What it does

A resource account is the disabled Entra user that gives an auto attendant or call queue an identity, a licence and, optionally, a phone number. Nesting lets one AA or CQ hand a call straight to another voice app, so only the entry point needs a resource account.

Key facts

• Resource accounts are sign-in disabled and must stay that way. No chat, and presence shows but never updates.
• Each needs a Microsoft Teams Phone Resource Account licence. These are a zero-cost allocation included with Teams Phone Standard, Teams Phone with Calling Plan and Teams Shared Devices subscriptions; you buy more if you run out. Set the licence's usage location to the right country when you assign it.
• At least one Teams Phone licence has to exist in the tenant for AA/CQ to work at all.
• Created in Teams admin center (Voice > Resource accounts, type Auto attendant or Call queue) or with New-CsOnlineApplicationInstance; edited with Set-CsOnlineApplicationInstance.
• Creating one needs a Teams admin role (Teams Administrator, Teams Communications Administrator or Teams Telephony Administrator) plus User Administrator, because you're creating a directory user.
• Numbers can be Calling Plan service numbers, Operator Connect or Direct Routing. Direct Routing numbers with extensions have to be assigned with Set-CsPhoneNumberAssignment — the admin center only handles them without.
• Nesting via the Voice app destination means a nested AA/CQ needs no resource account and no licence. Only the first AA/CQ that answers the call does.
• A queue can have multiple resource accounts, and a resource account can be used as the outbound calling ID for agents.
• Since 1 November 2025, outbound PSTN calls on behalf of a resource account (agent outbound as the queue, callback, external transfer from AA or CQ, Graph/extensibility outbound) need a funded pay-as-you-go licence or Communications Credits on Microsoft-provided numbers. Direct Routing needs an online voice routing policy; Operator Connect depends on the operator.
• Unassign the phone number before deleting a resource account, or the number can get stuck pending.
• Hybrid with Skype for Business Server 2019 uses New-CsHybridApplicationEndpoint with fixed application IDs (AA ce933385-9390-45d1-9512-c8d228074e07, CQ 11cd3e2e-fccb-42ad-ad00-878b93575e07).

When to use / skip

Every published number needs a resource account. Everything behind it generally shouldn't. Nesting through the Voice app destination keeps licence counts down, stops staff dialling a queue directly to jump the IVR, and keeps your opening hours in one place on the front AA.

Give a nested queue its own resource account only when it genuinely needs one: its own DDI, its own outbound caller ID for agents, or when supervisors need to manage it in the Queues app — authorized users can't edit nested AAs/CQs that have no resource account there.

Configuration decisions

• Which voice apps get direct numbers and which are reached only via the front AA.
• Whether queues need a dedicated "caller ID" resource account so agents can call out as the department rather than as themselves.
• Number source per resource account. Keep the resource account and every external transfer target on the same PSTN connectivity — transfers between Calling Plan, Operator Connect and Direct Routing trunks aren't supported.
• Outbound licensing: list every resource account that does callback, external overflow/transfer or on-behalf-of outbound, and get PAYG or Communications Credits on it before go-live if it's on Calling Plan numbers.
• Naming convention for UPN and display name (ra-cq-uk-sales@, display "Sales") — display name is what agents and internal callers see.
• Whether to hide queues from internal dialling: nesting without a resource account is the clean way; Information Barriers work but are heavy.

Gotchas

• Swapping a resource account from a Teams Phone Standard licence to the Resource Account licence has to happen in one operation ("Move users to a different subscription"). Remove-save-add can break the account.
• New resource accounts take time to sync before you can attach them or assign a number. Build them the day before, not in the change window.
• The admin center won't assign a Direct Routing number with an extension. Drop to PowerShell.
• Editing resource accounts has historically needed broader rights than creating them — Global Admin, or the legacy Skype for Business Administrator plus User Administrator. If a Teams Telephony admin gets an access error, that's why.
• Resource accounts land in Entra and often get swept up by user-lifecycle tooling, conditional access reviews and licence-clean-up scripts. Tag them and exclude them.
• Callback and external overflow quietly failing after November 2025 is almost always the missing PAYG/Communications Credits on a Calling Plan resource account.

Consultant notes

• Keep a resource account register: UPN, display name, linked AA/CQ, number, connectivity type, outbound licence. It saves hours when someone asks "what's on 020 7xxx".
• Put resource accounts in a dedicated admin unit or naming prefix so identity teams leave them alone.
• Design nesting top-down: one front AA per published number with hours and holidays, then voice-app links to queues with no numbers of their own.
• If the client is mixing Calling Plan and Direct Routing during a migration, map which trunk each resource account and transfer target sits on before you build anything.
• Remove the number before decommissioning, and wait for it to release before re-using it elsewhere.

---

Worth revisiting if Microsoft changes the on-behalf-of outbound licensing again, or finally lets Teams admins edit resource accounts without the legacy roles