Fix Teams Rooms Device Signs Out after a Network Firewall Change

Your Teams Rooms device suddenly signs out after your IT team updates the network firewall. The device shows a sign-in prompt on the console, and users cannot join meetings. This happens because Teams Rooms relies on specific endpoints and certificates that a firewall change can block. This article explains the root cause, the exact steps to re-authenticate the device, and how to prevent the issue from recurring.

You will learn how to verify firewall rules, re-sign in using the device admin account, and apply the correct Teams Rooms policy settings. The fix takes about 15 minutes and requires local admin access to the console.

Why a Firewall Change Signs Out Teams Rooms Devices

Teams Rooms devices authenticate using a device account that is a standard Microsoft 365 user account with a licensed Teams Rooms Pro or Basic plan. The device stores a token that lets it stay signed in. When the network firewall changes, it can block the traffic that the device uses to refresh that token. Common blockers are new rules that restrict outbound HTTPS traffic, proxy authentication requirements, or certificate inspection that breaks the TLS handshake.

The device does not have a way to renew the token offline. Once the token expires, the console shows a sign-in screen. This is by design because the device cannot cache credentials for security reasons. The sign-out is not a software bug; it is a direct result of the device losing connectivity to the Microsoft 365 authentication endpoints.

Which Endpoints Does Teams Rooms Use for Authentication?

Teams Rooms devices need access to these endpoint groups to stay signed in:

• login.microsoftonline.com and login.live.com for token requests
• graph.microsoft.com for device policy and calendar data
• teams.microsoft.com and skype.com for meeting signaling
• sfbassets.com and msedge.net for content and updates

The firewall must allow outbound HTTPS on port 443 to all these domains. If your firewall uses URL filtering, you must allow the full domain list from the Microsoft 365 URLs and IP ranges documentation.

Steps to Re-authenticate Teams Rooms After a Firewall Change

Follow these steps in order. The first step verifies the firewall, then you re-sign in, and finally you confirm the device stays authenticated.

1. Check the firewall logs for blocked traffic
   Open your firewall management console and filter logs for the device IP address. Look for denied outbound connections to login.microsoftonline.com or teams.microsoft.com. If you see blocks, add allow rules for the full Microsoft 365 URL list. Do not allow only the specific IP that was blocked because Microsoft changes IPs frequently.
2. Verify network connectivity from the device
   On the Teams Rooms console, press Ctrl+Alt+Del to open the administrator sign-in screen. Sign in with the local admin account. Open a web browser and go to https://login.microsoftonline.com. If the page loads, the firewall is not blocking authentication. If it fails, the firewall is still blocking the traffic.
3. Sign out of the device account
   On the console, go to Settings > Device sign-in. Select Sign out. This clears the cached token. Wait 30 seconds.
4. Sign back in with the device account
   Enter the device account credentials. Use the full email address and password. If the device has multi-factor authentication enabled, complete the prompt on your phone. The console should show the meeting room screen within 2 minutes.
5. Confirm the token refresh
   After sign-in, go to Settings > About. Check the Authentication status. It should show Signed in. Leave the device idle for 30 minutes, then check again to confirm the token refreshes automatically.
6. Update firewall rules for future changes
   Add a rule that allows outbound HTTPS to the full Microsoft 365 URL list. Use the URL list from the Microsoft 365 documentation, not a static IP list. Test the rule by restarting the device and confirming it stays signed in.

If Teams Rooms Still Signs Out After Re-authentication

Teams Rooms shows a sign-in prompt again after a few hours

This means the token refresh is still blocked. The device signs in once, but the background refresh fails. Check the firewall for blocks on graph.microsoft.com or msedge.net. Also check if your proxy requires authentication. Teams Rooms devices do not support proxy authentication. If you use a proxy, add the device IP to the bypass list.

The device signs in but cannot join meetings

This is usually a separate issue from sign-out. The firewall may allow authentication but block meeting media ports. Teams Rooms uses UDP ports 3478 through 3481 for media. Open these ports for the device IP range. Also allow TCP 443 for signaling.

The admin sign-in screen does not accept the local admin password

This happens when the device was enrolled in Intune or Azure AD and the local admin password was changed. Use the password that was set during provisioning. If you do not have it, contact your device vendor or use the recovery process for your specific model.

Teams Rooms Sign-out Causes: Firewall Rules vs Device Settings

Item	Firewall Rule Change	Device Setting Change
Typical trigger	New outbound block or proxy rule	Device account password reset or policy change
Sign-out timing	Within hours or days after the change	Immediately after the setting change
Error message	Sign-in prompt with no error code	Sign-in prompt with error code 0xCAA5001C or similar
Fix method	Allow the Microsoft 365 URL list and media ports	Re-enter the device account password and re-register the device
Verification	Check firewall logs for blocked traffic	Check Teams admin center for device status

Prevent Future Sign-outs with the Correct Firewall Configuration

Use the official Microsoft 365 URLs and IP ranges page to build your firewall rules. Update these rules monthly because Microsoft changes endpoints without notice. Do not use wildcards in your firewall rule; instead list each domain explicitly. For the media ports, open UDP 3478 through 3481 for the device subnet.

Also configure the Teams Rooms device account to use a long-lived token. In the Teams admin center, go to Teams devices > Rooms > Device settings and set the token refresh interval to the maximum allowed. This reduces the frequency of token checks, so a temporary network blip is less likely to cause a sign-out.

Finally, monitor the device health in the Teams admin center. The dashboard shows the last sign-in time and any authentication errors. Set up an alert so you know immediately when a device signs out.

You can now re-authenticate a Teams Rooms device after a firewall change and configure the network to prevent future sign-outs. Start by reviewing the firewall logs, then re-sign in with the device account. After that, update your firewall rules to include the full Microsoft 365 URL list and open the media ports. For ongoing protection, enable the device health alerts in the Teams admin center and review the endpoint list monthly.