot-desking availability on the
device. Pair with a calling policy scoped to what a lobby phone should ever do
(no international, no forwarding off-site) — the fraud surface of an unattended
handset is real.
The recurring incident: CAP account caught by MFA/CA rollout (no human to satisfy the prompt) — same playbook as room accounts: dedicated CA treatment, sign-in monitored.
Hot desking
A shared desk phone/deskphone-with-display where a visiting user signs in and
gets THEIR identity — number, calls — for the session: HotDeskingIdleTimeout
in the IP phone policy signs them out after idle, returning the device to its
base state. The two design decisions: timeout length (short enough that
yesterday's visitor isn't today's answerer) and which population's policy
allows it at all.
What to watch (proofs)
- Policy truth:
Get-CsTeamsIPPhonePolicy | fl(nightly in serv365) — SignInMode and hot-desking settings per instance; drift here changes what a lobby stranger can do. - CAP account hygiene: the CAP account list vs Entra sign-in logs — interactive sign-ins from unexpected IPs on an account that should live in one lobby is the anomaly worth an alert.
- Cost/abuse telemetry: PSTN usage filtered to CAP accounts — a lobby phone's call pattern is boring; excitement in that report is fraud or misuse.
- Hot-desk session behaviour: sign in at a shared device, walk away, verify the idle timeout returns it to base — the two-minute acceptance test per policy change.