WarmTransfer
Configuration · guide

Setting up an AudioCodes SBC for Teams Direct Routing

AudioCodes Mediant SBC

Verified 2026-09-30 · 98 sources · tier 2

For Voice engineers configuring an AudioCodes Mediant SBC for Microsoft Teams Direct Routing.

Microsoft Teams Direct Routing connects a customer-managed session border controller to Microsoft Teams Phone to provide PSTN connectivity 65 66. This guide walks through configuring an AudioCodes Mediant SBC to pair with Microsoft Teams Phone Direct Routing and route calls between Teams users and your carrier SIP trunk 66 1.

Before you start

Direct Routing requires a Microsoft-certified SBC, PSTN trunks to it, users homed online, a public IP address, an SBC FQDN in a verified tenant domain with public DNS, and a publicly trusted TLS certificate 67. Microsoft lists the AudioCodes Mediant 500, 500 Li, 800, 1000B, 2600, 3100, 4000, 7000, and 9000, as well as the Virtual Edition (VE) and Mediant Cloud Edition (CE), as certified for both non-media-bypass and media bypass deployments 1 68. Certified firmware for most models is listed as supported on 7.40A.600 1 69, and Microsoft supports higher firmware versions within the same major.minor release line 42 70. Microsoft supports Teams Phone Direct Routing only on certified SBC models 71.

The SBC domain cannot be an *.onmicrosoft.com domain 43. If using a subdomain (such as sbc.service.contoso.com), that subdomain must also be registered in the tenant 54. Additionally, the domain must use the Managed authentication type and have at least one user assigned an E3 or E5 license, or pairing will fail 36. Mapping multiple IP addresses to a single SBC FQDN is not supported 47. The tenant cannot be in Islands coexistence mode 72. If problems arise, Microsoft requires customers to engage the SBC vendor first and produce an investigation report prior to escalating 73.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

How will you build the base SBC configuration?
Will Teams clients exchange media directly with the SBC?

Two questions. One permanent page you can send to your manager.

Step 1 Confirm prerequisites

Do

Ensure the Mediant SBC model and firmware appear on the certified vendor list 1 71. Verify that the SBC public FQDN is mapped to a single public IP address in public DNS 47 and that the domain is verified in the tenant 43 36. Ensure the tenant is not operating in Islands mode 72.

Verify

Suggested check: resolve the SBC FQDN via public DNS and verify that it returns exactly one public IP address matching the external SBC interface.

Rollback

Suggested rollback: delete or update the public DNS record if incorrect.

Step 2 Open firewall ports for signaling and media

Media bypass off: all media goes through Microsoft Media Processors

Do

Allow outbound SIP/TLS from the SBC to Microsoft on port 5061, and allow inbound SIP/TLS from Microsoft source ports 1024–65535 to the listening TLS port configured on the SBC 52 74. Open these rules across all IP addresses in the 52.112.0.0/14 and 52.120.0.0/14 subnets 44. Allow UDP/SRTP media traffic between the SBC and Microsoft Media Processors on ports 3478–3481 and 49152–53247 in both directions, sizing the SBC media port range to allow at least 2 ports per concurrent call 75 76.

Verify

Suggested check: test network connectivity from the SBC to the signaling endpoints, and inspect firewall logs to confirm traffic flows to and from the specified subnets.

Rollback

Suggested rollback: delete the firewall rules created for SIP signaling and Media Processor ranges.

Media bypass on: clients send media straight to the SBC or through Transport Relays

Do

Configure the firewall rules required for signaling and Media Processors, as Media Processors remain in the path for web clients and voice applications like call queues and auto attendants 27 52 44 75. For direct media bypass, allow UDP/SRTP traffic from Teams client source ports 50000–50019 to the SBC's media ports on its public IP address, and from the SBC back to client ports 50000–50019 22. Internal clients must be able to reach this SBC public IP address 30. Allow inbound UDP from relay ports 50000–59999 to the SBC, and allow outbound UDP from the SBC to relay ports 50000–59999 and ports 3478–3481 31. Media bypass is not supported when the SBC uses IPv6 SIP or media or with the IPv6 Teams client 25.

Verify

Suggested check: verify connectivity to the SBC public IP address on the designated media ports from both internal workstation subnets and external networks.

Rollback

Suggested rollback: delete the firewall rules created for direct client traffic, Transport Relays, and Media Processors.

Step 3 Install public certificates in a TLS Context

Do

Open the Mediant Web interface and create a new TLS Context for Microsoft Teams, avoiding the default context (index 0) which contains a self-signed certificate 16. Generate a Certificate Signing Request (CSR) directly on the SBC, which generates the key pair and formats the DN and Subject Alternative Names 3 32. Ensure the SBC FQDN is in the Common Name or SAN, the certificate includes the Server Authentication EKU, and it is signed by a certificate authority participating in the Microsoft Trusted Root Program 33. Wildcard certificates complying with RFC 2818 are supported 34. Import the signed certificate into the TLS Context and confirm it matches the private key 3. Under Trusted Root Certificates, import the required Microsoft trusted root certificates in PEM format 18 34. Ensure the TLS Version includes TLS 1.2, and configure the cipher list using OpenSSL format to include at least one required cipher suite: ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-SHA384, or ECDHE-RSA-AES128-SHA256 17 56 77.

Verify

Suggested check: view the certificate properties in the SBC TLS Context table to ensure the certificate status is valid, matches the private key, displays the correct FQDN, and shows the imported root CAs in the Trusted Root CA store.

Rollback

Suggested rollback: delete the created TLS Context or clear the imported certificates and re-point dependent services to another TLS Context.

Step 4 Build the base SBC configuration

SBC Configuration Wizard on a new or disposable SBC

Do

Run the SBC Configuration Wizard in the Mediant Web interface to initialize device configuration 20, selecting the Microsoft Teams Direct Routing template alongside your carrier profile. Note that applying the wizard template overwrites configured parameters and resets any parameters not covered by the template to factory defaults 19. The wizard cannot be used if the SBC operates in High-Availability mode, uses IPv6 interfaces, or uses OVOC WebSocket tunneling 21.

Verify

Suggested check: review the device configuration tables to confirm that Teams and carrier entities have been generated, and verify that the TLS Context created in Step 3 remains intact.

Rollback

Suggested rollback: restore the configuration backup taken prior to launching the wizard to revert all modified parameters.

Manual configuration in the Web interface

Do

Link each Server-type IP Group to its Proxy Set and IP Profile 6.

Verify

Suggested check: confirm the backup file is safely stored on an external management system.

Rollback

Suggested rollback: restore the configuration backup if you decide to abandon manual configuration.

Step 5 Create the Teams SIP Interface

Do

Navigate to the SIP Interfaces table and create an interface of application type SBC mapped to the public-facing IP network interface 14 78. Set the transport type to TLS with port 5061 (or your selected custom port) and bind it to the Teams TLS Context 14. The port selected here must match the port contacted by Microsoft and defined in the tenant gateway configuration 52 49 74.

Verify

Suggested check: view the SIP Interface entry to verify that the application type is SBC, the transport is TLS, the assigned port matches your plan, and the context references the Teams TLS Context.

Rollback

Suggested rollback: remove the Teams SIP Interface entry from the SIP Interfaces table.

Step 6 Create the Teams Proxy Set

Do

Create a new Proxy Set and add the three Microsoft Direct Routing regional FQDNs in order of priority: sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com, and sip3.pstnhub.microsoft.com, using TLS on port 5061 79 80. Assign the Teams SIP Interface and Teams TLS Context to the Proxy Set 11 81. Enable Proxy Keep-Alive using SIP OPTIONS, enable Proxy Hot Swap, and set Redundancy Mode to Homing so the SBC returns to the primary proxy when available 11 82. Configure the Proxy Keep-Alive Time to 60 seconds or higher, adhering to Microsoft's transaction rate limit 48 83.

Verify

Navigate to Monitor > VoIP Status > Proxy Sets Status and verify that the status of the proxies is not showing NOT RESOLVED 12.

Rollback

Suggested rollback: delete the Teams Proxy Set after detaching any dependent IP Groups.

Step 7 Create the Teams IP Group

Do

Create an IP Group of type Server representing the Microsoft Teams signaling entity, linked to the Teams Proxy Set, Teams IP Profile, and an assigned Media Realm 6 84 85 86. Enable Teams Direct Routing Mode so that the Mediant SBC appends the X-MS-SBC header to outgoing INVITE and OPTIONS messages 15. Configure Classify By Proxy Set, Always Use Src Address, and Proxy Keep-Alive using IP Group Settings as needed 5 87 88. Set the Local Host Name parameter to the SBC's paired FQDN so the SBC populates this host in Via and Contact headers 7. If header modifications are necessary, configure and attach Message Manipulation Sets 9 89.

Verify

Suggested check: inspect the IP Group configuration table to verify that Teams Direct Routing Mode is active and that the Local Host Name matches the public SBC FQDN.

Rollback

Suggested rollback: remove the IP Group entry or disable Teams Direct Routing Mode.

Step 8 Configure IP Profile and Coders Group

Media bypass off: all media goes through Microsoft Media Processors

Do

In the IP Profile assigned to Teams, set SBC Media Security Mode to Secured to enforce SRTP and strip unencrypted RTP media lines 8 45. In the Coders Groups table, build a group containing the codecs supported by Direct Routing (SILK, G.711, G.722, G.729, and AMR-WB) in your prioritized order 90 2. Configure extension coders if transcoding is required to bridge carrier-supported codecs 2.

Verify

Suggested check: initiate a test call and verify in a SIP/SDP trace that media is offered as RTP/SAVP using the prioritized codec list.

Rollback

Suggested rollback: restore previous SBC Media Security Mode and Coders Group assignments in the IP Profile.

Media bypass on: clients send media straight to the SBC or through Transport Relays

Do

In the IP Profile assigned to Teams, set SBC Media Security Mode to Secured 8. Set ICE Mode to Lite to support media bypass 4 24 91. Build a Coders Group excluding AMR-WB, as AMR-WB is supported only when media bypass is disabled 90. Plan SBC transcoding resources because Transport Relays do not transcode media between the Teams client and the SBC 50 2.

Verify

Suggested check: inspect a SIP trace of an outgoing offer to Teams to confirm the SDP includes a=ice-lite attributes and omits AMR-WB.

Rollback

Suggested rollback: revert the IP Profile ICE Mode parameter to its previous setting and re-add AMR-WB to the Coders Group if needed.

Step 9 Create IP-to-IP Routing rules

Do

Configure an IP-to-IP Routing rule at the top of the routing table with Source IP Group set to Teams, Request Type set to OPTIONS, and Destination Type set to Internal to terminate and answer inbound keep-alive OPTIONS locally 10 13. Add bi-directional routing rules between the Teams IP Group and the carrier IP Group 13. Order the routing table such that strict rules appear above broad rules, as the SBC evaluates the table from top to bottom and routes on the first matching rule, rejecting unmatched calls 92 93 94.

Verify

Suggested check: capture a trace of an inbound OPTIONS request from Teams and verify that the SBC immediately responds locally.

Rollback

Suggested rollback: delete or disable the created IP-to-IP Routing rules.

Step 10 Pair the SBC with the Microsoft Teams tenant

Media bypass off: all media goes through Microsoft Media Processors

Do

Run New-CsOnlinePSTNGateway specifying the SBC FQDN as Identity, the listening TLS port as SipSignalingPort, MaxConcurrentSessions, and set Enabled to $true 49 (or navigate to Teams admin center > Voice > Direct Routing > SBCs > Add, noting that GCC High and DoD require PowerShell 55). Retain SendSIPOptions as $true so the SBC is monitored 51.

Verify

Run Get-CsOnlinePSTNGateway -Identity <SBC FQDN> and verify that Enabled is True 59.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <SBC FQDN> -Enabled $false to take the gateway out of service 37, or remove it using Remove-CsOnlinePSTNGateway -Identity <SBC FQDN> 49.

Media bypass on: clients send media straight to the SBC or through Transport Relays

Do

Run New-CsOnlinePSTNGateway with the SBC FQDN, SipSignalingPort, MaxConcurrentSessions, and Enabled $true 49 55. Enable media bypass on the gateway using Set-CsOnlinePSTNGateway -Identity <SBC FQDN> -MediaBypass $true 28. If conducting a phased pilot, configure a separate trunk with a unique FQDN on a different TLS port using the same media ports 29.

Verify

Run Get-CsOnlinePSTNGateway -Identity <SBC FQDN> and verify that Enabled is True and MediaBypass is True 59 28.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <SBC FQDN> -MediaBypass $false to disable media bypass 28, or set -Enabled $false to disable the gateway 37.

Step 11 Validate the SIP OPTIONS exchange

Do

Monitor the SIP traffic on the Mediant SBC to confirm that outgoing OPTIONS sent to Microsoft receive a 200 OK, and that incoming OPTIONS from Microsoft are answered with a 200 OK 58 95. Direct Routing transmits its OPTIONS pings to the FQDN specified in the Contact header of the SBC's OPTIONS message 58 95.

Verify

Navigate to Monitor > VoIP Status > Proxy Sets Status in the Mediant Web interface and verify that the status of the Teams Proxy Set displays ONLINE 12.

Rollback

Suggested rollback: if the status remains OFFLINE or NOT RESOLVED, re-verify DNS resolution, Step 3 TLS Context and root certificates, Step 6 Proxy Set settings, and Step 7 Local Host Name settings.

Step 12 Enable users and configure voice routing

Do

Assign users a Teams Phone license, ensure their accounts are homed online, assign an enterprise voice phone number, and assign Teams Only mode via TeamsUpgradePolicy 39 40. Assign numbers using Set-CsPhoneNumberAssignment -Identity <user> -PhoneNumber <number> -PhoneNumberType DirectRouting, preferably in E.164 format 38. Build the call routing chain by adding a PSTN usage with Set-CsOnlinePstnUsage, creating a voice route with New-CsOnlineVoiceRoute referencing the usage and SBC gateway, creating an online voice routing policy with New-CsOnlineVoiceRoutingPolicy, and granting the policy to the user with Grant-CsOnlineVoiceRoutingPolicy 61 60. Ensure PSTN usages are listed in priority order, as the first matching usage handles the call and halts further evaluation 64. Use a custom voice routing policy rather than editing the global policy to prevent unintended routing of Calling Plan or Operator Connect users 62.

Verify

Run Get-CsOnlineUser -Identity <user> | Select-Object OnlineVoiceRoutingPolicy and verify that the output reflects the assigned custom voice routing policy 60.

Rollback

Suggested rollback: revoke the assigned voice routing policy using Grant-CsOnlineVoiceRoutingPolicy -Identity <user> -PolicyName $null and remove the assigned phone number using Remove-CsPhoneNumberAssignment.

Step 13 Place test calls

Media bypass off: all media goes through Microsoft Media Processors

Do

Perform inbound and outbound PSTN test calls across the SBC 57. Verify that an unallocated or unrouted number dialed by a Teams Phone user lacking a Calling Plan is rejected and dropped 63. Note that Microsoft Direct Routing does not support mid-call media IP address retargeting 46. Test failover between the regional SIP proxy endpoints 57.

Verify

Suggested check: verify that audio flows bidirectionally on active calls, and review SBC call logs to confirm that the Teams IP Group and carrier IP Group are properly engaged.

Rollback

Suggested rollback: take the gateway out of service by setting Enabled to $false if critical call processing errors occur.

Media bypass on: clients send media straight to the SBC or through Transport Relays

Do

Perform inbound and outbound PSTN test calls 57. Test calling from an internal Teams desktop client, verifying direct media path establishment to the SBC public IP address 30. Test calling from an external client connecting via Transport Relays 30. Test a web client call to verify automatic fallback to non-bypass media 23. Test a call into a call queue or auto attendant, and test call escalation to a group call, verifying that Media Processors are inserted 27 26.

Verify

Suggested check: check the SBC active media session statistics during an internal client call to confirm the remote media IP is the client's address, and confirm it is an address in the relay ranges during relay, web client, or queue calls.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <SBC FQDN> -MediaBypass $false to revert the trunk to non-bypass operation 28.

Applicability

Applies to: Microsoft Teams Phone Direct Routing, AudioCodes Mediant SBC, AudioCodes Mediant Software SBC, and Microsoft Teams Phone. Deployments: cloud, on-premises, multi-tenant, cloud-iaas, dod, gcc, gcc-high, and virtual. Sources checked 2026-09-30. Microsoft lists the certified software version for most Mediant models as supported on 7.40A.600 and recommended on 7.40A.500, with Mediant 500 Li listed as supported on 7.2x.xxx (recommended 7.40A.400) and Mediant 7000 recommended on 7.40A.600 69. For Local Media Optimization, supported firmware is listed as 7.20A.258 (recommended 7.40A.100) for most models and 7.20A.256 for the Mediant 500 96. AudioCodes documents Mediant VE, CE, and SE together in one software SBC user manual, version 7.6 97. Microsoft Direct Routing SIP signaling endpoints for commercial Microsoft 365, Office 365, and GCC tenants use sip.pstnhub.microsoft.com, while GCC High uses sip.pstnhub.gov.teams.microsoft.us and DoD uses sip.pstnhub.dod.teams.microsoft.us 79. Microsoft has stated it is not accepting new nominations for Direct Routing SBC certification until further notice 98.

What remains uncertain

Whether firmware 7.6 releases have received official certification from Microsoft or AudioCodes is not covered by the sources below. Specific IP Profile timer and signaling parameters from AudioCodes' Teams configuration notes (such as session timers, RTCP settings, and re-INVITE handling) are not covered by the sources below. Template versions within the SBC Configuration Wizard that include Teams Direct Routing or hardening are not covered by the sources below. Carrier-specific normalization rules, carrier manipulation profiles, and emergency call routing policies are not covered by the sources below.

See also

Configures

  • AudioCodes Mediant SBC — Guide configures the Mediant SBC (certificates; SIP interface; proxy set; IP group; IP profile; coders; IP-to-IP routing) as the Direct Routing SBC.

Provides pstn for

  • Microsoft teams phone — Direct Routing is one of the four Teams Phone PSTN connectivity models; this guide pairs the SBC with the tenant and enables users and voice routing.

Referenced by

Sources

  1. 1
    Microsoft lists AudioCodes Mediant 500, 800, 1000B, 2600, 3100, 4000, 7000 and 9000 SBCs, Virtual Edition SBC and Mediant Cloud Edition SBC as certified for both non-media-bypass and media bypass, with supported firmware 7.40A.600.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, AudioCodes rows · Checked 2026-09-30
  2. 2
    Mediant Coders Groups determine the audio coders used for calls, are assigned through IP Profiles, list coders in priority order (first is preferred), and let the device add a coder the other side needs to the SDP offer so it can transcode.
    Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6) · Configuring Coders Groups, opening paragraphs · Checked 2026-09-30
  3. 3
    Obtaining a CA-signed certificate for a Mediant TLS Context proceeds by generating a CSR (the device creates a key pair if none exists and includes DN fields and SANs), sending it to the CA, importing the signed certificate, and verifying the certificate matches the private key.
    Assigning CSR-based Certificates to TLS Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Assigning CSR-based Certificates to TLS Contexts, overview and stage list · Checked 2026-09-30
  4. 4
    The Mediant IP Profile parameter ICE Mode can be set to Lite to enable ICE-Lite, and AudioCodes notes ICE is typically required when the device operates in a Microsoft Teams Direct Routing media bypass environment.
    Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6) · Configuring IP Profiles, parameter ICE Mode · Checked 2026-09-30
  5. 5
    The IP Group settings Classify By Proxy Set (classify incoming dialogs to a Server-type IP Group when the source address matches its Proxy Set), Always Use Src Address (reply within a dialog to the source IP of the previous packet) and Proxy Keep-Alive using IP Group Settings (apply the IP Group's settings such as outbound manipulation to keep-alive OPTIONS) are available on the Mediant.
    Configuring IP Groups (Mediant Software SBC User's Manual Ver. 7.4) · Configuring IP Groups, parameters Classify By Proxy Set, Always Use Src Address, Proxy Keep-Alive using IP Group Settings · Checked 2026-09-30
  6. 6
    A Mediant IP Group of type Server represents a SIP entity with a known address and is linked to a Proxy Set (where its requests are sent), an IP Profile, a Media Realm and optional inbound and outbound Message Manipulation Sets.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, parameters Type, Proxy Set, IP Profile, Media Realm, Inbound/Outbound Manipulation Set · Checked 2026-09-30
  7. 7
    The IP Group parameter Local Host Name defines the host name the Mediant puts in the Via and Contact headers of SIP messages sent to that IP Group.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, parameter Local Host Name · Checked 2026-09-30
  8. 8
    The IP Profile parameter SBC Media Security Mode set to Secured makes that SBC leg negotiate only SRTP media lines and removes RTP media lines.
    Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6) · Configuring IP Profiles, parameter SBC Media Security Mode · Checked 2026-09-30
  9. 9
    Mediant Message Manipulation rules modify SIP messages for normalization or interoperability; each rule has a Message Type, an optional Condition, an Action Subject (header), an Action Type such as Add, Remove or Modify, and an Action Value, and rule sets are attached to IP Groups as inbound or outbound manipulation sets.
    Configuring SIP Message Manipulation (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Message Manipulation, parameter table · Checked 2026-09-30
  10. 10
    An IP-to-IP Routing rule with Request Type OPTIONS and Destination Type Internal makes the Mediant terminate SIP OPTIONS locally instead of forwarding them.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, parameters Request Type and Destination Type · Checked 2026-09-30
  11. 11
    A Mediant Proxy Set can enable Proxy Keep-Alive using SIP OPTIONS sent every user-defined interval, Proxy Hot Swap (resend a failed INVITE or REGISTER to a redundant proxy), a Redundancy Mode of Parking or Homing, and a per-Proxy-Set TLS Context.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, parameters Proxy Keep-Alive, Proxy Hot Swap, Redundancy Mode, TLS Context Name · Checked 2026-09-30
  12. 12
    The Mediant shows Proxy Set status under Monitor > VoIP Status > Proxy Sets Status as ONLINE, OFFLINE (keep-alive failed) or NOT RESOLVED (DNS failure), and the field is empty when keep-alive is disabled or has not yet been sent.
    Viewing Proxy Set Status (Mediant Software SBC User's Manual Ver. 7.4) · Viewing Proxy Set Status, status table · Checked 2026-09-30
  13. 13
    A Mediant IP-to-IP Routing rule matches on characteristics such as Source IP Group and Request Type and routes to a destination whose type can be an IP Group, a destination address, the Request-URI, an IP Group Set, a Dial Plan or Destination Tag, or Internal.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, parameters Source IP Group and Destination Type · Checked 2026-09-30
  14. 14
    A Mediant SIP Interface defines a local listening port and transport on an IP network interface for SIP signaling, with TLS defaulting to port 5061, application type SBC, an assigned TLS Context, and an optional TLS Mutual Authentication setting that requires the client certificate.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, parameter table · Checked 2026-09-30
  15. 15
    The IP Group parameter Teams Direct Routing Mode makes the Mediant include Microsoft's proprietary X-MS-SBC header, valued AudioCodes/<model>/<firmware>, in outgoing SIP INVITE and OPTIONS messages.
    Configuring IP Groups (Mediant Software SBC User's Manual Ver. 7.4) · Configuring IP Groups, parameter Teams Direct Routing Mode · Checked 2026-09-30
  16. 16
    A Mediant TLS Context holds TLS settings such as certificates, up to 100 can be configured, and the device ships with a default TLS Context (index 0, named default) holding a self-generated private key and self-signed certificate.
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, opening paragraphs · Checked 2026-09-30
  17. 17
    The TLS Version parameter of a Mediant TLS Context defaults to 'TLSv1.2 and TLSv1.3', and cipher lists for TLS 1.2-and-earlier server and client roles are set in OpenSSL cipher list format.
    Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6) · Configuring TLS Certificate Contexts, TLS Version and cipher parameters · Checked 2026-09-30
  18. 18
    The Mediant accepts a peer certificate only if a CA in the TLS Context's Trusted Root CA store signed it; certificates are imported through TLS Contexts > Trusted Root Certificates > Import Certificate and must be Base64 (PEM) encoded X.509.
    Importing a Certificate into the Trusted Root CA Certificate Store (Mediant Software SBC User's Manual Ver. 7.6) · Importing a Certificate into the Trusted Root CA Certificate Store · Checked 2026-09-30
  19. 19
    When the SBC Configuration Wizard applies its template, the parameters it configures overwrite the device's existing values and parameters it does not configure are restored to factory defaults.
    SBC Configuration Wizard (Mediant Software SBC User's Manual Ver. 7.6) · SBC Configuration Wizard, note on applying the configuration · Checked 2026-09-30
  20. 20
    AudioCodes describes the SBC Configuration Wizard as a quick-and-easy method for the initial configuration of the device.
    SBC Configuration Wizard (Mediant Software SBC User's Manual Ver. 7.6) · SBC Configuration Wizard, opening paragraph · Checked 2026-09-30
  21. 21
    The SBC Configuration Wizard is not supported when the device operates in High-Availability mode, has IPv6 interfaces configured, or has WebSocket tunneling with OVOC configured.
    SBC Configuration Wizard (Mediant Software SBC User's Manual Ver. 7.6) · SBC Configuration Wizard, list of unsupported conditions · Checked 2026-09-30
  22. 22
    With media bypass, clients send UDP/SRTP from source ports 50000-50019 to SBC-defined ports on the SBC's public IP, and the SBC sends back to client ports 50000-50019.
    Plan for media bypass with Direct Routing · Media traffic: IP and Port ranges > Requirements for direct media traffic table · Checked 2026-09-30
  23. 23
    Media bypass is supported with standalone Teams desktop clients, Android and iOS clients and Teams Phone devices; calls from other endpoints such as Teams web clients are automatically converted to non-bypass.
    Plan for media bypass with Direct Routing · Client endpoints supported with media bypass · Checked 2026-09-30
  24. 24
    Media bypass uses ICE on the Teams client and ICE Lite on the SBC.
    Plan for media bypass with Direct Routing · About media bypass with Direct Routing, final paragraph · Checked 2026-09-30
  25. 25
    Media bypass is not supported when the SBC uses IPv6 SIP or media or with the IPv6 Teams client, and mixed IPv6/IPv4 SIP and media is not supported.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, IPAddressVersion bullet · Checked 2026-09-30
  26. 26
    On a media-bypass trunk, Teams Media Processors are still inserted when a call escalates from 1:1 to a group call, goes to a federated Teams user, or is forwarded or transferred to a Skype for Business user.
    Plan for media bypass with Direct Routing · Use of Teams Media Processors if trunk is configured for media bypass · Checked 2026-09-30
  27. 27
    Even with media bypass, Media Processors are always in the media path for voice applications such as Call Park, auto attendants and call queues and for web clients, so the non-bypass Media Processor firewall requirements still apply.
    Plan for media bypass with Direct Routing · Use of Media Processors and Transport Relays; Requirements for using media processors · Checked 2026-09-30
  28. 28
    Media bypass is controlled per SBC with Set-CsOnlinePSTNGateway -MediaBypass set to true or false, and enabling it does not mean all media stays inside the corporate network.
    Plan for media bypass with Direct Routing · About media bypass with Direct Routing, paragraph 2 · Checked 2026-09-30
  29. 29
    To pilot media bypass, Microsoft describes two trunks with different FQDNs on the same SBC, one with media bypass and one without, using different TLS signaling ports but the same media ports, a certificate covering both names (SAN or wildcard), and a separate online voice routing policy assigned to test users.
    Plan for media bypass with Direct Routing · Configure separate trunks for media bypass and non-media bypass · Checked 2026-09-30
  30. 30
    For direct media with media bypass the Teams client must reach the SBC's public IP address even from the internal network; otherwise media can flow via Teams Transport Relays, and signaling always flows via the Microsoft cloud.
    Plan for media bypass with Direct Routing · Call flow if the user has direct access to the public IP address of the SBC · Checked 2026-09-30
  31. 31
    With media bypass, Transport Relays reach the SBC from UDP ports 50000-59999, and the SBC must be able to send to relay ports 50000-59999 and 3478-3481 because Microsoft runs two relay versions (v4 on 50000-59999, v6 on 3478-3481).
    Plan for media bypass with Direct Routing · Requirements for using Transport Relays, port table and note · Checked 2026-09-30
  32. 32
    Microsoft recommends requesting the SBC certificate by generating the Certificate Signing Request directly on the SBC.
    Plan Direct Routing · Public trusted certificate for the SBC · Checked 2026-09-30
  33. 33
    The SBC certificate should carry the SBC FQDN as Common Name or Subject Alternative Name, be signed by a CA in the Microsoft Trusted Root Program and include the Server Authentication EKU.
    Plan Direct Routing · Public trusted certificate for the SBC, bullet list · Checked 2026-09-30
  34. 34
    Wildcard SBC certificates are supported when they comply with RFC 2818, and if mutual TLS is enabled all required Microsoft Trusted Root certificates must be installed on the SBC.
    Plan Direct Routing · Public trusted certificate for the SBC, closing paragraphs · Checked 2026-09-30
  35. 35
    Because Direct Routing sends its OPTIONS to the FQDN in the Contact header of the SBC's OPTIONS and the Mediant's Local Host Name sets that Contact host, the Teams IP Group's Local Host Name should likely be the same SBC FQDN that was paired in the tenant.inferred
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Local Host Name parameter, combined with ms-learn-dr-connect-sbc Validate SIP options · Checked 2026-09-30
  36. 36
    Besides registering the SBC's domain in the tenant, there must be a user with that domain who is assigned an E3 or E5 license, otherwise pairing fails with an error that the domain was not configured for this tenant; the domain's authentication type must be Managed to assign such a user.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, bullets 2-3 · Checked 2026-09-30
  37. 37
    The gateway's Enabled setting turns the SBC on for outbound calls, defaults to False, and can be used to temporarily remove the SBC from service during updates or maintenance.
    Connect your Session Border Controller (SBC) to Direct Routing · SBC settings table, row Enabled · Checked 2026-09-30
  38. 38
    For numbers managed online, Set-CsPhoneNumberAssignment -Identity <user> -PhoneNumber <number> -PhoneNumberType DirectRouting assigns the number and automatically enables enterprise voice; Microsoft recommends but does not require full E.164 format.
    Enable users for Direct Routing · Configure the phone number and enable enterprise voice > Use PowerShell · Checked 2026-09-30
  39. 39
    Microsoft's user enablement steps for Direct Routing are: create the user and assign a Teams Phone license, ensure the user is homed online, configure the phone number and enable enterprise voice, optionally configure direct-to-voicemail, and assign Teams Only mode.
    Enable users for Direct Routing · Introduction, numbered list of five steps · Checked 2026-09-30
  40. 40
    Direct Routing requires users to be in Teams Only mode, set by assigning the UpgradeToTeams instance of TeamsUpgradePolicy, so that incoming calls land in the Teams client.
    Enable users for Direct Routing · Assign Teams Only mode to users to ensure calls land in Microsoft Teams · Checked 2026-09-30
  41. 41
    Because Microsoft's list shows AudioCodes firmware 7.40A and supports higher builds only within the same major.minor, a Mediant running a 7.6 release may fall outside the documented certified line and should be confirmed with AudioCodes before production.inferred
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table AudioCodes rows plus support note on major.minor · Checked 2026-09-30
  42. 42
    Direct Routing certification is granted to specific SBC firmware versions, and firmware higher than the documented version is supported as long as the major.minor version is the same.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Support note under the vendor bullet list, with example · Checked 2026-09-30
  43. 43
    An SBC can be connected to Direct Routing only if the domain portion of its FQDN matches a domain registered in the tenant, and *.onmicrosoft.com domains are not supported for the SBC FQDN.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, bullet 2 · Checked 2026-09-30
  44. 44
    Microsoft instructs administrators to allow signaling to and from all Microsoft Teams Direct Routing IP ranges (52.112.0.0/14 and 52.120.0.0/14 for Microsoft 365, Office 365 and GCC), not only the addresses returned by DNS.
    Plan Direct Routing · SIP signaling: FQDNs, Important note · Checked 2026-09-30
  45. 45
    Microsoft lists the Direct Routing media transport as TCP/RTP/SAVP and UDP/RTP/SAVP, that is, secure RTP.
    Plan Direct Routing · Infrastructure requirements table, row Media transport · Checked 2026-09-30
  46. 46
    Microsoft does not support media re-targeting during an active Direct Routing call: if the SBC signals a new media IP mid-call, Direct Routing never sends media to it.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Closing note on media re-targeting · Checked 2026-09-30
  47. 47
    Mapping multiple IP addresses to the same FQDN on the SBC side is not supported for Direct Routing.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, bullet 4 · Checked 2026-09-30
  48. 48
    Microsoft states that SIP OPTIONS pings from the SBC must not exceed a frequency of one transaction every 60 seconds per configured trunk per endpoint.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, SIP OPTIONS bullet · Checked 2026-09-30
  49. 49
    The SBC is connected to the tenant with New-CsOnlinePSTNGateway, whose minimum parameters are the SBC FQDN, SipSignalingPort, MaxConcurrentSessions and Enabled.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant · Checked 2026-09-30
  50. 50
    Media Processors are B2BUAs that can transcode (for example SILK to G.711), whereas Transport Relays only relay audio, so on bypassed calls the codec is never changed between the client and the SBC.
    Plan for media bypass with Direct Routing · Media Processors vs Transport Relays table and transcoding explanation · Checked 2026-09-30
  51. 51
    SendSIPOptions defaults to True and Microsoft highly recommends leaving it on, because when it is off the SBC is excluded from the Monitoring and Alert system.
    Connect your Session Border Controller (SBC) to Direct Routing · SBC settings table, row Send SIP options · Checked 2026-09-30
  52. 52
    For SIP/TLS, the Microsoft SIP Proxy connects to the SBC from source ports 1024-65535 to a destination port defined on the SBC, and the SBC connects to the SIP Proxy on port 5061.
    Plan for media bypass with Direct Routing · SIP Signaling: Ports table · Checked 2026-09-30
  53. 53
    Because Direct Routing media is RTP/SAVP (SRTP), the IP Profile assigned to the Teams IP Group should use SBC Media Security Mode Secured, while the carrier leg keeps whatever the carrier requires, with the SBC converting between them.inferred
    Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6) · SBC Media Security Mode parameter, combined with ms-learn-plan-direct-routing Infrastructure requirements (Media transport) · Checked 2026-09-30
  54. 54
    If the SBC FQDN uses a subdomain (for example sbc.service.contoso.com), that subdomain (service.contoso.com) must also be registered in the tenant.
    Connect your Session Border Controller (SBC) to Direct Routing · Use the Microsoft Teams admin center, step 3 · Checked 2026-09-30
  55. 55
    In the Teams admin center an SBC is added under Voice > Direct Routing > SBCs > Add, but for GCC High and DoD the SBC must be connected with PowerShell because the option is not available in the Teams admin center.
    Connect your Session Border Controller (SBC) to Direct Routing · Introduction note; Use the Microsoft Teams admin center, steps 1-2 · Checked 2026-09-30
  56. 56
    Microsoft forces TLS 1.2 on the Direct Routing SIP interface and requires the SBC to connect with one of four cipher suites: ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-SHA384 or ECDHE-RSA-AES128-SHA256.
    Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, TLS1.2 bullet · Checked 2026-09-30
  57. 57
    Microsoft's post-configuration checks are: the SBC reports a healthy connection, inbound and outbound PSTN calls work, emergency calling works if configured, failover between SIP connection points works, voice routing policies are assigned correctly, and call quality is acceptable across representative scenarios.
    Plan Direct Routing · Verify your deployment · Checked 2026-09-30
  58. 58
    Pairing is validated on the SBC by confirming that its outgoing OPTIONS receive 200 OK and that it answers Direct Routing's incoming OPTIONS with 200 OK; Direct Routing sends its OPTIONS to the SBC FQDN found in the Contact header of the SBC's OPTIONS.
    Connect your Session Border Controller (SBC) to Direct Routing · Verify the SBC connection > Validate SIP options · Checked 2026-09-30
  59. 59
    After pairing, Get-CsOnlinePSTNGateway -Identity <SBC FQDN> should list the SBC with Enabled showing True.
    Connect your Session Border Controller (SBC) to Direct Routing · Verify the SBC connection > Check whether the SBC is on the list of paired SBCs · Checked 2026-09-30
  60. 60
    Microsoft's PowerShell sequence for call routing is Set-CsOnlinePstnUsage to add a usage, New-CsOnlineVoiceRoute with a NumberPattern and OnlinePstnGatewayList, New-CsOnlineVoiceRoutingPolicy with OnlinePstnUsages, and Grant-CsOnlineVoiceRoutingPolicy to assign it, verified with Get-CsOnlineUser selecting OnlineVoiceRoutingPolicy.
    Configure call routing for Direct Routing · Example 1: Configuration steps > Using PowerShell, steps 1-4 · Checked 2026-09-30
  61. 61
    Direct Routing call routing consists of an online voice routing policy (a container of PSTN usages assigned to users), PSTN usages (containers of voice routes), voice routes (a number pattern plus online PSTN gateways) and the online PSTN gateway (a pointer to the SBC).
    Configure call routing for Direct Routing · Call routing overview · Checked 2026-09-30
  62. 62
    Configuring the global (org-wide default) online voice routing policy makes every voice-enabled user inherit it, which can route Calling Plan and Operator Connect users' PSTN calls to the Direct Routing trunk; Microsoft advises a custom policy assigned to individual users instead.
    Configure call routing for Direct Routing · Voice routing policy considerations, Caution item 1 · Checked 2026-09-30
  63. 63
    For a user with Teams Phone but no Calling Plan, a call that matches no voice route pattern in the user's policy is dropped.
    Configure call routing for Direct Routing · Example 1, paragraph after the third-route diagram · Checked 2026-09-30
  64. 64
    PSTN usages in a voice routing policy are applied in order and, once a match is found in one usage, later usages are never evaluated.
    Configure call routing for Direct Routing · Example 2, note under the summary table · Checked 2026-09-30
  65. 65
    Microsoft lists four PSTN connectivity models for Teams Phone: Microsoft Teams Calling Plan, Operator Connect, Teams Phone Mobile and Direct Routing.
    PSTN connectivity options · PSTN connectivity options, section 'PSTN connectivity options' · Checked 2026-09-24
  66. 66
    Direct Routing lets an organization use any PSTN operator by connecting it through a certified SBC that is procured, installed and managed by the customer, an integrator or a Direct-Routing-as-a-Service provider.
    PSTN connectivity options · PSTN connectivity options, bullet 'Direct Routing' · Checked 2026-09-24
  67. 67
    Direct Routing requires a Microsoft-certified SBC, PSTN trunks to it, users homed online, a public IP, an SBC FQDN in a verified tenant domain (not *.onmicrosoft.com) with public DNS, and a publicly trusted TLS certificate.
    Plan Direct Routing · Plan Direct Routing, section 'Infrastructure requirements' table and section 'SBC domain names' · Checked 2026-09-24
  68. 68
    Microsoft's certified Direct Routing SBC table lists AudioCodes Mediant 500, 500 Li, 800, 1000B, 2600, 3100, 4000, 7000 and 9000 SBCs plus Virtual Edition and Mediant Cloud Edition, all certified for both non-media-bypass and media bypass.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, AudioCodes rows · Checked 2026-09-24
  69. 69
    For most AudioCodes models, Microsoft's certified-SBC table lists firmware 'Supported 7.40A.600 (Recommended 7.40A.500)'; Mediant 500 Li is listed as Supported 7.2x.xxx (Recommended 7.40A.400) and Mediant 7000 as Recommended 7.40A.600.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, AudioCodes rows, 'Software version' column · Checked 2026-09-24
  70. 70
    Microsoft supports certified SBC firmware versions higher than the documented one as long as the major.minor version is the same.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Introductory note on firmware versions, above the certified vendor table · Checked 2026-09-24
  71. 71
    Microsoft supports Teams Phone with Direct Routing only when certified SBCs are used, expects the SBC vendor to investigate first and escalate, and may decline support requests involving non-certified SBCs.
    Plan Direct Routing · Plan Direct Routing, sections 'Supported Session Border Controllers (SBCs)' and 'Support boundaries' · Checked 2026-09-24
  72. 72
    Direct Routing is not supported in Islands coexistence mode.
    Plan Direct Routing · Plan Direct Routing, section 'Licensing requirements', Note · Checked 2026-09-24
  73. 73
    For Direct Routing issues, the customer must contact the certified SBC vendor's support first, and escalations to Microsoft need the vendor's investigation report.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Note under the introductory list · Checked 2026-09-24
  74. 74
    The SBC sends SIP/TLS to the Microsoft SIP proxy on port 5061; the port the Microsoft proxy uses toward the SBC is the one configured for the SBC.
    Plan Direct Routing · SIP signaling ports table · Checked 2026-09-24
  75. 75
    Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP ports 3478-3481 and 49152-53247 in both directions, and Microsoft recommends at least two media ports per concurrent call on the SBC.
    Plan Direct Routing · Plan Direct Routing, section 'Media ports' table and Tip · Checked 2026-09-24
  76. 76
    Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP on ports 3478 to 3481 and 49152 to 53247, and Microsoft recommends at least two SBC media ports per concurrent call.
    Plan Direct Routing · Media ports table and following tip · Checked 2026-09-24
  77. 77
    Microsoft forces TLS 1.2 on the Direct Routing SIP interface and lists four ECDHE-RSA AES cipher suites the SBC must be able to use.
    Connect your Session Border Controller (SBC) to Direct Routing · Connect the SBC to the tenant > Considerations, TLS bullet · Checked 2026-09-24
  78. 78
    A SIP Interface represents a Layer-3 network by defining a local listening port and transport type and assigning an IP network interface for SIP signaling.
    Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6) · Configuring SIP Interfaces, opening paragraph · Checked 2026-09-24
  79. 79
    For Microsoft 365, Office 365 and GCC, the SBC connects to sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com in priority order over SIP/TLS to port 5061; GCC High uses sip.pstnhub.gov.teams.microsoft.us and DoD uses sip.pstnhub.dod.teams.microsoft.us.
    Plan Direct Routing · Plan Direct Routing, sections 'SIP signaling: FQDNs', 'SIP signaling: GCC High', 'SIP signaling: DoD', 'SIP signaling ports' · Checked 2026-09-24
  80. 80
    For Microsoft 365, Office 365 and GCC, an SBC connects to Direct Routing through sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com in that priority order.
    Plan Direct Routing · SIP signaling: FQDNs · Checked 2026-09-24
  81. 81
    At least one SIP Interface must be assigned to a Proxy Set.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, SIP Interface parameter note · Checked 2026-09-24
  82. 82
    In Parking redundancy mode the SBC stays with the current proxy until it fails; in Homing mode it always tries to use the highest-priority proxy currently online.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Redundancy Mode' parameter · Checked 2026-09-24
  83. 83
    The Proxy Set 'Proxy Keep-Alive Time' defaults to 60 seconds and can be set from 5 to 2,000,000 seconds.
    Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6) · Configuring Proxy Sets, 'Proxy Keep-Alive Time' parameter · Checked 2026-09-24
  84. 84
    On a Mediant SBC, an IP Group represents a SIP entity the device communicates with, either a server such as an IP PBX or ITSP, or a group of users such as LAN IP phones.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, opening paragraph · Checked 2026-09-24
  85. 85
    Mediant IP Groups have three types: Server (address known, usually through a Proxy Set), User (location learned from REGISTER), and Gateway (SBC only; address taken from the Contact header of the gateway's REGISTER).
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Type' parameter description · Checked 2026-09-24
  86. 86
    The Media Realm assigned to an IP Group determines the UDP port range and maximum number of media sessions on a specific IP interface for that IP Group's media.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Media Realm' parameter description · Checked 2026-09-24
  87. 87
    When the IP Group's 'Proxy Keep-Alive using IP Group settings' option is enabled, the IP Group's Outbound Manipulation Set is also applied to the proxy keep-alive SIP OPTIONS messages.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Proxy Keep-Alive using IP Group settings' parameter · Checked 2026-09-24
  88. 88
    For security, AudioCodes recommends classifying SIP dialogs by Proxy Set only when the IP Group's address is unknown, meaning its Proxy Set is configured with an FQDN.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Classify By Proxy Set' parameter note · Checked 2026-09-24
  89. 89
    Each IP Group can be assigned an Inbound Message Manipulation Set and an Outbound Message Manipulation Set, applied to SIP messages on the respective call leg.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring IP Groups, 'Inbound Message Manipulation Set' and 'Outbound Message Manipulation Set' parameters · Checked 2026-09-24
  90. 90
    Direct Routing supports SILK, G.711, G.722, G.729 and AMR-WB between Teams and the SBC, with AMR-WB supported only without media bypass.
    Plan Direct Routing · Plan Direct Routing, section 'Supported codecs' · Checked 2026-09-24
  91. 91
    The IP Profile has an ICE Mode parameter that can be set to Lite, enabling ICE for the SIP user agent associated with that IP Profile.
    Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6) · Configuring IP Profiles, 'ICE Mode' parameter · Checked 2026-09-24
  92. 92
    The Mediant SBC searches the IP-to-IP Routing table from top to bottom and uses the first rule that matches the incoming call.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, introductory paragraphs · Checked 2026-09-24
  93. 93
    AudioCodes advises placing stricter IP-to-IP Routing rules higher in the table than less strict rules.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, note on rule order · Checked 2026-09-24
  94. 94
    If no IP-to-IP Routing rule matches an incoming call, the Mediant SBC rejects the call.
    Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Configuring SBC IP-to-IP Routing Rules, introductory paragraphs · Checked 2026-09-24
  95. 95
    To validate Direct Routing pairing, the SBC should receive 200 OK to its outgoing OPTIONS and answer Direct Routing's OPTIONS with 200 OK; Direct Routing sends its OPTIONS to the FQDN in the Contact header of the SBC's OPTIONS.
    Connect your Session Border Controller (SBC) to Direct Routing · Verify the SBC connection > Validate SIP options · Checked 2026-09-24
  96. 96
    Microsoft lists AudioCodes Mediant 500, 800, 1000B, 2600, 4000, 9000, Virtual Edition and Cloud Edition SBCs as supporting Local Media Optimization; for most models the table shows Supported 7.20A.258 (Recommended 7.40A.100), and for Mediant 500 it shows 7.20A.256.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Support for Local Media Optimization table, AudioCodes rows · Checked 2026-09-24
  97. 97
    AudioCodes documents Mediant VE (Virtual Edition), Mediant CE (Cloud Edition) and Mediant SE (Server Edition) together in one 'Mediant Software SBC' User's Manual, version 7.6.
    Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6) · Page header: manual title 'Mediant Software (VE, CE and SE) Session Border Controller User's Manual Version 7.6' · Checked 2026-09-24
  98. 98
    Microsoft states it is not accepting new nominations for Direct Routing SBC certification until further notice.
    Session Border Controllers certified for Direct Routing - Microsoft Teams · Paragraph directly above 'Certified SBC vendors' · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Assigning CSR-based Certificates to TLS Contexts (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Configure call routing for Direct Routing

Microsoft · 2026-09-10 · accessed 2026-09-21

tier 2 current vendor documentation

Configuring Coders Groups (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Configuring IP Groups (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring IP Groups (Mediant Software SBC User's Manual Ver. 7.4)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Configuring IP Profiles (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring Proxy Sets (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring SBC IP-to-IP Routing Rules (Mediant Software (VE, CE and SE) SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring SIP Interfaces (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring SIP Message Manipulation (Mediant Software SBC User's Manual Version 7.6)

AudioCodes · accessed 2026-09-24

tier 2 current vendor documentation

Configuring TLS Certificate Contexts (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Connect your Session Border Controller (SBC) to Direct Routing

Microsoft · 2026-04-26 · accessed 2026-09-21

tier 2 current vendor documentation

Enable users for Direct Routing

Microsoft · 2026-08-21 · accessed 2026-09-21

tier 2 current vendor documentation

Importing a Certificate into the Trusted Root CA Certificate Store (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Plan Direct Routing

Microsoft (Microsoft Learn) · 2026-08-21 · accessed 2026-09-06

tier 2 current vendor documentation

Plan for media bypass with Direct Routing

Microsoft · 2026-09-10 · accessed 2026-09-16

tier 2 current vendor documentation

PSTN connectivity options

Microsoft (Microsoft Learn) · 2026-08-06 · accessed 2026-09-06

tier 2 current vendor documentation

SBC Configuration Wizard (Mediant Software SBC User's Manual Ver. 7.6)

AudioCodes · accessed 2026-09-30

tier 2 current vendor documentation

Session Border Controllers certified for Direct Routing - Microsoft Teams

Microsoft · 2026-05-27 · accessed 2026-09-14

tier 2 current vendor documentation

Viewing Proxy Set Status (Mediant Software SBC User's Manual Ver. 7.4)

AudioCodes · accessed 2026-09-30

Cite this page

APA

WarmTransfer. (2026, September 30). Setting up an AudioCodes SBC for Teams Direct Routing. WarmTransfer. https://warmtransfer.net/guides/audiocodes-teams-direct-routing-setup

BibTeX

@misc{warmtransfer-audiocodes-teams-direct-routing-setup,
  title  = {Setting up an AudioCodes SBC for Teams Direct Routing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/audiocodes-teams-direct-routing-setup},
  note   = {Verified 2026-09-30}
}