The client is a mid-sized consulting firm, ISO 27001 certified, whose managed IT and ISMS we already ran. When they took a new floor, the brief was broader than “put a screen in each room”. Town halls run weekly with staff dialling in from interstate. Consultants whiteboard with clients and need to take the result away. And the firm's core service, facilitated sessions with participants, has to be watched live by their client without that client ever being in the room.
This is a story about the configuration, not the boxes. The hardware went in over a couple of days. The work that made it reliable happened in Exchange Online, Teams admin, the network, and Azure.
The floor
An open-plan floor with a town hall area, five meeting rooms, a boardroom, a glass-walled observation room for facilitated client sessions, a breakout lounge and phone booths. We designed and installed the UniFi wireless for the floor as part of the same project, which mattered later.
MaxHub throughout, specified per room:
- Town hall. An 86" MaxHub XBoard V7 interactive board on the wall, mounted for 40 seated people to see the back row over the front row while keeping the touch surface and the integrated camera at a usable height. Remote staff appear on it alongside the presentation.
- Meeting rooms. MaxHub XBar V50 all-in-one video bars on commercial displays in three rooms, an XBar V70in the larger room, and 55" XBoard V7 boards where the room is small enough for one unit to do display, camera, audio and compute.
- Observation room.A 65" XBoard V7 for the facilitator, plus a MaxHub Capture System: two independently positioned gimbal cameras, a pair of ceiling microphones over the group, and a capture host that composites the feeds and pushes up to three RTMP streams.
Every room account was created as an Exchange Online resource mailbox, licensed with Teams Rooms Basic, enrolled in the tenant, and tested with a real Teams call before handover.
Why the observation room was the hard part
The obvious answer for the observation room was a second XBar V70. We recommended against it and wrote the client a comparison to explain why. A meeting bar is built so the people in the room can see and hear remote participants. An observation room is the reverse: the people in the room are the subject, and the audience is a client watching one-way, who needs a wide shot of the group and a tight shot of whoever is speaking, with audio picked up from above the table rather than from a bar on the wall.
The Capture System gave them that. It also created the streaming problem.
Streaming client sessions without a new supplier
The client needed clients to watch sessions live from their own offices. Three options were on the table, and each had a catch.
- Teams or Zoom RTMP-in.Both generate a new stream URL and key per meeting instance, so every session means reconfiguring the capture host. Zoom's option also requires a paid add-on licence.
- A third-party streaming platform.Confidential client content on someone else's servers. Under the firm's ISO 27001 ISMS, that is a new supplier assessment cycle before anyone streams anything.
- Self-host it. More work up front, but one permanent viewer URL, one permanent RTMP target on the capture host, and no new supplier.
We self-hosted. A small relay runs in Azure, in the Australia East region to match the data-residency language already in the client's Statement of Applicability. The capture host pushes its three channels to it over RTMP with a fixed publish key. Clients open a single web address, enter a session password, and watch.
The part that took care was the password. Sessions for different clients must never share one, and the firm did not want IT rotating it. So the viewer password lives in a tightly-permissioned SharePoint list, the relay reads it live through Microsoft Graph using certificate-based authentication with the certificate held in Azure Key Vault, and a small internal portal behind Entra ID single sign-on lets authorised staff roll it with one click. No credentials are stored on the relay. The whole thing costs tens of dollars a month in Azure consumption.
We also caught two real bugs in local testing before go-live, including one where the relay would have silently rejected every publish from the capture host. Test with real RTMP traffic, not just health checks.
What broke after go-live, and how it was fixed
Every Teams Rooms deployment has a second phase where real usage finds the gaps. These are the ones this floor produced, because they are the ones most installs produce.
- The town hall board sat in the lobby.The weekly town hall was organised by a staff member who invited the board's account as an attendee. The board showed “someone will let you in” until the organiser joined. The lobby policy was fine. The cause was that the account had been created as a user mailbox, so Teams treated the board as a person, not a room. Converting it to a room resource and fixing calendar processing made it auto-join. AV installers rarely look here; it is an Exchange problem.
- A licence would not assign. Teams Rooms Basic refused to attach to one room account. The account had no usage location set in Entra ID. One field, thirty seconds, and a common trap when room accounts are created by script.
- Whiteboard saves failed on guest Wi-Fi. The XBoard saves a whiteboard by showing a QR code that points at the board itself. Anyone on the guest network could not reach it, by design, because the guest VLAN is isolated from the corporate VLAN. A single firewall rule allowing guest clients to reach that one device on the ports it uses restored the feature without opening the network. Because we had built the wireless, the fix was ours to make.
- Remote participants heard muttering.Two meeting rooms share a wall. The V50's beamforming array and automatic gain were picking up speech through the partition and the ceiling void and presenting it to remote callers as indistinct background talk. We worked it from the cheapest end: narrowing mic pickup and gain before any building work, and identifying the ceiling plenum as the path to treat if acoustics needed to follow.
None of these were hardware faults. All of them would have stalled with a vendor who only does AV, or with an IT provider who does not touch rooms.
Why it stayed inside the ISMS
The client's ISO 27001:2022 certification was maintained through and after the project. The rooms did not create audit work because nothing about them lives outside the tenant: room accounts are Entra ID identities, devices are visible in Teams admin, the streaming relay is an Azure resource in the client's own subscription in an Australian region, and the only secret that matters is rotated by the client's own staff through single sign-on. There was no new supplier to assess and no confidential session ever transited a platform the firm does not control.
Client anonymised. Technical detail available on request.
What to take from it
- Specify per room. Boards where one unit can cover the room, bars where the display is already there or the room is bigger, and purpose-built capture where the room is a studio rather than a meeting space.
- Rooms are Exchange and Entra objects first. Resource mailbox type, calendar processing, usage location and lobby policy decide whether a room joins a meeting. Get those right before blaming the board.
- If you hold ISO 27001, count the suppliers. The convenient streaming platform is also a supplier assessment, a data-flow change and a residency question. Sometimes the cheaper answer is to own it.