Merge pull request #15354 from MicrosoftDocs/main

merge to live

Teams/alerts/device-health-status.md

@@ -3,7 +3,7 @@ title: Microsoft Teams Devices Monitoring and Alerting
 author: mstonysmith
 ms.author: tonysmit
 manager: pamgreen
-ms.reviewer: vapati
+ms.reviewer: kimmatlock
 ms.date: 10/10/2023
 ms.topic: article
 audience: Admin

Teams/app-support-on-Teams-panels.md

@@ -46,7 +46,7 @@ You can now use the Teams apps on Teams panels and customize the user experience
 
 ## Manage apps on Teams panels in Teams admin center
 
-**Note**: You must be a global admin or a Teams service admin to access the [Teams admin center](https://admin.teams.microsoft.com/).
+**Note**: You must be a Teams service admin to access the [Teams admin center](https://admin.teams.microsoft.com/).
 
 End users can view but not install apps on Teams panels. As an admin, you can view and manage all Teams apps for your organization via the Teams admin center. Learn more about how you can [manage your apps in the Microsoft Teams admin center](/microsoftteams/manage-apps) via the **Manage apps** page. The **Manage apps** page within the Teams admin center is also where you can upload [custom apps](/microsoftteams/manage-apps#publish-a-custom-app-to-your-organizations-app-store).
 

Teams/devices/collab-bar-deploy.md

@@ -33,6 +33,9 @@ Deployment of Microsoft Teams Rooms on Android can be broken down into the follo
 
 To manage Teams Rooms, you need to be a Global admin, Teams Service admin, or Teams Device admin. For more information about admin roles, see [Use Microsoft Teams administrator roles to manage Teams](../using-admin-roles.md).
 
+> [IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 ## Site readiness
 
 While the ordered devices are being delivered to your organization, work with your networking, facilities, and audio-visual teams to make sure that deployment requirements are met and each site and room is ready in terms of power, networking, and display.

Teams/devices/device-management.md

@@ -33,7 +33,6 @@ You can manage devices used with Microsoft Teams in your organization from the M
 
 To manage devices, such as change device configuration, restart devices, manage updates, or view device and peripheral health, you need to be assigned one of the following Microsoft 365 admin roles:
 
-- Microsoft 365 Global admin
 - Teams Service admin
 - Teams Device admin
 

Teams/devices/device-store.md

@@ -49,6 +49,9 @@ To use the devices store in the Teams admin center, go to  **Devices > Store**.
 
 To use the device store, you need to be a Global admin, a Teams admin, or a Teams device admin.
 
+> [IMPORTANT]
+>  Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 ### Browse the store
 
 The device store includes all devices that are certified for Teams, including headsets, web cameras, and Teams devices such as Teams Rooms, desk phones, and Teams displays. You can sort, filter, or search to find the device that your organization needs.

Teams/devices/manage-device-tags.md

@@ -26,12 +26,15 @@ search.appverid: MET150
 
 Device tags in Microsoft Teams let you group, organize, and more easily manage the devices you've deployed in your organization. With the Microsoft Teams admin center, you can add one or more tags to devices, use filters to view devices that match the tag you specify, and then perform actions on the devices that have that tag.
 
+> [!IMPORTANT]
+> Device tags are assigned to the resource account that's logged into a device. If you sign a resource account out of one device and then use it to sign in to another device, the device tags are applied to the new device.
+
 You can add a device tag to more than one device type. However, when you open a device pane in the admin center, only the devices of that type are returned. For example, you can assign the "Corporate" tag to both phones and Teams Rooms devices. If you search for the "Corporate" tag while in **Teams Devices** > **Phones**, only phones are returned. Similarly, if you search for the "Corporate" tag in **Teams Devices** > **Teams Rooms**, only Teams Rooms devices are returned.
 
-To manage device tags, you need to be a Global admin, Teams Service admin, or Teams Device admin. For more information about admin roles, see [Use Microsoft Teams administrator roles to manage Teams](../using-admin-roles.md).
+To manage device tags, you need to be a Teams Service admin, or Teams Device admin. For more information about admin roles, see [Use Microsoft Teams administrator roles to manage Teams](../using-admin-roles.md).
 
-> [!IMPORTANT]
-> Device tags are assigned to the resource account that's logged into a device. If you sign a resource account out of one device and then use it to sign in to another device, the device tags are applied to the new device.
+> [IMPORTANT]
+>  Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
 
 ## Create, remove, or rename device tags
 

Teams/devices/phones-for-teams.md

@@ -30,6 +30,9 @@ To deliver a high-quality and reliable Microsoft Teams experience on phones, we
 
 To manage phones, you need to be a Global admin, Teams Service admin, or Teams Device admin. For more information about admin roles, see [Use Microsoft Teams administrator roles to manage Teams](../using-admin-roles.md).
 
+> [IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 ## Features supported by Teams phones
 
 Teams-certified phones have a broad array of features to help your users do their jobs, and help you manage their use. Here's a summary of the features available in Teams-certified phones:

Teams/devices/remote-update.md

@@ -127,6 +127,7 @@ If you want to check which software versions are currently rolling out for your
 
 > [!NOTE]
 > The new version may not always be the latest available version. Devices running older versions may be updated in a step-wise approach, until they reach the latest version.
+
 ### Pause automatic updates
 
 You can temporarily pause automatic updates for your tenant. When paused, Android based devices aren't automatically updated for the next 15 days. To pause the updates, do the following steps:
@@ -136,7 +137,6 @@ You can temporarily pause automatic updates for your tenant. When paused, Androi
 3. Under the **Actions** menu, select **Pause auto-updates**.
 1. Updates automatically resume after 15 days. If you want to resume the updates before that, select **Resume auto-updates** from under the **Actions** menu.
 
-
 ## Manually update remote devices
 
 If you want to manually update devices using the Teams admin center, you can decide whether to update the devices immediately or schedule an update for a future date and time.
@@ -158,10 +158,10 @@ When you select a single device, updates that are available for the device are s
 
 After you select **Update**, updates are applied to your devices at the date and time of the selected scheduling option. If you didn't select a future date and time, updates are applied to your devices within a few minutes.
 
+To manage devices, you need to be a Global admin, Teams Service admin, or Teams Device admin. For more information about admin roles, see [Use Microsoft Teams administrator roles to manage Teams](../using-admin-roles.md).
 
-> [!NOTE]
-> To manage devices, you need to be a Global admin, Teams Service admin, or Teams Device admin. For more information about admin roles, see [Use Microsoft Teams administrator roles to manage Teams](../using-admin-roles.md).
-
+> [IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
 
 This video shows how to update Teams devices.
 

Teams/hybrid-meetings-device-config-intro.md

@@ -36,6 +36,9 @@ In order for Teams Rooms to work with your organization, you need to complete a
 
 - You need to be a Global admin and a Teams admin to complete the steps below. For more information, see [About Microsoft 365 admin roles](/microsoft-365/admin/add-users/about-admin-roles).
 
+> [!IMPORTANT]
+>Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 ## Set up the Teams Rooms account
 
 The following steps show you how to purchase a license for your Teams Rooms console, create an account for it, and then assign the license to it. Each Teams Rooms console needs its own account and license to work properly. The account you create will show up in the organization's address list as a room available for reservation in Outlook.

Teams/includes/mtr-device-config-license-include.md

@@ -6,7 +6,7 @@ Follow the steps below to purchase a Teams Rooms Basic or Teams Rooms Pro licens
 > [!NOTE]
 > If you have multiple Teams Rooms consoles, we recommend that you purchase a Teams Rooms Pro license for each of your consoles. The Teams Rooms Pro license enables more advanced remote management and analytics for Teams Rooms, enabling you to create a more consistent and robust Teams Rooms and meeting experience.
 
-1. Go to the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2024339) and log in with an account that has global admin permissions.
+1. Go to the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2024339) and log in with an account that has license admin permissions.
 1. In the admin center, go to the **Billing** > [Purchase services](https://go.microsoft.com/fwlink/p/?linkid=868433) page.
 1. On the **Purchase services** page, type in **Teams Rooms** in the search box and press enter.
 1. Select **Details** under either **Teams Rooms Basic** or **Teams Rooms Pro**.

Teams/rooms/create-resource-account.md

@@ -27,7 +27,7 @@ description: Read this article for information on how to create resource account
 
 This article provides steps to create resource accounts for shared spaces and devices, and it includes steps to configure resource accounts for Microsoft Teams Rooms on Windows, Teams Rooms on Android, Teams Rooms on Surface Hub, and hot-desking on Teams displays.
 
-Microsoft 365 resource accounts are mailbox and Teams accounts that are dedicated to specific resources, such as a room or projector. These resource accounts can automatically respond to meeting invites using rules you define when they're created. For example, if you have a common resource such as a conference room, you can set up a resource account for that conference room that will automatically accept or decline meeting invites depending on its calendar availability. 
+Microsoft 365 resource accounts are mailbox and Teams accounts that are dedicated to specific resources, such as a room or projector. These resource accounts can automatically respond to meeting invites using rules you define when they're created. For example, if you have a common resource such as a conference room, you can set up a resource account for that conference room that will automatically accept or decline meeting invites depending on its calendar availability.
 
 Every resource account is unique to a single Microsoft Teams Rooms installation or Teams display hot-desking implementation.
 
@@ -49,6 +49,9 @@ Depending on your environment, you need one or more roles to create resource acc
 |Exchange Online |Global Administrator or Exchange Administrator  |
 |Exchange Server |Exchange Organization Management or Recipient Management  |
 
+> [IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 > [!IMPORTANT]
 > If you're creating resource accounts for Teams Rooms, the resource account's UPN must match the SMTP address of the resource account.
 

Teams/rooms/multi-tenant-management-partner.md

@@ -46,7 +46,7 @@ It's recommended to configure this role so designated Tenant managers can accept
 
 **To configure tenant managers**
 
-1. Log in to the Teams Rooms Pro Management-MTM portal as either a Global admin or Teams Rooms Pro Manager role.
+1. Log in to the Teams Rooms Pro Management-MTM portal Teams Rooms Pro Manager role.
 2.	Go to Tenant managers.
 3.	Select **Add tenant managers**.
 4.	In the detail pane, search for the users or security groups.
@@ -57,14 +57,17 @@ It's recommended to configure this role so designated Tenant managers can accept
 
 The partner will provide the domain name to customers. Only the Global admin, Teams Rooms Pro Manager, and Tenant managers roles can see and will accept the invitation when they log in to the Teams Rooms Pro Management-MTM portal.
 
+> [IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 > [!Note]
 > Even though these roles can see invitations and high-level Tenant metadata, you won't see the customer’s data until you are assigned a role with that customer.
 
 Details on the customer invitation are outlined in [Multitenant management for Customers](Multi-tenant-management-customer.md).
 
 **To accept a pending invite**
 
-1. Log in to the Teams Rooms Pro Management-MTM portal as either a Global admin, Teams Rooms Pro Manager, or Tenant manager.
+1. Log in to the Teams Rooms Pro Management-MTM portal as either Teams Rooms Pro Manager, or Tenant manager.
 1. Go to **Tenants**.
 1. Select the invitation that shows a **Pending** status.
 1. Review the invitation details.

Teams/rooms/remotely-access-teams-rooms.md

@@ -49,6 +49,9 @@ When you create, edit, or assign custom roles, the account must have one of the
     - Global Administrator in Azure Active Directory (Azure AD)
     - Teams Rooms Pro Manager in the Microsoft Teams Rooms Pro Management portal
 
+> [IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 - **Role-based access control (RBAC)**: You can use RBAC roles to determine the scope of a Teams Rooms Pro management remote access users. For remote access, it as two RBAC roles:
 
   - **VIEW** These users can remotely access the device, but with this level, they're limited to only viewing the Teams Rooms consoles and displays. No changes can be saved.

Teams/rooms/resource-accounts.md

@@ -86,7 +86,7 @@ This section lists crucial alert messages and their descriptions:
 
 |Message  |Description  |
 |---------|---------|
-|Mailbox settings are not available. You need to be a global admin to get this information. Contact your administrator to get access.     |  This message appears if the users don't have permissions.       |
+|Mailbox settings are not available. You need to be a global admin to get this information. Contact your administrator to get access.     |  This message appears if the users don't have permissions.  Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.|
 |An error occurred while loading resource account(s). If the problem persists please contact support.     |   This message appears when an error has occurred while loading accounts.      |
 |An error occurred while loading summary, please try again later. If the problem persists please contact support.     | This message appears when an error has occurred while loading stats.       |
 |An error occurred while exporting file, please try again later. If the problem persists, please contact support.     | This message appears when an error has occurred while exporting resource accounts.         |

Teams/rooms/rooms-manage.md

@@ -42,7 +42,7 @@ To manage Teams Rooms devices in Teams Admin Center, open the [Microsoft Teams a
 :::image type="content" source="../media/teams-rooms-summary2.png" alt-text="Teams Rooms summary page in Teams admin center.":::
 
 > [!IMPORTANT]
-> To manage devices using the Teams admin center, you need to be assigned the Global Administrator, Teams Administrator, or Teams Devices Administrator roles.
+> To manage devices using the Teams admin center, you need to be assigned Teams Administrator or Teams Devices Administrator roles.
 
  To manage devices using Teams Rooms Pro management, see [Role-based access control in the Microsoft Teams Rooms Pro Management Portal](/microsoftteams/rooms/rooms-pro-rbac).
 

Teams/rooms/rooms-pro-rbac.md

@@ -30,6 +30,9 @@ To create, edit, or assign roles, your account must have one of the following pe
 - Global Administrator through Microsoft Entra ID
 - Teams Rooms Pro Manager through the Microsoft Teams Rooms Pro Management portal
 
+> [!IMPORTANT]
+>Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 ## What is a role?
 
 A role defines the set of permissions granted to users assigned to that role. For now, the Microsoft Teams Rooms Pro Management portal has three built-in roles: **Teams Rooms Pro Manager**, **Site Lead**, and **Site Technician**. They cover some common scenarios for users in your organization that may be involved in managing your rooms.
@@ -76,6 +79,9 @@ The following table summarizes what each role can do.
 
 If the built-in roles do not suit your organizational needs, you can create a role and configure its permissions as desired. To create a role, you must be a Global Administrator or Teams Rooms Pro Manager role. 
 
+> [!IMPORTANT]
+>Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 1. In the left navigation of the Microsoft Teams Rooms Pro Management portal, go to **Settings** > **Roles**.
 2. Select **Create role**.
 3. On the **General settings** page, under **Role properties**, enter a name for this role. Under **Description**, enter details about this role. Choose **Next**.
@@ -89,6 +95,9 @@ If the built-in roles do not suit your organizational needs, you can create a ro
 
 To assign roles, you must be a Global Administrator or Teams Rooms Pro Manager role or have a role with role management permissions.
 
+> [!IMPORTANT]
+>Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
 1. In the left navigation of the Microsoft Teams Rooms Pro Management portal, expand **Settings** > **Roles**.
 
     :::image type="content" source="../media/microsoft-teams-rooms-premium-roles.png" alt-text="Screenshot of Access control page showing roles.":::