Skip to content
← Back to the guide

Handling a Teams Rooms fleet certificate expiry

7slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 7

Handling a Teams Rooms fleet certificate expiry

What breaks in a Teams Rooms fleet when a certificate expires — Wi-Fi, 802.1X, proxy roots, hybrid Exchange — how to tell which, and renewing fleet-wide.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 7
01

Step 1: read the symptom

Five certificates commonly expire under a Rooms fleet. The symptom tells you which.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 7
02

Step 2: 802.1X — the usual suspect

Most fleets that authenticate rooms to the network use EAP-TLS with a device certificate from your PKI, typically issued through Intune's SCEP or PKCS profiles to the room's device object. Two things expire:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 7
03

Step 3: proxy and TLS inspection

Rooms behind a proxy that inspects TLS need the proxy's root certificate installed in the machine store. Those roots expire like any other. Symptoms: the device reaches the network, but Teams sign-in fails, Windows Upda…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 7
04

Step 4: the Exchange side

Rooms are resource mailboxes, and a room account in a hybrid organisation whose mailbox is on-prem depends on the on-prem Exchange certificate for Autodiscover and EWS. When it expires, the room signs into Teams fine bu…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 7
05

Step 5: fleet renewal without walking

For rooms that are online and enrolled, everything is a policy push:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 7
06

Step 6: stop it happening again

None of this needs Microsoft support. Downtime is whatever it takes to get an offline room back on a network it can renew from — minutes per room with a bypass VLAN, a site visit without one.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/teams-rooms-certificate-expiry-runbook

Slide 7Download PNG

Auto-generated from Handling a Teams Rooms fleet certificate expiry. This page is not indexed and isn't part of the guide itself.