Configuration · guide

Setting up SIP Gateway for Cisco and Poly phones on Teams

Microsoft Teams Phone

Verified 2026-09-30 · 79 sources · tier 2

For Teams Phone administrators reusing existing Cisco or Poly SIP desk phones as Teams endpoints through SIP Gateway.

Microsoft lists Cisco IP phones with multiplatform SIP firmware, and SIP devices from vendors such as Poly, as compatible with SIP Gateway 37. Microsoft lists SIP Gateway device capabilities as including PSTN and Teams calling, hold and resume, voicemail with message waiting indicator, DTMF, and blind and consultative transfer 43.

Before you start

To use SIP Gateway, each Teams user must have a phone number with PSTN calling enabled, plus Microsoft Teams, Skype for Business Online (Plan 2), Microsoft Phone System and PSTN connectivity 72.
To use PSTN telephony with Teams Phone, a user account must be licensed with the Teams Phone application and must also have a PSTN solution from a PSTN service provider 73.
Microsoft states that SIP Gateway is not yet available for DoD 50.
Cisco devices that run enterprise firmware must first be converted to multiplatform (MPP) firmware 74.
During onboarding, SIP Gateway pushes its default configuration and authentication interface to the device, and the device must be on the minimum supported firmware 51.
SIP Gateway supports only IPv4, although the Teams service and clients support both IPv4 and IPv6 46.
Inventory each phone's MAC address, because Teams admin center enrollment adds devices by MAC address 66 and a bulk sign-in CSV identifies each device by its MAC address 4.
Inventory the region each site belongs to, because the provisioning server URLs differ for EMEA, the Americas and APAC 62.
Inventory each site's public IP addresses, because Conditional Access exclusions use them 17 and bulk sign-in requires them as trusted IPs 12.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Which existing phones are you reusing?

How will the phones find the SIP Gateway provisioning server?

How will each phone be signed in?

Does Entra Conditional Access apply to the accounts that will sign in?

Four questions. One permanent page you can send to your manager.

Step 1 Confirm SIP Gateway is available for the organization

Do

In the Teams admin center, open Teams devices and look for a SIP devices tab: if it is visible, the SIP Gateway service is enabled for the organization 2.

If the tenant is in DoD, stop here, because Microsoft states SIP Gateway is not yet available for DoD 50.

Check that each account that will sign in has a phone number with PSTN calling enabled, Microsoft Phone System and PSTN connectivity 72.

Verify

The SIP devices tab is visible under Teams devices 2.

SIP Gateway device users can only call users who have phone numbers 22.

Suggested check: confirm that every account that will sign in, and every account the phones must reach, shows an assigned phone number.

Step 2 Qualify the phones and their firmware

Cisco phones still running enterprise firmware

Do

Cisco devices running enterprise firmware must be converted to multiplatform (MPP) firmware before SIP Gateway supports them 74.

Plan only for models in Microsoft's list: the Cisco 6821, 6841, 6851, 6861, 6871, 7811, 7821, 7841, 7861, 8811, 8841, 8845, 8851, 8861 and 8865 need minimum firmware 11.1.1MPP, and the 8832 needs minimum 11.3.5MPP, with 12-0-7MPP approved for all of them 32.

Verify

Each converted phone reports MPP firmware at or above Microsoft's minimum of 11.1.1MPP, or 11.3.5MPP for the 8832 32.

Suggested check: record each phone's model, firmware version and MAC address after conversion and compare the list with your inventory.

Cisco phones already on multiplatform (MPP) firmware or PhoneOS

Do

For the Cisco 6821, 6841, 6851, 6861, 6871, 7811, 7821, 7841, 7861, 8811, 8841, 8845, 8851, 8861 and 8865, Microsoft lists minimum firmware 11.1.1MPP and approved firmware 12-0-7MPP, and for the 8832 a minimum of 11.3.5MPP with 12-0-7MPP approved 32.

For the Cisco 8875, 9841, 9851, 9861 and 9871, Microsoft lists PhoneOS 3.3.1 as both the minimum and the approved firmware 33.

Verify

Each phone's firmware version matches or exceeds the minimum Microsoft lists for its model 32 33.

Suggested check: record each phone's model, firmware version and MAC address and compare the list with your inventory.

Poly VVX, Trio or Edge phones

Do

Microsoft lists Poly VVX models with minimum firmware 5.9.5, with approved firmware 5.9.7.3480 for the VVX300, 310, 400, 410, 500 and 600, and 6.4.x builds for other VVX models such as the VVX250, 350 and 450 (6.4.6.2656) 60.

Microsoft lists the Poly Trio 8500 and 8800 with minimum 5.9.5.3182 and approved 7.2.4.0185, the Poly Edge E100 to E550 with minimum 8.1.0.12774 and approved 8.5.1.0508, and Poly Edge V models with minimum 8.5.1.0565 59.

Microsoft's compatible-devices table notes that a Poly device will auto reboot and install the selected firmware 56.

Verify

Each phone's firmware version matches or exceeds the minimum Microsoft lists for its model 60 59.

Suggested check: record each phone's model, firmware version and MAC address and compare the list with your inventory.

Step 3 Open the network path to SIP Gateway

Do

Open the firewall to Microsoft 365 and Teams traffic according to the Office 365 URLs and IP address ranges; rules are needed for outbound traffic only 44.

Make sure the phones' http/s traffic bypasses any corporate proxy 44.

Open UDP ports 49152 to 53247 and TCP port 5061 for the IP ranges 52.112.0.0/14 and 52.122.0.0/15 61.

Give the phones IPv4 addresses, because SIP Gateway supports only IPv4 46.

Verify

Suggested check: confirm firewall rules exist for the listed ports and ranges, and that the phone network is excluded from proxy settings.

Rollback

Suggested rollback: remove the firewall rules and proxy bypasses added in this step.

Step 4 Enable the SIP devices calling policy

Do

In the Teams admin center, go to Voice > Calling policies, turn on SIP devices can be used for calls in the policy assigned to the target users, and save it 55.

In PowerShell, the same setting is -AllowSIPDevicesCalling $true on Set-CsTeamsCallingPolicy, and the default is False, so users cannot use SIP devices until it is enabled 53.

On the same policy, set AllowCallRedirect to Enabled, because SIP phones on SIP Gateway depend on call redirect and the setting also makes device-local call forwarding work 1.

Verify

Calling policy propagation for SIP Gateway enablement may take up to 24 hours 52.

Suggested check: open the policy assigned to the target users and confirm both settings are on before troubleshooting any sign-in.

Rollback

With AllowSIPDevicesCalling set to False, users cannot use SIP devices 53.

Policy changes for signed-in users sync to the device within 1 hour 54.

Step 5 Handle Conditional Access for SIP Gateway

Yes, Conditional Access policies target these accounts or all cloud apps

Do

Because SIP devices are not Intune-managed, stricter Conditional Access checks apply to them, and Microsoft states an organization using Conditional Access for devices on the corporate network should exclude its site public IP addresses and the SIP Gateway API app 17.

The SIP Gateway resources cannot be excluded from Conditional Access policies directly, and excluding the apps alone is insufficient, so Microsoft documents a dynamic app filter based on a custom security attribute 19.

Define and assign the custom security attribute with the Attribute Definition Administrator and Attribute Assignment Administrator roles, because by default Global Administrator and other admin roles cannot read, define or assign custom security attributes 16.

Create service principals for SIP Gateway API (0ab9de21-b802-4d77-b279-1ad41ca233b4) and SIP Gateway UserApp (582b2e88-6cca-4418-83d2-2451801e1d26), plus Teams SIP Gateway (61c8fd69-c13e-4ee6-aaa6-24ff71c09bca) if you use bulk sign-in, and assign the custom security attribute to each 21.

In each Conditional Access policy, set Target resources to include All cloud apps, and on the Exclude tab use Edit filter with the custom attribute, operator Contains, and the value assigned to the SIP Gateway apps 18.

If you use bulk sign-in, or your SIP devices were signed in before July 2023, add location-based exclusions for the regional SIP Gateway service IPs: 52.170.38.140 and 40.112.144.212 (North America), 40.112.71.149 and 40.113.112.67 (EMEA), and 20.92.120.71 and 13.73.115.90 (APAC) 20.

Starting 1 January 2026 Microsoft requires 4 additional service IPs per region to be excluded: 70.152.106.56, 70.152.136.2, 70.152.120.55 and 70.152.38.25 (North America); 70.152.180.28, 70.152.200.28, 70.152.180.29 and 70.152.192.2 (EMEA); and 70.152.50.14, 70.152.1.9, 70.152.49.18 and 70.152.1.10 (APAC) 14.

We infer that tenants whose bulk sign-in location exclusions were set up before 1 January 2026 and list only the original 6 service IPs are likely to see bulk sign-in blocked by Conditional Access until the 12 additional IPs are added 15.

Verify

Each policy's Exclude tab shows the filter on the custom attribute with operator Contains 18.

Suggested check: confirm that each required service principal exists in the tenant and carries the attribute value, and that every location exclusion lists the site public IPs and all required service IPs.

Rollback

Suggested rollback: remove the attribute filter and the location exclusions from each policy you edited.

No Conditional Access policy applies to these accounts

Do

Microsoft states that stricter Conditional Access checks apply to SIP devices because they are not Intune-managed, and that an organization using Conditional Access should exclude its site public IP addresses and the SIP Gateway API app 17.

Microsoft notes that common area phones can be impacted by conditional access rules and other identity configurations such as user-interactive MFA 24.

Verify

Suggested check: confirm that no access policy in the identity platform targets the accounts that will sign in, and record that result with the deployment notes.

Step 6 Prepare the accounts that will sign in

Direct sign-in by the person at the phone with a pairing code

Do

Use each user's own account, because only local sign-in is supported for users' personal SIP Gateway devices 48.

Each account needs a phone number with PSTN calling enabled, Microsoft Phone System and PSTN connectivity 72.

Assign each account the calling policy on which you turned on SIP devices can be used for calls 55.

Verify

SIP Gateway device users can only call users who have phone numbers 22.

Suggested check: confirm each account shows an assigned phone number and the SIP-enabled calling policy.

Rollback

Suggested rollback: assign the accounts back to the calling policy they used before this step.

Enrollment from the Teams admin center for common area phones

Do

Microsoft recommends creating each common area phone account as a standard user account with a manually set password, with automatic password creation and change-at-first-sign-in unchecked, and assigning the Teams Shared Devices license, which includes Phone System features 23.

Shared Device licenses are supported only for telephone devices 75.

Each account needs a phone number with PSTN calling enabled 72, and the calling policy on which SIP devices can be used for calls is turned on 55.

We infer that admin-driven remote pairing is available only for shared common area accounts, not for an individual user's phone 68.

Teams admin center enrollment of SIP devices is unavailable in GCC 66.

Verify

Suggested check: confirm each common area account shows the shared device license, an assigned phone number and the SIP-enabled calling policy.

Rollback

Suggested rollback: remove the license from each account created in this step and delete the account.

Bulk sign-in by PowerShell for many common area phones

Do

Accounts in a bulk sign-in request must have the CommonAreaPhone policy applied, must not have MFA enabled, must have a phone number assigned and must have the AllowSIPDevicesCalling calling policy assigned 3.

The account must not have User must change password at next login or User's password can't be changed selected, and the minimum password age must be 0, otherwise password writeback fails 8.

Bulk sign-in resets the shared device account's password at runtime to an unknown value and uses the new credential to fetch a token from Entra ID 9.

At least 24 hours before running the bulk sign-in cmdlets, add each site's public IP address or range to the tenant's trusted IPs 12, under Locations > Network topology > Trusted IPs > Add or with New-CsTenantTrustedIPAddress 69.

Turn bulk sign-in on tenant-wide with Set-CsTeamsSipDevicesConfiguration -BulkSignIn Enabled, which requires a role such as Teams Administrator or Teams Communications Administrator 10.

Install MicrosoftTeams PowerShell 5.6.0 or later, and run bulk sign-in from an account holding Authentication Administrator, Privileged Authentication Administrator or Global Administrator, with Microsoft recommending the least-privileged role 7.

Verify

Microsoft's bulk sign-in error table maps errors to fixes, including a missing phone number, a missing AllowSIPDevicesCalling or CommonAreaPhone policy, and a public IP not configured as a trusted IP 5.

Suggested check: confirm each account meets every account requirement above, each site's public IP appears in the trusted IP list, and the tenant-wide bulk sign-in setting reads Enabled.

Rollback

Set-CsTeamsSipDevicesConfiguration -BulkSignIn Disabled switches bulk sign-in off tenant-wide 10.

After a bulk sign-in has run, the account's password is an unknown value 9.

Suggested rollback: remove the added trusted IPs, set a new password on any account you reuse elsewhere, and remove the license and policies from accounts you no longer need.

Step 7 Factory-reset the phones and point them at the provisioning server

Phones sit on a corporate network where you control DHCP

Do

Reset each SIP device to its factory default settings using the manufacturer's instructions 41.

On the phone scope, set DHCP option 160, which Microsoft specifies for Cisco and Poly phones, and optionally option 42 for NTP and option 2 for the UTC offset 39.

Use the regional provisioning URL: http://noam.ipp.sdg.teams.microsoft.com for the Americas, http://emea.ipp.sdg.teams.microsoft.com for EMEA or http://apac.ipp.sdg.teams.microsoft.com for APAC 62.

For Cisco devices, append /$PSN.xml to the URL 34.

If you use bulk sign-in, add the tenant ID to the URL: for Cisco phones in North America the form is http://noam.ipp.sdg.teams.microsoft.com/tenantid/<tenant-ID>/$PSN.xml, and for other phones the same URL without the suffix 11.

To set the phone's interface language, append lang_xx to the URL (for Cisco, before /$PSN.xml), using en, es, ja, de, fr or pt; English is used when the parameter is absent or unsupported 47.

Verify

A successfully provisioned SIP phone displays the Teams logo and a soft button for sign-in 51.

Rollback

Suggested rollback: remove the option from the phone scope and reset the phone to factory defaults.

Phones are at remote or home sites, so you enter the URL on each phone

Do

Reset each SIP device to its factory default settings using the manufacturer's instructions 41.

Browse to the device's IP address, sign in to its web utility and enter the provisioning server URL under Settings or Advanced settings 49.

For Cisco devices, append /$PSN.xml to the URL 34.

To set the phone's interface language, append lang_xx to the URL (for Cisco, before /$PSN.xml), using en, es, ja, de, fr or pt; English is used when the parameter is absent or unsupported 47.

Verify

A successfully provisioned SIP phone displays the Teams logo and a soft button for sign-in 51.

Rollback

Suggested rollback: clear the URL in the phone's web utility, or reset the phone to factory defaults.

Step 8 Sign the phones in

Direct sign-in by the person at the phone with a pairing code

Do

The user presses Sign-in on the phone to display an authentication URL and a time-sensitive pairing code, signs in with corporate credentials in a desktop or mobile browser and enters the code; if the code expires, the user presses Back and starts again 70.

SIP Gateway authenticates the user through a web authentication app using the OAuth 2.0 device authorization grant flow, and the location that app shows is the SIP Gateway datacenter the device is connected to 38.

Verify

On success the phone shows the phone number and username if the model supports it 70.

The device appears under Teams devices > SIP devices only after its user signs in at least once 45.

Rollback

The user can sign the device out with the Sign-Out key, or an admin can sign it out from its Details pane in Teams devices > SIP devices 63.

Enrollment from the Teams admin center for common area phones

Do

Under Teams devices > SIP devices > Actions > Provision devices, add each device's MAC address and location, one at a time or by CSV upload, and generate a one-time verification code; the device must already be onboarded 66.

On the phone, dial *55* followed by the verification code (for example *55*123456) to enroll it 67 42.

Under Waiting for sign in, select Signed out to show an authentication URL and pairing code, and complete them in a browser with the common area account's credentials 67.

Verify

The device appears under Teams devices > SIP devices once the account has signed in at least once 45.

Suggested check: confirm each enrolled device has left the waiting states and shows the common area account's number.

Rollback

An admin can sign the device out from its Details pane in Teams devices > SIP devices, but removing a SIP device from the tenant is currently unavailable in the Teams admin center 63.

Bulk sign-in by PowerShell for many common area phones

Do

Build a CSV with Username (the UPN) and HardwareId (the MAC address as xx-xx-xx-xx-xx-xx), and submit it with New-CsSdgBulkSignInRequest -DeviceDetailsFilePath <csv> -Region set to NOAM, EMEA or APAC 4.

We infer that saving the BatchId from the original request lets you query its status later without submitting a second batch 65.

Bulk sign-in runs in batches of up to 100 devices, with a limit of 3 concurrent batches per region 6.

Bulk sign-in applies to new devices within 72 hours of onboarding, or to signed-out devices within 7 days (168 hours) of sign-out, and Microsoft advises running it at least 1 hour and at most 70 hours after provisioning 13.

For a single common area phone, the SIP remote login portal (aka.ms/sipremotelogin) signs it in without touching the device when you authenticate as the common area account, choose the NOAM, EMEA or APAC region and enter the MAC address as XX-XX-XX-XX-XX-XX, provided the bulk sign-in prerequisites are in place 71.

Verify

Get-CsSdgBulkSignInRequestStatus -Batchid reads the progress of the request 4.

WarmTransfer's reading of the sources is that Microsoft's status example calls New-CsSdgBulkSignInRequest again before the status cmdlet, so running it verbatim likely submits a second batch, and querying only the status cmdlet with the saved BatchId avoids this 65.

Microsoft's bulk sign-in error table covers failures including a BulkSignIn tag missing because of a wrong tenant ID in the provisioning URL, and a bulk sign-in deadline expired after 72 or 168 hours 5.

Rollback

An admin can sign devices out from their Details pane in Teams devices > SIP devices, but removing a SIP device from the tenant is currently unavailable in the Teams admin center 63.

Set-CsTeamsSipDevicesConfiguration -BulkSignIn Disabled switches bulk sign-in off tenant-wide once no more batches are planned 10.

Step 9 Set up emergency location for the phones

Do

SIP Gateway supports dynamic emergency calling for devices that share network attributes provisioned in the Teams admin center, either local IP and subnet length or chassis ID and port 40.

Otherwise SIP Gateway falls back to registered addresses, which are not supported for Direct Routing 40.

Direct Routing also requires specific emergency call routing policies 76.

Compatible Cisco SIP IP phones support dynamic emergency location discovery with SIP Gateway over LLDP only 31.

For Poly devices, LLDP must be turned on at switch level for subnet-length-based dynamic location discovery 58.

Microsoft marks the Poly VVX300, VVX310, VVX400, VVX410, VVX500 and VVX600 as supporting only static location with SIP Gateway 64.

An emergency address must be validated and carry a geo code before you can assign it to a network identifier, and addresses created with the Teams admin center map search get both automatically 77.

Verify

Suggested check: confirm the switches send LLDP on phone ports, and that each phone subnet or switch port is mapped to a validated address.

Rollback

Suggested rollback: remove the network-to-location mappings added in this step.

Step 10 Test calling and phone features

Do

From each phone model, place and receive a PSTN call and a call to a Teams user, then test hold and resume, a blind and a consultative transfer, and a DTMF menu 43.

Call only users who have phone numbers, because SIP Gateway device users can only call users who have phone numbers 22.

Check voicemail with the feature code *99*, and set and reset Teams Do Not Disturb with the feature codes *30* and *31* 42.

Set a device-local call forwarding rule, which works only with AllowCallRedirect set to Enabled 1.

If the phones are call queue agents, make sure the queue does not use presence-based routing, because SIP Gateway does not publish presence for SIP devices 78.

Verify

Suggested check: confirm every test call connects in both directions, each transfer completes, the menu responds to key presses, and the presence shown for the account changes after the set and reset codes.

Rollback

Suggested rollback: clear the test forwarding rule and the do-not-disturb state on each phone.

Step 11 Hand over for operation

Do

Monitor the phones under Teams devices > SIP devices, where a device can also be restarted 45.

Tell phone owners that SIP Gateway automatically offboards signed-in devices after 30 days without a connection and signed-out devices after 14 days, and that an offboarded device can be onboarded again after a factory reset 79.

Verify

Suggested check: confirm the number of devices in the inventory matches the number of phones deployed.

Rollback

Devices can be signed out by the user or by an admin, but removing a SIP device from the tenant is currently unavailable in the Teams admin center 63.

A signed-out device is offboarded after 14 days 79.

Applicability

Applies to: Microsoft Teams Phone, MicrosoftTeams PowerShell module, and Microsoft Entra ID. Deployments: hybrid and multi-tenant. Sources checked 2026-09-30. Microsoft states that SIP Gateway is not yet available for DoD 50. Teams admin center enrollment of SIP devices as common area phones is unavailable in GCC 66. Starting 1 January 2026 Microsoft requires 4 additional SIP Gateway service IPs per region to be excluded from Conditional Access 14.

What remains uncertain

The procedure, licensing and eligible hardware for converting phones from enterprise firmware to multiplatform firmware are not covered by the sources below. Whether SIP Gateway is available in GCC High is not covered by the sources below. The configuration of emergency call routing on a Direct Routing session border controller for these phones is not covered by the sources below. The steps of the vendor provisioning guide linked from the compatible-devices table are not covered by the sources below. Firmware minimums, approved versions and the Conditional Access service IP list may change after the claims were gathered, and how often they change is not covered by the sources below.

Sources

1
SIP phones on SIP Gateway depend on call redirect, so the AllowCallRedirect attribute of the Teams calling policy must be set to Enabled; this also makes device-local call forwarding work.
Configure SIP Gateway · Sync policy changes to SIP devices to enforce policies · Checked 2026-09-30
2
If the SIP devices tab is visible under Teams devices in the Teams admin center, the SIP Gateway service is enabled for the organization.
Configure SIP Gateway · Verify that SIP Gateway is available for your organization · Checked 2026-09-30
3
Accounts in a bulk sign-in request must have the CommonAreaPhone policy applied, must not have MFA enabled, must have a phone number assigned and must have the AllowSIPDevicesCalling calling policy assigned.
Configure SIP Gateway · Bulk sign in prerequisites, items 4-7 · Checked 2026-09-30
4
A bulk sign-in request is a CSV with Username (UPN) and HardwareId (MAC as xx-xx-xx-xx-xx-xx, or with :001-style port suffix for ATA ports) submitted with New-CsSdgBulkSignInRequest -DeviceDetailsFilePath <csv> -Region NOAM, EMEA or APAC, and its progress is read with Get-CsSdgBulkSignInRequestStatus -Batchid.
New-CsSdgBulkSignInRequest (MicrosoftTeams) · Parameters -DeviceDetailsFilePath and -Region; Example 2 · Checked 2026-09-30
5
Microsoft's bulk sign-in error table maps errors to fixes, including missing phone number, missing AllowSIPDevicesCalling or CommonAreaPhone policy, BulkSignIn tag missing (wrong tenant ID in the provisioning URL), public IP not configured as trusted IP, and bulk sign-in deadline expired after 72 or 168 hours.
Configure SIP Gateway · Bulk sign in error messages table · Checked 2026-09-30
6
SIP Gateway bulk sign-in signs in shared accounts in batches of up to 100 devices, with a limit of 3 concurrent batches per region.
Configure SIP Gateway · Bulk sign in, first paragraph · Checked 2026-09-30
7
Bulk sign-in needs MicrosoftTeams PowerShell 5.6.0 or later and must be run by an account holding Global Administrator, Privileged Authentication Administrator or Authentication Administrator, with Microsoft recommending the least-privileged role.
Configure SIP Gateway · Bulk sign in prerequisites, items 3 and 8 · Checked 2026-09-30
8
For bulk sign-in the device account must not have User must change password at next login or User's password can't be changed selected, and the minimum password age must be 0, otherwise password writeback fails.
Configure SIP Gateway · Bulk sign in error messages table, Password writeback row · Checked 2026-09-30
9
Bulk sign-in resets the shared device account's password at runtime to an unknown value and uses the new credential to fetch a token from Entra ID.
New-CsSdgBulkSignInRequest (MicrosoftTeams) · Description · Checked 2026-09-30
10
Bulk sign-in for common area phone accounts is switched on or off tenant-wide with Set-CsTeamsSipDevicesConfiguration -BulkSignIn set to Enabled or Disabled, which requires a role such as Teams Administrator or Teams Communications Administrator.
Set-CsTeamsSipDevicesConfiguration (MicrosoftTeams) · Description, Examples 1-2 and -BulkSignIn parameter · Checked 2026-09-30
11
For bulk sign-in the tenant ID must be added to the device provisioning URL; for Cisco IP phones in North America the form is http://noam.ipp.sdg.teams.microsoft.com/tenantid/<tenant-ID>/$PSN.xml, and for other IP phones the same URL without the suffix.
Configure SIP Gateway · Bulk sign in prerequisites, item 2 · Checked 2026-09-30
12
For bulk sign-in, the site public IP addresses or ranges must be added to the tenant's trusted IPs in the Teams admin center at least 24 hours before running the bulk sign-in cmdlets.
Configure SIP Gateway · Bulk sign in prerequisites, item 1 · Checked 2026-09-30
13
Bulk sign-in applies to new devices within 72 hours of onboarding to SIP Gateway, or to signed-out devices within 7 days (168 hours) of sign-out, in which case the tenant ID need not be added to the provisioning URL; Microsoft advises running it at least 1 hour and at most 70 hours after provisioning.
Configure SIP Gateway · Bulk sign in, scenarios list and prerequisites note after item 9 · Checked 2026-09-30
14
Starting 1 January 2026 Microsoft requires four additional SIP Gateway service IPs per region to be excluded: 70.152.106.56, 70.152.136.2, 70.152.120.55 and 70.152.38.25 (North America); 70.152.180.28, 70.152.200.28, 70.152.180.29 and 70.152.192.2 (EMEA); 70.152.50.14, 70.152.1.9, 70.152.49.18 and 70.152.1.10 (APAC).
Configure SIP Gateway · Configure conditional access, Starting 1st January 2026 list · Checked 2026-09-30
15
Tenants whose Conditional Access location exclusions for bulk sign-in were set up before 1 January 2026 and list only the original six service IPs are likely to see bulk sign-in blocked by Conditional Access until the twelve additional IPs are added.inferred
Configure SIP Gateway · Configure conditional access, Note and Starting 1st January 2026 list · Checked 2026-09-30
16
Defining and assigning the custom security attributes requires the Attribute Definition Administrator and Attribute Assignment Administrator roles; by default Global Administrator and other admin roles cannot read, define or assign custom security attributes.
Set up dynamic filters for SIP Gateway - Microsoft Teams · Prerequisites · Checked 2026-09-30
17
Because SIP devices are not Intune-managed, stricter Conditional Access checks apply to them; an organization using Conditional Access for devices on the corporate network should exclude its site public IP addresses and the SIP Gateway API app (0ab9de21-b802-4d77-b279-1ad41ca233b4).
Configure SIP Gateway · Configure conditional access · Checked 2026-09-30
18
The Conditional Access policy is then edited so that Target resources includes All cloud apps and the Exclude tab uses Edit filter with the custom attribute, operator Contains, and the value assigned to the SIP Gateway apps.
Set up dynamic filters for SIP Gateway - Microsoft Teams · Step 5 Exclude this attribute from your Conditional Access Policy · Checked 2026-09-30
19
The SIP Gateway resources cannot be excluded from Conditional Access policies directly, and excluding the apps alone is insufficient because they depend on the Teams app for scopes; Microsoft instead documents a dynamic app filter based on a custom security attribute.
Set up dynamic filters for SIP Gateway - Microsoft Teams · Introduction, second paragraph · Checked 2026-09-30
20
Tenants using bulk sign-in, or whose SIP devices were signed in before July 2023, need location-based Conditional Access exclusions for the regional SIP Gateway service IPs: 52.170.38.140 and 40.112.144.212 (North America), 40.112.71.149 and 40.113.112.67 (EMEA), 20.92.120.71 and 13.73.115.90 (APAC).
Configure SIP Gateway · Configure conditional access, Note · Checked 2026-09-30
21
The dynamic filter procedure requires service principals in the tenant for SIP Gateway API (0ab9de21-b802-4d77-b279-1ad41ca233b4) and SIP Gateway UserApp (582b2e88-6cca-4418-83d2-2451801e1d26), plus Teams SIP Gateway (61c8fd69-c13e-4ee6-aaa6-24ff71c09bca) when bulk sign-in is used, each assigned the custom security attribute.
Set up dynamic filters for SIP Gateway - Microsoft Teams · Step 3 Add SIP Gateway Service Principals and Step 4 Assign custom security attribute · Checked 2026-09-30
22
SIP Gateway device users can only call users who have phone numbers.
Plan SIP Gateway · Benefits of SIP Gateway, Make calls · Checked 2026-09-30
23
Microsoft recommends creating common area phone accounts as standard user accounts with a manually set password, unchecking automatic password creation and change-at-first-sign-in, and assigning the Teams Shared Devices license, which includes Phone System features.
Set up the common area phones for Microsoft Teams · Step 2 Create a new common area phone resource account and assign licenses · Checked 2026-09-30
24
Microsoft notes that common area phones can be impacted by conditional access rules and other identity configurations such as user-interactive MFA.
Set up the common area phones for Microsoft Teams · Step 2, Using PowerShell, Note · Checked 2026-09-30
25
For Cisco IP Phone 7800 Series phones, Cisco requires a per-device enterprise-to-MPP migration license (SKU L-CP-E2M-78XX-CNV=) for conversions not destined for Webex Calling, and the phone must run enterprise firmware 14.2.1SR1 or later for the procedures to work.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Prerequisites, conversion license and hardware and software requirements · Checked 2026-09-30
26
For Cisco IP Phone 8800 Series phones, Cisco requires a per-device enterprise-to-MPP migration license (SKU L-CP-E2M-88XX-CNV=) for conversions not destined for Webex Calling, and the phone must run enterprise firmware 14.2.1SR1 or later for the procedures to work.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Prerequisites, conversion license and hardware and software requirements · Checked 2026-09-30
27
For Cisco IP Phone 7800 Series phones, Cisco offers a cloud upgrader for non-Webex call control at upgrade.cisco.com/e2m_converter_3rd, or a manual method that loads transition firmware and the conversion license through Unified CM TFTP and sets the Transition Authorization Rule in the phone's web interface.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Conversion methods, Cloud Upgrader and UCM-based manual migration · Checked 2026-09-30
28
For Cisco IP Phone 8800 Series phones, Cisco offers a cloud upgrader for non-Webex call control at upgrade.cisco.com/e2m_converter_3rd, or a manual method that loads transition firmware and the conversion license through Unified CM TFTP and sets the Transition Authorization Rule in the phone's web interface.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Conversion methods, Cloud Upgrader and UCM-based manual migration · Checked 2026-09-30
29
Cisco lists as eligible for enterprise-to-MPP conversion the 7800-series models 7811, 7821 (hardware V03 to V24), 7841 (V04 or later), 7861 (V03 or later) and 7832.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Eligible phone models and ineligible models sections · Checked 2026-09-30
30
Cisco lists as eligible for enterprise-to-MPP conversion the 8800-series models 8811, 8841, 8851, 8861, 8832, 8845 and 8865, and states that the 8821 and 8831 cannot migrate to MPP.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Eligible phone models and ineligible models sections · Checked 2026-09-30
31
Compatible Cisco SIP IP phones support dynamic emergency location discovery with SIP Gateway over LLDP only.
Plan SIP Gateway · Compatible devices, note after footnotes · Checked 2026-09-30
32
For Cisco 6821, 6841, 6851, 6861, 6871, 7811, 7821, 7841, 7861, 8811, 8841, 8845, 8851, 8861 and 8865 Microsoft lists minimum firmware 11.1.1MPP and approved firmware 12-0-7MPP; the 8832 has minimum 11.3.5MPP and approved 12-0-7MPP.
Plan SIP Gateway · Compatible devices table, Cisco rows · Checked 2026-09-30
33
Microsoft lists the Cisco 8875, 9841, 9851, 9861 and 9871 as compatible with minimum and approved firmware PhoneOS 3.3.1.
Plan SIP Gateway · Compatible devices table, Cisco rows 8875 and 9841-9871 · Checked 2026-09-30
34
For Cisco devices, /$PSN.xml must be appended to the SIP Gateway provisioning server URL.
Configure SIP Gateway · Set the SIP Gateway provisioning server URL, Note · Checked 2026-09-30
35
For Cisco IP Phone 7800 Series phones, Cisco states phones migrated with firmware later than 11.3.3 can revert to enterprise firmware without extra licensing via factory reset and UCM upgrade rules, while phones migrated with 11.2.3 need an MPP-to-enterprise license to revert.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Reverting to enterprise firmware · Checked 2026-09-30
36
For Cisco IP Phone 8800 Series phones, Cisco states phones migrated with firmware later than 11.3.3 can revert to enterprise firmware without extra licensing via factory reset and UCM upgrade rules, while phones migrated with 11.2.3 need an MPP-to-enterprise license to revert.
Cisco IP Phone 7800 and 8800 Series firmware conversion guide (Enterprise to Multiplatform) · Reverting to enterprise firmware · Checked 2026-09-30
37
Microsoft lists as SIP Gateway compatible: Skype for Business IP phones with standard SIP firmware, Cisco IP phones with multiplatform SIP firmware, and SIP devices from vendors such as Poly, Yealink and AudioCodes.
Plan SIP Gateway · Plan SIP Gateway, introductory paragraph · Checked 2026-09-30
38
SIP phones in scope are not OAuth-capable, so SIP Gateway authenticates the user through a web authentication app using the OAuth 2.0 device authorization grant flow, and the location shown in that app is the SIP Gateway datacenter the device is connected to.
Configure SIP Gateway · User pairing and sign-in, first Note · Checked 2026-09-30
39
When delivering the provisioning URL by DHCP, Microsoft specifies option 160 for Cisco, Poly and AudioCodes phones and option 66 for Yealink and Alcatel-Lucent Enterprise phones; option 42 can supply NTP and option 2 the UTC offset.
Configure SIP Gateway · Set the SIP Gateway provisioning server URL, Using DHCP paragraph and Note · Checked 2026-09-30
40
SIP Gateway supports dynamic emergency calling for devices that share network attributes (local IP and subnet length, or chassis ID and port) provisioned in the Teams admin center; otherwise it falls back to registered addresses, which are not supported for Direct Routing.
Configure SIP Gateway · Emergency calling · Checked 2026-09-30
41
Before configuring SIP Gateway, each SIP device used with it must be reset to its factory default settings using the manufacturer's instructions.
Configure SIP Gateway · Before you can configure SIP Gateway, Reset SIP devices to factory default settings · Checked 2026-09-30
42
SIP Gateway feature codes include *30* to set Teams Do Not Disturb, *31* to reset it, *55* for one-time verification code validation of devices provisioned through the Teams admin center, and *99* to check voicemail.
Plan SIP Gateway · Requirements to use SIP Gateway, note SIP Gateway Feature Codes · Checked 2026-09-30
43
Microsoft lists SIP Gateway device capabilities as PSTN and Teams calling, hold and resume, mute, multiple simultaneous calls and conferencing two calls, voicemail with message waiting indicator, DTMF, dial-in to Teams meetings, and blind and consultative transfer.
Plan SIP Gateway · Benefits of SIP Gateway, bullet list · Checked 2026-09-30
44
SIP Gateway requires the firewall to be open to Microsoft 365 and Teams traffic per the Office 365 URLs and IP address ranges, with rules needed for outbound traffic only, and device http/s traffic must bypass any corporate proxy.
Configure SIP Gateway · Before you can configure SIP Gateway, firewall and proxy bullets · Checked 2026-09-30
45
SIP devices appear in the Teams admin center inventory under Teams devices > SIP devices only after their users sign in at least once, and a device can be restarted from there.
Configure SIP Gateway · View and monitor SIP devices; Restart a SIP device · Checked 2026-09-30
46
SIP Gateway supports only IPv4, although the Teams service and clients support both IPv4 and IPv6.
Configure SIP Gateway · Microsoft Teams and IPv6 · Checked 2026-09-30
47
A SIP device's UI language is set by appending lang_xx to the provisioning URL (for Cisco before /$PSN.xml); supported codes are en, es, ja, de, fr and pt, and English is used when the parameter is absent or unsupported.
Configure SIP Gateway · Set a SIP device's UI language and Supported languages · Checked 2026-09-30
48
Only local sign-in is supported for users' personal SIP Gateway devices.
Configure SIP Gateway · How to sign in and sign out, first sentence · Checked 2026-09-30
49
Users who work remotely must configure the provisioning server URL manually by browsing to the device's IP address, signing in to its web utility and entering the URL under Settings or Advanced settings.
Configure SIP Gateway · Set the SIP Gateway provisioning server URL, Manually · Checked 2026-09-30
50
Microsoft states SIP Gateway is not yet available for DoD.
Plan SIP Gateway · Requirements to use SIP Gateway, note · Checked 2026-09-30
51
Successfully provisioned SIP phones display the Teams logo and a soft button for sign-in; during onboarding SIP Gateway pushes the default configuration and authentication user interface to the device, which must be on the minimum supported firmware.
Configure SIP Gateway · Set the SIP Gateway provisioning server URL, Using DHCP, final two paragraphs · Checked 2026-09-30
52
Calling policy propagation for SIP Gateway enablement may take up to 24 hours.
Configure SIP Gateway · Enable SIP Gateway for the users in your organization, note · Checked 2026-09-30
53
With PowerShell, SIP Gateway is enabled by setting -AllowSIPDevicesCalling to True on a calling policy with Set-CsTeamsCallingPolicy; the default is False, so users cannot use SIP devices until enabled.
Configure SIP Gateway · Enable SIP Gateway for the users in your organization, By using PowerShell · Checked 2026-09-30
54
User details and policies are fetched to a SIP device at sign-in, and later policy changes for signed-in users sync to the device within one hour.
Configure SIP Gateway · Sync policy changes to SIP devices to enforce policies · Checked 2026-09-30
55
In the Teams admin center, SIP Gateway is enabled per calling policy under Voice > Calling policies by turning on SIP devices can be used for calls and saving the policy assigned to the users.
Configure SIP Gateway · Enable SIP Gateway for the users in your organization, By using Teams admin center · Checked 2026-09-30
56
Microsoft's compatible-devices table notes that a Poly device will auto reboot and install the selected firmware, and links the Poly Lens provisioning guide.
Plan SIP Gateway · Compatible devices table, Poly header row Remarks · Checked 2026-09-30
57
Poly Lens offers a Teams SIP Gateway bulk sign-in aid for Poly VVX, Trio, CCX and Edge E devices that additionally requires enabling the Bulk Onboarding toggle in the Lens policy and configuring the tenant GUID.
Teams SIP Gateway Bulk Sign-In (Poly Lens) · Teams SIP Gateway Bulk Sign-In, prerequisites and supported devices · Checked 2026-09-30
58
For Poly devices, LLDP must be turned on at switch level for subnet-length-based dynamic location discovery with SIP Gateway.
Plan SIP Gateway · Compatible devices, note after footnotes · Checked 2026-09-30
59
Microsoft lists Poly Trio 8500 and 8800 with minimum 5.9.5.3182 and approved 7.2.4.0185, Poly Edge E100 to E550 with minimum 8.1.0.12774 and approved 8.5.1.0508, and Poly Edge V models with minimum 8.5.1.0565.
Plan SIP Gateway · Compatible devices table, Poly Trio and Edge rows · Checked 2026-09-30
60
Microsoft lists Poly VVX models with minimum firmware 5.9.5; approved firmware is 5.9.7.3480 for VVX300, 310, 400, 410, 500 and 600, and 6.4.x builds for the other VVX models such as VVX250, 350 and 450 (6.4.6.2656).
Plan SIP Gateway · Compatible devices table, Poly VVX rows · Checked 2026-09-30
61
SIP Gateway requires UDP ports 49152 to 53247 and TCP port 5061 open for IP ranges 52.112.0.0/14 and 52.122.0.0/15.
Configure SIP Gateway · Before you can configure SIP Gateway, Open the UDP port and Open the TCP port · Checked 2026-09-30
62
The SIP Gateway provisioning server URLs are http://emea.ipp.sdg.teams.microsoft.com for EMEA, http://noam.ipp.sdg.teams.microsoft.com for the Americas and http://apac.ipp.sdg.teams.microsoft.com for APAC.
Configure SIP Gateway · Set the SIP Gateway provisioning server URL, Using DHCP · Checked 2026-09-30
63
A SIP device can be signed out by the user with the Sign-Out key or by an admin from its Details pane in Teams devices > SIP devices, but removing a SIP device from the tenant is currently unavailable in the Teams admin center.
Configure SIP Gateway · Sign-out; Restart a SIP device, Note · Checked 2026-09-30
64
Microsoft marks the Poly VVX300, VVX310, VVX400, VVX410, VVX500 and VVX600 and the Cisco ATA191 and ATA192 as supporting only static location with SIP Gateway.
Plan SIP Gateway · Compatible devices table, footnote 3 markers · Checked 2026-09-30
65
Microsoft's example for checking bulk sign-in status calls New-CsSdgBulkSignInRequest again before Get-CsSdgBulkSignInRequestStatus, so running it verbatim likely submits a second batch; saving the BatchId from the original request and querying only the status cmdlet avoids this.inferred
New-CsSdgBulkSignInRequest (MicrosoftTeams) · Example 2 · Checked 2026-09-30
66
The Teams admin center can enroll SIP devices as common area phones one at a time or by CSV upload under Teams devices > SIP devices > Actions > Provision devices, by adding MAC address and location and generating a one-time verification code; the device must already be onboarded and the method is unavailable in GCC.
Configure SIP Gateway · Provision and enroll SIP devices as common area phones, Note and steps 1-3 · Checked 2026-09-30
67
After enrollment, dialing *55* followed by the verification code on the device (for example *55*123456) enrolls it; selecting Signed out under Waiting for sign in then shows an authentication URL and pairing code, which are completed in a browser with the account's credentials.
Configure SIP Gateway · Provision and enroll SIP devices as common area phones, steps 4-8 · Checked 2026-09-30
68
Because Microsoft documents admin-center enrollment only for common area phones and supports only local sign-in for users' personal devices, an admin-driven remote pairing path is likely available only for shared common area accounts, not for an individual user's phone.inferred
Configure SIP Gateway · Provision and enroll SIP devices as common area phones; How to sign in and sign out · Checked 2026-09-30
69
External trusted IP addresses are added in the Teams admin center under Locations > Network topology > Trusted IPs > Add, or with New-CsTenantTrustedIPAddress.
Manage your network topology for cloud voice features in Microsoft Teams · Manage external trusted IP addresses, Add a trusted IP address; Define external subnets · Checked 2026-09-30
70
For user pairing, the user presses Sign-in on the phone to display an authentication URL and a time-sensitive pairing code, signs in with corporate credentials in a desktop or mobile browser and enters the code; if the code expires the user presses Back and starts again, and on success the phone shows the phone number and username if supported.
Configure SIP Gateway · User pairing and sign-in, steps 1-3 · Checked 2026-09-30
71
Common area phones can be signed in without touching the device through the SIP remote login portal (aka.ms/sipremotelogin) by authenticating as the common area phone account, choosing the NOAM, EMEA or APAC region and entering the MAC address as XX-XX-XX-XX-XX-XX, provided the bulk sign-in prerequisites are in place.
Configure SIP Gateway · Zero Touch Common Area Phone sign in · Checked 2026-09-30
72
To use SIP Gateway, Teams users must have a phone number with PSTN calling enabled, plus Microsoft Teams, Skype for Business Online (Plan 2), Microsoft Phone System and PSTN connectivity; SIP Gateway is not yet available for DoD.
Plan SIP Gateway · Plan SIP Gateway, section 'Requirements to use SIP Gateway' and subsection 'Hardware, software, and licenses' · Checked 2026-09-24
73
To use PSTN telephony with Teams Phone, a user account must be licensed with the Teams Phone application and also be equipped with a PSTN solution from a PSTN service provider.
PSTN connectivity options · PSTN connectivity options, section 'What is the Public Switched Telephone Network (PSTN)?' · Checked 2026-09-24
74
SIP Gateway supports compatible SIP devices including Cisco IP phones, but Cisco devices running enterprise firmware must first be converted to multiplatform (MPP) firmware.
Plan SIP Gateway · Plan SIP Gateway, introduction and section 'Compatible devices', Cisco row remark · Checked 2026-09-24
75
The Microsoft Teams Shared Device license (for common area phones) and the Microsoft Teams Rooms Pro license both include the Microsoft 365 Phone System application, and Shared Device licenses are supported only for telephone devices.
Teams Phone licensing · Teams Phone licensing, sections 'Licensing Teams Phone - for shared devices' and 'Considerations' · Checked 2026-09-24
76
Direct Routing requires specific emergency call routing policies, whereas with the other PSTN options the carrier handles much of the emergency call routing configuration.
Plan and manage emergency calling · Plan and manage emergency calling, section 'Emergency call routing' · Checked 2026-09-24
77
To assign an emergency location to a network identifier for dynamic emergency calling, the emergency address must be validated and carry a geo code; addresses created with the Teams admin center map search get both automatically.
Plan and manage emergency calling · Plan and manage emergency calling, sections 'Emergency address validation' and 'Emergency address geo codes', Important block · Checked 2026-09-24
78
SIP devices on SIP Gateway can be call queue agents, but SIP Gateway does not publish presence for them, so presence-based routing is not supported.
Plan SIP Gateway · Plan SIP Gateway, section 'Benefits of SIP Gateway', bullet 'Call Queues and voice apps support' · Checked 2026-09-24
79
SIP Gateway automatically offboards stale devices: paired (signed-in) devices after 30 days without a connection and unpaired (signed-out) devices after 14 days, and an offboarded device can be onboarded again after a factory reset.
Plan SIP Gateway · Plan SIP Gateway, section 'Benefits of SIP Gateway', bullet 'Off board stale devices' · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, September 30). Setting up SIP Gateway for Cisco and Poly phones on Teams. WarmTransfer. https://warmtransfer.net/guides/teams-sip-gateway-setup

BibTeX

@misc{warmtransfer-teams-sip-gateway-setup,
  title  = {Setting up SIP Gateway for Cisco and Poly phones on Teams},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/teams-sip-gateway-setup},
  note   = {Verified 2026-09-30}
}

Setting up SIP Gateway for Cisco and Poly phones on Teams

Before you start

What changes by situation

Step 1 Confirm SIP Gateway is available for the organization

Do

Verify

Step 2 Qualify the phones and their firmware

Do

Verify

Do

Verify

Do

Verify

Step 3 Open the network path to SIP Gateway

Do

Verify

Rollback

Step 4 Enable the SIP devices calling policy

Do

Verify

Rollback

Step 5 Handle Conditional Access for SIP Gateway

Do

Verify

Rollback

Do

Verify

Step 6 Prepare the accounts that will sign in

Do

Verify

Rollback

Do

Verify

Rollback

Do

Verify

Rollback

Step 7 Factory-reset the phones and point them at the provisioning server

Do

Verify

Rollback

Do

Verify

Rollback

Step 8 Sign the phones in

Do

Verify

Rollback

Do

Verify

Rollback

Do

Verify

Rollback

Step 9 Set up emergency location for the phones

Do

Verify

Rollback

Step 10 Test calling and phone features

Do

Verify

Rollback

Step 11 Hand over for operation

Do

Verify

Rollback

Applicability

What remains uncertain

See also

Configures feature of

Referenced by

What you need from this guide

Sources

Documents

Cite this page