The enrolment map
Certified Android-based endpoints (phones, panels, displays, many bars) reach TAC's device inventory via their Teams sign-in; their ANDROID layer is governed through the Android management path (the AOSP device-management migration replaced the legacy Android Enterprise approach across recent years — check your vendors' current guidance when enrolling new fleets). MTRoW rides Windows management. The practical takeaway: inventory lives in TAC, but the OS underneath each category answers to a different master — know which for each device family you own before an incident asks.
Update mechanics (TAC-side)
TAC manages Teams APP/firmware updates for enrolled devices with phased
options (auto vs manual, staged timing): the update surface our scan snapshots
as TeamsUpdateManagementPolicy covers client update rings broadly, while
device firmware follows the TAC device-update settings per device class.
Operating rules that survive contact:
- Ring your devices like your rooms: a pilot shelf of each hardware model takes updates first; the estate follows on proven builds.
- Never let 'auto' mean 'unknown': auto-update ON with no pilot = the whole fleet tests Tuesday's firmware simultaneously.
- Certify per model, not per vendor: two models from one vendor can run different chipsets and firmware trains.
Fleet failure shapes
| Shape | Read |
|---|---|
| One model misbehaves everywhere after a date | Firmware train issue — the ring you didn't have would have caught it |
| Devices drop from TAC inventory | Sign-in/token expiry on device accounts, or network change blocking enrolment endpoints |
| Sidecars/panels healthy, calls fail on same desk | The PHONE'S SIP/media path vs the panel's HTTPS-only life — different dependencies |
| Mass sign-out overnight | Token/CA event fleet-wide — Entra sign-in logs for the device accounts tell it instantly |
What to watch (proofs)
- The inventory of record: TAC > Teams devices per category, EXPORTED weekly — model, firmware, health, last-seen; the diff between weeks is your fleet change log.
- Update policy truth:
Get-CsTeamsUpdateManagementPolicy | fl(in the nightly scan) — ring configuration as code-visible fact. - Per-model health pivot: the exported inventory pivoted by model+firmware vs incident tickets — the 'one bad train' pattern appears in a pivot table long before it appears in a vendor advisory.
- Device account sign-ins: Entra logs scoped to device/room/CAP accounts — the fleet-wide auth event detector.