Deploy Microsoft Teams QoS with Intune

Before deploying Microsoft Teams QoS settings to your device make sure your network is ready and configure your firewalls.

https://learn.microsoft.com/en-us/microsoftteams/qos-in-teams#make-sure-your-network-is-ready

Why should you use QoS settings for Microsoft Teams?

Quality of Service are a great way to improve the performance and reliability of the application, many of us constantly work in Microsoft Teams today, all our meetings and communication like voice calls, video, screen sharing and more is being done in Teams so it is easy to say that we want the best performance we can get here.

Setting up QoS for Teams will improve the call quality, reduce buffering of videos and manage your bandwidth better, it prioritize the Teams packages on your network.

Now to the fun part, configuring and setting it up 😁

QoS Markers in Meetings Settings

Go to Teams Admin portal.

Open the tab Meetings and select Meetings settings

Turn on Insert Quality of Service (QoS) markers for real-time media traffic.

Intune Deployment for Teams QoS settings

If you we look at the Microsoft documentation we can see that they specify how to implement QoS in Teams using PowerShell, and this is exactly what we will do.

https://learn.microsoft.com/en-us/microsoftteams/qos-in-teams#implement-qos-in-teams-on-windows-using-powershell

Teams QoS Script

The script is modify to check for failure and also remove any existing QoS settings with the same name, this allows you to overwrite and change ports later on if required.

# Microsoft Teams QoS
# https://learn.microsoft.com/en-us/microsoftteams/qos-in-teams#choose-initial-port-ranges-for-each-media-type

function CreateOrUpdatePolicy ($name, $startPort, $endPort, $dscpAction) {
    try {
        # Attempt to find an existing policy with the given name
        $policy = Get-NetQosPolicy -Name $name -ErrorAction Stop

        # If the policy is found, it is deleted for a fresh creation
        Remove-NetQosPolicy -Name $name -Confirm:$false

        # Double check to make sure policy was successfully deleted
        $policy = Get-NetQosPolicy -Name $name -ErrorAction SilentlyContinue
        if ($policy -ne $null) {
            throw "Failed to delete $name QoS policy"
        }
    } catch {
        # In the case where the policy was not found initially, 
        # the error is caught and $policy is set to $null
        $policy = $null
    }

    # If the policy didn't exist originally or was deleted successfully 
    # ($policy is $null), a new policy is created
    try {
        new-NetQosPolicy -Name $name -AppPathNameMatchCondition "Teams.exe" -IPProtocolMatchCondition Both -IPSrcPortStartMatchCondition $startPort -IPSrcPortEndMatchCondition $endPort -DSCPAction $dscpAction -NetworkProfile All
    } catch {
        throw "Failed to set $name QoS policy: $_"
    }
}

CreateOrUpdatePolicy -name "Teams Audio" -startPort 50000 -endPort 50019 -dscpAction 46
CreateOrUpdatePolicy -name "Teams Video" -startPort 50020 -endPort 50039 -dscpAction 34
CreateOrUpdatePolicy -name "Teams Sharing" -startPort 50040 -endPort 50059 -dscpAction 18

Deploying the script from Intune

We can do this a couple of ways, we could for example do a Remediation script or even package the script as a Win32 application. However I do not see the need of doing that so we will simply deploy this using the standard PowerShell script.

Go to the Intune Portal

Select Devices – Windows – PowerShell scripts.

Add a new script and input the required name and upload the PowerShell script.
Select “Run script in 64 bit PowerShell Host” assign the script to your devices or users.

You can verify that the QoS settings have been applied on the device by running the command Get-NetQosPolicy in PowerShell, this will display all the QoS policy and you should be able to see the Teams QoS we just created.

Verifying QoS using Wireshark

You should always verify that packages are being tagged correctly on your network, you can do this in a couple of ways, I will not go over the specific details on how to use Wireshark.

https://learn.microsoft.com/en-us/microsoftteams/qos-in-teams#validate-your-qos-implementation

Wireshark example output

In Wireshark we can capture the Network package on a device and verify that the tagging is working correctly.