Handling a Teams Rooms fleet certificate expiry

A certificate expiry in a Teams Rooms fleet does not announce itself as a certificate expiry. It shows up as thirty rooms offline on the Pro Management dashboard on a Monday, or as rooms that sign in but cannot see their calendar, or as one region's rooms dropping off Wi-Fi at midnight. The certificate involved is almost never one you issued to Teams; it is one the room depends on to reach Teams. This runbook is about identifying which, and renewing it at fleet scale.

For the deployment model these rooms sit in, see Teams Rooms deployment and management.

Step 1: read the symptom

Five certificates commonly expire under a Rooms fleet. The symptom tells you which.

• Rooms drop off the network at the same time; wired rooms fine, Wi-Fi rooms dead (or vice versa) — 802.1X: the client certificate on the device, or the RADIUS server's certificate.
• Rooms show "network connected" but Teams cannot sign in; a browser on the device shows TLS warnings — the proxy or TLS-inspection root certificate on the device.
• Rooms sign in and join meetings, but the calendar is empty or shows an error — the Exchange side: a hybrid on-prem Exchange certificate, or the Autodiscover endpoint's certificate.
• Only Android-based rooms or panels affected — a device or Wi-Fi certificate deployed via Intune to Android.
• Only rooms behind one Wi-Fi controller or one site — that site's RADIUS server certificate.

Confirm from a device: on Teams Rooms on Windows, switch to the admin account and open Settings → Network, and a browser to https://teams.microsoft.com to see whether TLS is trusted. On Teams Rooms on Android, the device's Wi-Fi settings and the Intune device page show certificate state.

Pro Management's device health signals are quicker than a walk: an entire batch going offline within a minute of each other, with the last-seen timestamp matching a certificate's not after date, is a certificate expiry until proven otherwise.

Step 2: 802.1X — the usual suspect

Most fleets that authenticate rooms to the network use EAP-TLS with a device certificate from your PKI, typically issued through Intune's SCEP or PKCS profiles to the room's device object. Two things expire:

The device certificates. Intune renews SCEP certificates automatically when they approach the renewal threshold, if the device checks in. Rooms that are permanently on and enrolled do check in; rooms that were set up with a manually installed certificate, or that lost their Intune enrollment, do not. Check Intune → Devices → the room → certificates, and the SCEP profile's renewal threshold. Rooms whose certificate is expired cannot get on the network to renew it — a wired fallback VLAN without 802.1X, or a temporary MAC-bypass on the switch port for those rooms, is how you get them back long enough to renew.

The RADIUS server certificate. When the NPS or third-party RADIUS server's certificate expires, every 802.1X client at once rejects the server. This is the fleet-wide, single-timestamp outage. Renewal happens on the RADIUS server, not on the rooms — but if the issuing CA changed, rooms need the new root or intermediate in their trust store, which is an Intune trusted-certificate profile push.

If your PKI's root or intermediate itself is approaching expiry, that is a PKI project with the rooms as one of many clients, and it needs a plan measured in months.

Step 3: proxy and TLS inspection

Rooms behind a proxy that inspects TLS need the proxy's root certificate installed in the machine store. Those roots expire like any other. Symptoms: the device reaches the network, but Teams sign-in fails, Windows Update fails, and the Pro Management agent stops reporting.

The fix is pushing the renewed root via Intune (trusted certificate profile, machine scope) — but a room that cannot trust the proxy cannot reach Intune either. Options, in order of preference: exclude the Teams Rooms IP ranges or Microsoft 365 endpoints from inspection permanently (Microsoft's guidance is to bypass inspection for Teams media and signalling anyway), push the certificate through the proxy's own bypass for the Intune endpoints, or visit the rooms. This is the case most likely to require a physical visit, and the reason to bypass inspection for rooms before the next expiry.

Step 4: the Exchange side

Rooms are resource mailboxes, and a room account in a hybrid organisation whose mailbox is on-prem depends on the on-prem Exchange certificate for Autodiscover and EWS. When it expires, the room signs into Teams fine but the calendar goes blank. Renew the certificate on the Exchange servers and rebind it to IIS and SMTP; rooms recover on their next calendar sync without a restart.

The lasting fix is to move room mailboxes to Exchange Online, which removes the dependency and is one of the concrete steps in retiring on-prem Exchange.

Step 5: fleet renewal without walking

For rooms that are online and enrolled, everything is a policy push:

• Intune SCEP/PKCS profile with a sensible renewal threshold (a third of validity is a common choice) so renewals happen while the old certificate is still valid.
• Trusted certificate profiles for any new root or intermediate, deployed well before the old chain expires.
• For Android rooms and panels, the same profiles targeted at the Android device group; check that the Wi-Fi profile references the certificate profile so the two renew together.

For rooms that are offline because of the expiry, you need a path to the network that does not depend on the expired credential: a wired port without 802.1X, a pre-shared-key Wi-Fi SSID for remediation, or a bypass on the switch. Have one of these designed before you need it.

Step 6: stop it happening again

• A certificate inventory with expiry dates: every RADIUS server, proxy root, PKI intermediate, Exchange certificate, and the Intune certificate profiles' validity periods. A calendar reminder 60 days before each.
• Pro Management alerts on device offline for the whole fleet; a single-timestamp mass offline is your early warning.
• Remove the dependency where you can: bypass TLS inspection for rooms, move room mailboxes to Exchange Online, and for network access prefer certificate profiles from Intune over anything installed by hand.

None of this needs Microsoft support. Downtime is whatever it takes to get an offline room back on a network it can renew from — minutes per room with a bypass VLAN, a site visit without one.