Softphone MFA constraints

Overview

Teams on mobile inherits Conditional Access: MFA prompts mid-call disrupt execs; compliant device requirements block personal phones.

Design choices

• Certificate-based device trust or MAM-only balance when BYOD calls allowed.
• Voice-specific CA policies excluding risky countries but allowing domestic—order of evaluation matters.

Common breaks

• Passwordless push loops when time skew—fix NTP.
• Session revocation during hunt—agents drop; tune sign-in frequency vs risk.

Support script

Collect Correlation ID, device Intune status, whether issue is PSTN or Teams-only.

Vendor limits

Some SIP softphones cannot do modern auth—retire or isolate on VPN; never embed service passwords in mobile profiles.

Governance

Quarterly review of excluded groups—exclusions rot into permanent holes.