How to Configure Teams Phone Mobile Access Policies in PowerShell Using CsTeamsCarrierTenantAccessPolicy

Modern enterprise mobility demands seamless convergence between corporate telecommunications and desktop collaboration. Traditionally, enterprise users had to juggle separate SIM cellular phone numbers and Microsoft Teams VoIP lines, creating fragmented presence statuses, disjointed call histories, and compliance blind spots. With Teams Phone Mobile (formerly Operator Connect Mobile), participating telecommunications carriers integrate cellular SIM cards directly into an organisation’s Microsoft 365 cloud PBX infrastructure.

When a user receives a phone call on their native mobile cellular dialer, their Microsoft Teams client simultaneously rings across desktop, tablet, and web apps, while their corporate presence automatically switches to “In a call”. To control which user cohorts or executive branches have permission to enable carrier integration and activate cellular-to-Teams bridging, Microsoft Teams administrators use dedicated PowerShell cmdlets under the CsTeamsCarrierTenantAccessPolicy family. This guide explains how Teams Phone Mobile access policies function, how to inspect existing tenant assignments, and how to create and grant scoped carrier access policies using the Microsoft Teams PowerShell module.

Understanding Teams Phone Mobile and Carrier Access Policies

Teams Phone Mobile operates as an enterprise mobile partnership between Microsoft and certified tier-1 telecommunications carriers (such as Rogers, Swisscom, Telia, Verizon, and BT). Through carrier-level peering, cellular voice channels interconnect directly with Microsoft Teams SIP trunks and Azure Communication Services infrastructure.

Governing this carrier relationship requires granular policy controls. The CsTeamsCarrierTenantAccessPolicy cmdlet family manages tenant-level and user-level permissions for mobile carrier services:

• Global (Tenant-Wide Default): Controls whether carrier mobile integration is permitted by default for all licensed users in the Microsoft 365 directory. In many enterprise environments, administrators keep the Global policy disabled or restricted until corporate mobile subscriptions and carrier service agreements are finalised.
• Custom Scoped Policies: Allows administrators to create granular policies targeted at specific employee groups (e.g. field engineers, executives, or corporate sales teams) who carry company-sponsored smartphones with supported carrier SIMs.
• Carrier Mobile Number Binding: Ensures that only users explicitly granted carrier access policies can have their carrier mobile phone numbers linked to their Teams Phone system identities.

Implementing targeted access policies prevents unauthorised cellular activation and ensures mobile voice traffic conforms to organisational data loss prevention (DLP) and compliance recording mandates.

Prerequisites and PowerShell Module Connection

Configuring Teams carrier access policies requires the Microsoft Teams PowerShell module version 4.9.0 or later and an account assigned the Teams Administrator or Global Administrator role in Microsoft Entra ID.

Open an elevated PowerShell session and verify your module version:

Get-Module -ListAvailable -Name MicrosoftTeams

If the module is outdated or missing, install or update it from the PowerShell Gallery:

Install-Module -Name MicrosoftTeams -Force -AllowClobber -Scope CurrentUser

Next, authenticate to your Microsoft 365 tenant:

Connect-MicrosoftTeams

Once authenticated, verify your active session by checking your tenant connection status:

Get-CsTenant | Select-Object DisplayName, TenantId

Inspecting Current Carrier Tenant Access Policies

Before introducing new policies, audit the current configuration across your tenant using Get-CsTeamsCarrierTenantAccessPolicy:

Get-CsTeamsCarrierTenantAccessPolicy

PowerShell outputs existing policy definitions:

Identity    : Global
Description : Default tenant-wide carrier mobile access configuration
Enabled     : False

Identity    : Tag:Executive-Mobile-Access
Description : Allows mobile SIM carrier bridging for executive leadership
Enabled     : True

By reviewing the Identity and Enabled attributes, you can immediately identify whether cellular mobile bridging is globally permitted or restricted to specific cohorts.

To view specific attributes of a named policy in list format:

Get-CsTeamsCarrierTenantAccessPolicy -Identity "Global" | Format-List

Creating Custom Carrier Access Policies

Best practice in enterprise governance dictates leaving the default Global policy disabled (Enabled = $false) and creating explicitly named policies for departments or user tiers authorised to use corporate mobile SIM integration.

To create a new carrier access policy that enables mobile integration for field service staff or sales representatives, use New-CsTeamsCarrierTenantAccessPolicy:

New-CsTeamsCarrierTenantAccessPolicy `
    -Identity "FieldSales-CarrierMobile" `
    -Description "Authorises Teams Phone Mobile integration for field sales personnel" `
    -Enabled $true

To create an explicitly disabled policy used to block mobile carrier integration for contractor accounts or temporary staff:

New-CsTeamsCarrierTenantAccessPolicy `
    -Identity "Contractors-BlockMobile" `
    -Description "Explicitly blocks cellular SIM integration for external contractor accounts" `
    -Enabled $false

Modifying Existing Policy Settings

If policy requirements change—such as when expanding a carrier pilot program to tenant-wide adoption—use Set-CsTeamsCarrierTenantAccessPolicy to update existing policy instances:

# Enable carrier mobile access on the Global tenant policy
Set-CsTeamsCarrierTenantAccessPolicy -Identity "Global" -Enabled $true

Conversely, to immediately disable a policy during carrier maintenance or security investigations:

Set-CsTeamsCarrierTenantAccessPolicy -Identity "FieldSales-CarrierMobile" -Enabled $false

Assigning Policies to Individual Users and Security Groups

Once a custom policy is defined, assign it to licensed users using the Grant-CsTeamsCarrierTenantAccessPolicy cmdlet.

Granting Policy to an Individual User

To assign the custom mobile access policy to a specific user via their User Principal Name (UPN):

Grant-CsTeamsCarrierTenantAccessPolicy `
    -Identity "[email protected]" `
    -PolicyName "FieldSales-CarrierMobile"

To remove a direct policy assignment and revert a user to the default Global tenant setting, pass $null to the -PolicyName parameter:

Grant-CsTeamsCarrierTenantAccessPolicy `
    -Identity "[email protected]" `
    -PolicyName $null

Assigning Policies at Scale via Security Groups

In large enterprises with hundreds of mobile subscribers, assign policies dynamically based on Microsoft 365 or Entra ID security group membership using New-CsGroupPolicyAssignment:

# Obtain the Object ID of the target Entra ID security group
$groupId = (Get-MgGroup -Filter "DisplayName eq 'Field Sales Department'").Id

# Assign the carrier policy to the security group with evaluation rank
New-CsGroupPolicyAssignment `
    -GroupId $groupId `
    -PolicyType TeamsCarrierTenantAccessPolicy `
    -PolicyName "FieldSales-CarrierMobile" `
    -Rank 1

Group-based policy assignments automatically apply the carrier access policy to new employees added to the security group, eliminating manual provisioning steps.

Verifying User Policy Assignments and Telephony State

After granting a policy, verify that the assignment is correctly applied to the user’s online directory record:

Get-CsOnlineUser -Identity "[email protected]" | Select-Object DisplayName, UserPrincipalName, TeamsCarrierTenantAccessPolicy, LineURI, EnterpriseVoiceEnabled | Format-List

Expected output confirms the policy association:

DisplayName                    : Sarah Jenkins
UserPrincipalName              : [email protected]
TeamsCarrierTenantAccessPolicy : FieldSales-CarrierMobile
LineURI                        : tel:+14165550198
EnterpriseVoiceEnabled         : True

Once the policy is granted and active, the user’s carrier-provisioned mobile SIM can be linked in the Microsoft Teams admin center or via carrier self-service portals, unifying native mobile dialling and Teams communications under a single corporate phone identity.