Integrations · guide

Setting up an Oracle SBC for Teams Direct Routing

Verified 2026-09-30 · 71 sources · tier 2 · 1 disputed

For Voice engineers configuring an Oracle Enterprise Session Border Controller for Microsoft Teams Phone Direct Routing..

Microsoft Teams Phone Direct Routing connects customer-managed Session Border Controllers to Microsoft's cloud telephony infrastructure over SIP and SRTP 6465. To establish bidirectional calling and trunk health monitoring, validate that the SBC's outgoing OPTIONS receive 200 OK responses and that acceptance tests pass 3862.

Before you start

Direct Routing requires a Microsoft-certified SBC, PSTN trunks connected to it, users homed online, a public IP address, an SBC FQDN in a verified tenant domain with public DNS, and a publicly trusted TLS certificate 66. Microsoft supports Teams Phone Direct Routing only with certified SBCs and expects the SBC vendor to investigate issues first 67.

Do not use the Web GUI Configuration Assistant on an SBC that already carries active configuration: Oracle warns that the assistant removes all existing configuration on the device, including High Availability settings 9. Ensure the tenant is not operating in Islands coexistence mode, as Direct Routing is unsupported in that mode 68.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Will media flow directly between Teams clients and the SBC, or through Microsoft Media Processors?

Does the SBC serve a single Microsoft 365 tenant, or multiple customer tenants from a carrier host?

Two questions. One permanent page you can send to your manager.

Step 1 Confirm SBC model, software version, and DNS design

Do

Verify that the SBC hardware or virtual platform is certified by Microsoft: the supported list includes the Oracle AP 1100, AP 3900, AP 4600, AP 6300, AP 6350, VME, AP 3950, AP 4900 and AP 6400 39. Verify that the running software version is 9.x or 10.x, noting that Microsoft lists the AP 6300 for 9.x only and the AP 6400 for 10.x only 40. Microsoft does not support mapping multiple IP addresses to the same FQDN on the SBC side 35.

Verify

Confirm that the running major and minor release numbers match a certified version, as Microsoft supports firmware higher than the documented build only while the major.minor version remains identical 23.

Rollback

Suggested rollback: No configuration changes are made in this step.

Step 2 Register and activate domain names in Microsoft 365

Single tenant: the SBC serves one Microsoft 365 organization

Do

Select an SBC FQDN whose domain is registered in the tenant and is not *.onmicrosoft.com 21. If a subdomain is used in the FQDN, register that subdomain in the tenant 21. The tenant needs a user in that domain with an E3 or E5 license, and the domain's authentication type must be Managed 22. Publish a public DNS A record resolving the FQDN to the SBC's public IP address 66.

Verify

Pairing fails with an error that the domain was not configured for the tenant if the licensed user in that domain or Managed authentication type is missing 22.

Rollback

Suggested rollback: Remove the licensed user and deregister the domain or subdomain from the administration center.

Carrier multi-tenant: the SBC serves multiple customer organizations

Do

Confirm that the carrier tenant and all customer tenants reside in the same cloud, as a carrier tenant in the public cloud cannot serve customer tenants in GCC High 12. In the carrier tenant, register a base domain (such as sbc1.carrier.example) and activate it by adding at least 1 Teams-licensed user or a resource account assigned a Teams Phone Resource Account license whose UPN matches the exact FQDN 1011. For each customer tenant, have a Global Administrator add a unique subdomain of that base domain and verify it using a TXT record created at the carrier's DNS host 15. Activate each customer subdomain by creating an account with a Teams license or Teams Phone Resource Account license using the exact customer subdomain FQDN 10. Publish public DNS records resolving every customer subdomain FQDN to the SBC's IP address 14.

Verify

Confirm that each subdomain reads Setup complete in its respective tenant's admin center 15.

Rollback

Suggested rollback: Remove the activation accounts and delete the subdomains from each customer tenant, and delete the corresponding TXT and A records from carrier DNS.

Step 3 Install certificates and create the TLS profile

Single tenant: the SBC serves one Microsoft 365 organization

Do

Generate a certificate signing request on the SBC for a certificate signed by a CA in the Microsoft Trusted Root Program, containing the SBC FQDN as CN or SAN and including the Server Authentication EKU 16. Microsoft SIP endpoints accept certificates lacking the Client Authentication EKU 17.

Under security > tls-profile, configure a profile setting end-entity-certificate to the installed SBC certificate and trusted-ca-certificates to trust Microsoft's roots 59. Import the root certificates Microsoft lists for its SIP interface: DigiCert Global Root CA, DigiCert Global Root G2, DigiCert Global Root G3, DigiCert TLS ECC P384 Root G5, DigiCert TLS RSA 4096 Root G5, Microsoft ECC Root Certificate Authority 2017, and Microsoft RSA Root Certificate Authority 2017 31. When mutual TLS is enabled, all required Microsoft Trusted Root certificates must be installed 33. Sources disagree on relying solely on Baltimore CyberTrust Root: Oracle's ESBC 9.0.0 Web GUI Configuration Assistant states it must be installed and installs it by default 2, while Microsoft's list requires the DigiCert roots along with Microsoft ECC Root Certificate Authority 2017 and Microsoft RSA Root Certificate Authority 2017 31. Ensure the profile can negotiate TLS 1.2 using one of Microsoft's 4 required cipher suites: ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-SHA384, or ECDHE-RSA-AES128-SHA256 61.

Verify

Suggested check: Review the TLS profile configuration to ensure the root CAs are linked and TLS negotiation is permitted.

Rollback

Suggested rollback: Delete the TLS profile under security and remove the imported certificate records from the SBC.

Carrier multi-tenant: the SBC serves multiple customer organizations

Do

Generate a certificate signing request on the SBC for an RFC 2818 wildcard certificate signed by a CA in the Microsoft Trusted Root Program, using the pattern *.base_domain (such as *.sbc1.carrier.example) as the CN or SAN, and ensure it includes the Server Authentication EKU 1116. Microsoft SIP endpoints accept certificates lacking the Client Authentication EKU 17.

Under security > tls-profile, configure a profile setting end-entity-certificate to the installed wildcard certificate and trusted-ca-certificates to trust Microsoft's roots 59. Import the root certificates Microsoft lists for its SIP interface: DigiCert Global Root CA, DigiCert Global Root G2, DigiCert Global Root G3, DigiCert TLS ECC P384 Root G5, DigiCert TLS RSA 4096 Root G5, Microsoft ECC Root Certificate Authority 2017, and Microsoft RSA Root Certificate Authority 2017 31. When mutual TLS is enabled, all required Microsoft Trusted Root certificates must be installed 33. Sources disagree on relying solely on Baltimore CyberTrust Root: Oracle's ESBC 9.0.0 Web GUI Configuration Assistant states it must be installed and installs it by default 2, while Microsoft's list requires the DigiCert roots along with Microsoft ECC Root Certificate Authority 2017 and Microsoft RSA Root Certificate Authority 2017 31. Ensure the profile can negotiate TLS 1.2 using one of Microsoft's 4 required cipher suites: ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-SHA384, or ECDHE-RSA-AES128-SHA256 61.

Verify

Suggested check: Review the TLS profile to ensure the wildcard certificate and trusted root CAs are assigned.

Rollback

Suggested rollback: Delete the TLS profile under security and remove the imported wildcard certificate records from the SBC.

Step 4 Configure realms, steering pools, and firewall rules

Media bypass off: media always routes through Microsoft Media Processors

Do

Under realm-config, configure a Teams-facing realm bound to a network interface, and configure a PSTN-facing realm bound to its respective network interface 44.

Under media-manager > steering-pool, define a pool for the Teams realm configuring ip-address, start-port, end-port, and realm-id, allocating at least 2 media ports per concurrent call 6956. Define a distinct steering pool for the PSTN realm 56.

Open the perimeter firewall between the SBC's Teams steering pool and Microsoft Media Processors on UDP/SRTP ports 3478-3481 and 49152-53247 in both directions 69.

Verify

Suggested check: Verify that the steering pools load without port collision errors and that ACLs allow bidirectional UDP traffic between the steering pool and cloud media ranges.

Rollback

Suggested rollback: Delete the steering pools and realm configurations from the SBC ACLI and remove the firewall rules.

Media bypass on: media routes directly between Teams clients and the SBC where supported

Do

Under media-manager > ice-profile, create an ICE profile for the Teams interface 27. Direct Routing media bypass uses ICE on the client and ICE Lite on the SBC 5. If enabling rtcp-stun, disable rtcp-mux on both call realms, noting that rtcp-stun does not support Teams-to-Teams calls and does not support 2 Microsoft Teams hold scenarios where RTP and RTCP flow asymmetrically 48.

Under realm-config, create a Teams realm referencing the ice-profile and bound to its network interface, and create a PSTN realm 44.

Under media-manager > steering-pool, define steering pools for both realms, allocating at least 2 media ports per concurrent call for the Teams realm 6956.

Allow direct media between Teams clients and the SBC's public IP address, using client UDP/SRTP ports 50000-50019 to and from SBC-defined ports 3. Allow media between Teams Transport Relays in 52.112.0.0/14 (sending from ports 50000-59999 to the SBC, and receiving from the SBC on ports 50000-59999 and 3478-3481) and the SBC steering pool 7. Allow media to Microsoft Media Processors on UDP/SRTP ports 3478-3481 and 49152-53247 in both directions, which remain in the media path for voice applications, web clients, group escalations, and federated calls 696.

Verify

Suggested check: Verify that external and internal clients can reach the SBC public IP address on the steering pool ports.

Rollback

Suggested rollback: Remove the ice-profile reference from the realm, delete the ice-profile and steering-pool configurations, and remove the client and relay firewall rules.

Step 5 Configure SRTP for Direct Routing

Do

Under security > media-security > sdes-profile, create an SDES profile that includes AES_CM_128_HMAC_SHA1_80 in its crypto-list, which is supported on every listed Acme Packet platform and on virtual platforms and matches Microsoft's Direct Routing RTP/SAVP offer 5157.

Under security > media-security > media-sec-policy, create a policy for the Teams realm with pass-through disabled (the default) so the SBC terminates the SRTP session itself 32. Assign this media-sec-policy to the Teams realm-config 44.

Verify

Suggested check: Verify that the media security policy is active on the realm and that pass-through is disabled.

Rollback

Suggested rollback: Remove the media-sec-policy reference from the Teams realm and delete the media-sec-policy and sdes-profile objects.

Step 6 Create the Teams-facing SIP interface

Do

Under sip-interface, create an interface bound to the Teams realm 44. Set the SipSignalingPort required for the gateway 24. If header manipulation rules are used, attach them via in-manipulationid and out-manipulationid 54.

Verify

Suggested check: Verify that the SIP interface is bound to the Teams realm and listening on the designated TLS port.

Rollback

Suggested rollback: Delete the Teams-facing SIP interface from the SBC configuration.

Step 7 Configure session agents and session agent groups

Do

For Microsoft 365, Office 365 and GCC, connect the SBC to sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com in priority order over SIP/TLS to port 5061; GCC High uses sip.pstnhub.gov.teams.microsoft.us and DoD uses sip.pstnhub.dod.teams.microsoft.us 70.

On each session-agent, set hostname, port, a TLS transport-method such as StaticTLS, realm-id to the Teams realm, ping-method to OPTIONS, and ping-interval in seconds 49. Direct Routing considers an SBC healthy if it sent SIP OPTIONS within the last 3 minutes 37. Set ping-response to enabled so the SBC treats OPTIONS received from that agent as pings and answers them locally 42.

Destinations in session-agent-group are listed in dest, and strategy defaults to Hunt, which selects session agents in listed order 50.

Verify

Suggested check: Check the session agent status on the SBC to confirm all configured agents are in service and reachable.

Rollback

Suggested rollback: Delete the session agent group and the session agents from the SBC.

Step 8 Configure Teams SIP header formatting

Single tenant: the SBC serves one Microsoft 365 organization

Do

Every OPTIONS and INVITE sent to the Microsoft SIP proxy must contain the paired SBC FQDN as the host in the Contact URI with transport=tls, because using an IP address is rejected with 403 Forbidden 19. The Contact FQDN must match the SBC certificate CN or SAN 18. Ensure numbers in the Request-URI and From header include a leading plus sign, and add user=phone to the Request-URI 43.

On Oracle releases from S-Cz8.3.0m1 and later, SIP headers can be formatted using built-in parameters instead of custom manipulation rules 26. Set the hostname under network-interface to the SBC FQDN 58. On the Teams realm-config, enable teams-fqdn-in-uri, which replaces the IP address with the hostname in From and Contact headers and appends the proprietary X-MS-SBC header on the egress realm 58.

Verify

Suggested check: Capture an outgoing SIP OPTIONS packet and confirm that the Contact header contains <sip:sbc-fqdn:port;transport=tls>.

Rollback

Suggested rollback: Disable teams-fqdn-in-uri on the Teams realm.

Carrier multi-tenant: the SBC serves multiple customer organizations

Do

Every OPTIONS and INVITE sent to Microsoft must carry the paired FQDN in the Contact header with transport=tls 19. For user calls, the Contact header must carry the customer's specific subdomain FQDN matching the wildcard certificate, because Direct Routing identifies the tenant from the Contact header rather than the called number 1118. OPTIONS messages require only the base carrier trunk FQDN 14.

Ensure numbers in the Request-URI and From header include a leading plus sign, and add user=phone to the Request-URI 43. Attach any customer-specific Contact header manipulation rules to the Teams SIP interface using out-manipulationid 54.

Verify

Suggested check: Capture an outgoing call INVITE for a customer tenant and verify that the Contact header reflects that customer's registered subdomain FQDN.

Rollback

Suggested rollback: Remove the manipulation rule reference from out-manipulationid on the Teams SIP interface.

Step 9 Configure local call routing policies

Do

Under local-policy, create a routing policy for calls arriving from the PSTN realm with policy-attributes setting next-hop to SAG:<Teams session agent group> and realm to the Teams realm 29. Create a second local-policy matching traffic from the Teams source-realm and directing it to the PSTN next hop and realm 29.

Verify

Suggested check: Review the local-policy table to verify that inbound PSTN traffic maps to the Teams SAG and egress realm, and Teams traffic maps to the PSTN egress realm.

Rollback

Suggested rollback: Delete both local-policy entries from the SBC configuration.

Step 10 Pair the SBC trunk in Microsoft 365

Single tenant: the SBC serves one Microsoft 365 organization

Do

Pair the SBC with Teams by running PowerShell: New-CsOnlinePSTNGateway -Fqdn <SBC FQDN> -SipSignalingPort <port> -MaxConcurrentSessions <n> -Enabled $true 41. Alternatively, navigate to Teams admin center under Voice > Direct Routing > SBCs > Add (GCC High and DoD require PowerShell) 41. Leave SendSipOptions enabled (the default True), because disabling it excludes the SBC from monitoring and alerts 24.

Verify

Run Get-CsOnlinePSTNGateway -Identity <SBC FQDN> and confirm that Enabled returns True 41.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <SBC FQDN> -Enabled $false to take the SBC out of service, or Remove-CsOnlinePSTNGateway -Identity <SBC FQDN> to unpair the SBC entirely 2441.

Carrier multi-tenant: the SBC serves multiple customer organizations

Do

In the carrier tenant only, register the carrier trunk by running: New-CSOnlinePSTNGateway -FQDN <base carrier domain> -SIPSignalingport <port> 14. Do not execute New-CSOnlinePSTNGateway in customer tenants: customer subdomains exist as derived trunks that inherit all settings from the carrier trunk and are not individually registered 14. Leave SendSipOptions enabled on the carrier trunk 24.

Verify

Run Get-CsOnlinePSTNGateway -Identity <base carrier domain> in the carrier tenant and verify Enabled is True 41.

Rollback

Suggested rollback: Remove or disable the carrier trunk in the carrier tenant with Set-CsOnlinePSTNGateway -Identity <base carrier domain> -Enabled $false or Remove-CsOnlinePSTNGateway -Identity <base carrier domain>, noting that this affects all derived trunks simultaneously 14.

Step 11 Configure media bypass on the trunk

Media bypass off: media always routes through Microsoft Media Processors

Do

Leave media bypass disabled on the trunk, as MediaBypass defaults to $false 5. Media will route through Microsoft Media Processors 6.

Verify

Suggested check: Run Get-CsOnlinePSTNGateway -Identity <trunk FQDN> and confirm MediaBypass is False.

Rollback

Suggested rollback: No change is required.

Media bypass on: media routes directly between Teams clients and the SBC where supported

Do

To enable bypass, run: Set-CsOnlinePSTNGateway -Identity <trunk FQDN> -MediaBypass $true 5. In carrier environments, run this against the carrier trunk; derived trunks inherit the setting 14.

To trial media bypass on an active SBC, configure two separate trunks with different FQDNs on the same SBC public IP (one with bypass enabled), using different TLS signaling ports, shared media ports, a certificate covering both names, and a dedicated voice routing policy for test users 8.

Verify

Confirm that calls placed from supported endpoints (standalone Teams desktop clients, Android, iOS, or Teams Phone devices) negotiate direct ICE media candidates with the SBC, while endpoints such as Teams web clients convert to non-bypass automatically 4.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <trunk FQDN> -MediaBypass $false 5.

Step 12 Verify SIP OPTIONS exchange

Do

Monitor SIP traffic on the SBC to observe bidirectional OPTIONS messages 38. Direct Routing automatically transmits incoming OPTIONS to the SBC FQDN advertised in the Contact header of the SBC's outgoing OPTIONS requests 38.

Verify

Confirm that the SBC's outgoing OPTIONS receive 200 OK responses from Microsoft and that the SBC returns 200 OK to Microsoft's incoming OPTIONS 38. Ensure the SBC sends OPTIONS at least once every 3 minutes; an SBC that fails to send OPTIONS within 3 minutes is demoted in routing priority 37. If pairing fails or calls are rejected, inspect the SBC logs rather than Call Analytics, as Direct Routing returns detailed failure descriptions directly to the SBC 30.

Rollback

Suggested rollback: No rollback action is needed for traffic observation.

Step 13 Build voice routes and assign user policies

Single tenant: the SBC serves one Microsoft 365 organization

Do

Configure Direct Routing call routing using PowerShell or the Teams admin center: create a PSTN usage with Set-CsOnlinePstnUsage, create a voice route pointing to the SBC FQDN with New-CsOnlineVoiceRoute, create an online voice routing policy with New-CsOnlineVoiceRoutingPolicy, and assign the policy to users with Grant-CsOnlineVoiceRoutingPolicy 63. Create a custom online voice routing policy rather than modifying the global default policy, preventing Calling Plan or Operator Connect users from inadvertently routing over the Direct Routing trunk 25. Ensure target users have a Teams Phone license and are equipped with a PSTN solution 71.

Verify

Run Get-CsOnlineUser -Identity <user UPN> | select OnlineVoiceRoutingPolicy and confirm the custom policy is assigned 63.

Rollback

Suggested rollback: Remove the voice routing policy assignment from users with Grant-CsOnlineVoiceRoutingPolicy -Identity <user UPN> -PolicyName $null, then delete the voice routing policy, voice route, and PSTN usage.

Carrier multi-tenant: the SBC serves multiple customer organizations

Do

In each customer tenant, add the customer's derived trunk FQDN to a voice route by running Set-CsOnlineVoiceRoute -OnlinePstnGatewayList @{add="<customer subdomain FQDN>"} or navigating in the Teams admin center to Voice > Direct Routing > Voice routes > Add SBCs > Add SBC as derived trunk 14. Configure PSTN usages and voice routing policies in each customer tenant and assign them to users 63. Create all required number translation rules directly within each customer tenant, as translation rules configured on the carrier trunk do not apply to derived trunks 13.

Verify

Confirm that the customer tenant voice route accepts the derived trunk FQDN without rejection 14.

Rollback

Suggested rollback: Remove the derived trunk FQDN from the customer tenant voice route with Set-CsOnlineVoiceRoute -OnlinePstnGatewayList @{remove="<customer subdomain FQDN>"}.

Step 14 Execute acceptance tests

Media bypass off: media always routes through Microsoft Media Processors

Do

Perform validation against Microsoft's checklist: verify healthy SBC trunk status, place inbound PSTN calls, place outbound PSTN calls, verify failover between the Microsoft SIP connection points, and confirm call quality 62. Test call transfers: Direct Routing sends REFER to the SBC only when the SBC lists REFER in its Allow header 45. Decline an inbound test call from Teams and verify the SBC terminates without retrying, as the SBC must not retry a call on a 603 response 1. If a 503 response with a Retry-After header is received, verify the SBC terminates that connection and advances to the next Microsoft datacenter 1.

Verify

Verify bidirectional audio on inbound and outbound calls, and confirm media packets flow between the SBC steering pool and Microsoft Media Processor IP ranges 69.

Rollback

Suggested rollback: Investigate SBC signaling and media logs if call failure or one-way audio occurs.

Media bypass on: media routes directly between Teams clients and the SBC where supported

Do

Execute acceptance testing across all supported client paths: test an internal desktop client (expecting direct media to the SBC public IP) 3, test an external client (expecting media via Transport Relays in 52.112.0.0/14) 7, and test a voice application such as an auto attendant or call queue (expecting Media Processors in the media path) 6.

Test call transfers: transfer without SBC REFER handling is unsupported in media bypass mode, and the SBC must advertise REFER in its Allow header 45. If rtcp-stun is configured, test hold scenarios to confirm the call behaves as expected 48. Decline an inbound call from Teams to confirm the SBC does not retry on a 603 response, and ensure the SBC fails over to the next Microsoft datacenter on a 503 response with Retry-After 1.

Verify

Verify bidirectional audio across direct client, Transport Relay, and Media Processor flows, and confirm audio persists after hold and transfer operations 367.

Rollback

If bypass calls fail, disable media bypass temporarily using Set-CsOnlinePSTNGateway -Identity <trunk FQDN> -MediaBypass $false while reviewing firewall policies and ICE Lite configuration 5.

Applicability

Applies to: Microsoft Teams Phone Direct Routing, Oracle Enterprise Session Border Controller, Oracle Communications Session Border Controller, and Microsoft Teams Phone. Deployments: on-premises, multi-tenant, dod, gcc, and gcc-high. Sources checked 2026-09-30. Supported Oracle SBC platforms include the Oracle AP 1100, AP 3900, AP 4600, AP 6300, AP 6350, VME, AP 3950, AP 4900 and AP 6400 39. Supported Oracle software releases span 9.x and 10.x, with the AP 6300 certified on 9.x only and the AP 6400 certified on 10.x only 40. Direct Routing signaling endpoints apply to Microsoft 365, Office 365, and GCC, as well as dedicated endpoints for GCC High and DoD 70.

What remains uncertain

Specific configuration details contained within Oracle application note PDFs for Microsoft Teams Direct Routing could not be retrieved and are not covered by the sources below. Whether an ice-profile element is required under realm-config when media bypass is disabled is not covered by the sources below. The specific Oracle ESBC header manipulation rule syntax used to emit individual customer subdomain Contact headers in carrier multi-tenant environments is not covered by the sources below.

Sources

1
When the SBC receives a 503 with a Retry-After header in response to an INVITE it must terminate that connection and try the next available Microsoft datacenter, and the SBC must not retry a call on a 603 response.
Teams Phone System Direct Routing: SIP protocol · Retry-After; Handling retries (603 response) · Checked 2026-09-30
2
Oracle's ESBC 9.0.0 Web GUI Configuration Assistant says the Baltimore CyberTrust Root certificate must be installed on the ESBC for secure communication with the Teams Direct Routing service, and its Configure Trusted Certificate step installs it by default.disputed
Web GUI Guide: Configuration Assistant Operations · Microsoft Teams configuration, Step 5 Configure Trusted Certificate · Checked 2026-09-30
3
For direct bypass media, the Teams client must be able to reach the SBC's public IP address, even from the internal network, with client UDP/SRTP ports 50000-50019 to and from SBC-defined ports.
Plan for media bypass with Direct Routing · Requirements for direct media traffic (between the Teams client and the SBC) · Checked 2026-09-30
4
Media bypass is supported on standalone Teams desktop clients, Android and iOS clients and Teams Phone devices; calls on other endpoints such as Teams web clients are converted to non-bypass automatically.
Plan for media bypass with Direct Routing · Client endpoints supported with media bypass · Checked 2026-09-30
5
Media bypass keeps media between the SBC and the Teams client using ICE on the client and ICE Lite on the SBC, signaling still always flows through the Microsoft cloud, and it is switched per SBC with Set-CsOnlinePSTNGateway -MediaBypass $true or $false.
Plan for media bypass with Direct Routing · About media bypass with Direct Routing; Call flow if the user has direct access to the public IP address of the SBC · Checked 2026-09-30
6
Even on a media-bypass trunk, Teams Media Processors stay in the media path for voice applications (Call Park, auto attendants, call queues), web clients, calls escalated from 1:1 to group, calls to federated Teams users and forwards or transfers to Skype for Business users.
Plan for media bypass with Direct Routing · Use of Media Processors and Transport Relays; Use of Teams Media Processors if trunk is configured for media bypass; Requirements for using media processors · Checked 2026-09-30
7
When the client cannot reach the SBC directly, bypass media goes through Teams Transport Relays in 52.112.0.0/14 (commercial), which send from ports 50000-59999 to the SBC and receive from the SBC on 50000-59999 and 3478-3481.
Plan for media bypass with Direct Routing · Requirements for using Transport Relays · Checked 2026-09-30
8
To trial media bypass, Microsoft describes two trunks with different FQDNs on the same SBC and public IP, one with bypass enabled, using different TLS signaling ports but the same media ports, a certificate covering both names (two SANs or a wildcard) and a separate online voice routing policy for test users.
Plan for media bypass with Direct Routing · Configure separate trunks for media bypass and non-media bypass · Checked 2026-09-30
9
Oracle warns that running the ESBC Configuration Assistant removes all existing configuration on the ESBC, including High Availability configuration, which must be reconfigured afterwards.
Web GUI Guide: Configuration Assistant Operations · Configuration Assistant caution · Checked 2026-09-30
10
The base domain in the carrier tenant and each subdomain in a customer tenant must be activated by adding at least one Teams-licensed user or a resource account with a Teams Phone Resource Account license whose UPN uses that exact FQDN.
Configure a Session Border Controller for multiple tenants · Activate the domain name in the carrier tenant; Activate the subdomain name in the customer tenant · Checked 2026-09-30
11
In the multi-tenant (carrier) model, the carrier registers a base domain in its own tenant and gets a wildcard certificate for *.base_domain, and each customer tenant gets a subdomain of it; that subdomain must match both the customer's trunk FQDN and the FQDN the SBC puts in the Contact header, because Direct Routing identifies the tenant from the Contact header.
Configure a Session Border Controller for multiple tenants · Register a base domain and subdomains - Overview · Checked 2026-09-30
12
For the multi-tenant model, the carrier tenant and customer tenants must be in the same cloud, so a carrier tenant in the public cloud cannot serve a GCC High customer tenant.
Configure a Session Border Controller for multiple tenants · Introductory note · Checked 2026-09-30
13
Number translation rules applied to a carrier trunk do not apply to derived trunks, which Microsoft calls a known issue; translation rules must be created in each customer tenant instead.
Configure a Session Border Controller for multiple tenants · Create a trunk and provision users, Note after the examples · Checked 2026-09-30
14
In the current carrier model, the carrier creates one carrier trunk in its own tenant with New-CSOnlinePSTNGateway; customer tenants add the derived trunk FQDN (for example customer.sbc1.base) to voice routes without registering it, derived trunks inherit all carrier-trunk settings including media bypass and port, OPTIONS go only to the carrier trunk FQDN, and the carrier must publish DNS resolving each derived FQDN to the SBC.
Configure a Session Border Controller for multiple tenants · Create a trunk and provision users; Provisioning logic and example · Checked 2026-09-30
15
A Global Administrator adds each customer subdomain in the customer's Microsoft 365 admin center and verifies it with a TXT record created at the carrier's DNS host, then ensures the status reads Setup complete.
Configure a Session Border Controller for multiple tenants · Add a subdomain to the customer tenant and verify it, steps 1-11 · Checked 2026-09-30
16
Microsoft recommends generating the SBC certificate request on the SBC itself; the certificate should carry the SBC FQDN as CN or SAN, be signed by a CA in the Microsoft Trusted Root Program and include the Server Authentication EKU, and RFC 2818 wildcard certificates are supported.
Plan Direct Routing · Public trusted certificate for the SBC · Checked 2026-09-30
17
Microsoft SIP endpoints currently accept SBC certificates that lack the Client Authentication EKU, Microsoft expects this to continue for the foreseeable future, and it says it will announce any change in advance.
What's New Direct Routing · Clarification on Client Authentication Extended Key Usage (EKU) · Checked 2026-09-30
18
The SIP proxy matches the Contact FQDN against the SBC certificate CN/SAN (exact or wildcard), then finds the tenant by looking up the full Contact FQDN as a registered domain and, failing that, the FQDN with its host portion removed; if neither is found the call fails.
Teams Phone System Direct Routing: SIP protocol · Processing the incoming request: finding the tenant and user, steps 1-3 · Checked 2026-09-30
19
Every OPTIONS and INVITE sent to the Microsoft SIP proxy must carry the paired SBC FQDN as the Contact URI host with transport=tls; a Contact whose host is an IP address is refused with 403 Forbidden.
Teams Phone System Direct Routing: SIP protocol · Detailed requirements for Contact header and Request-URI, Contact header · Checked 2026-09-30
20
The Teams-related parameters documented in Oracle's Session Border Controller 9.3.0 ACLI reference (realm-config Teams parameters, session-agent ping-response, ice-profile) probably exist under the same names on the Enterprise SBC, because the ESBC 8.3.0m1 release notes introduce the same session-agent and realm-config parameters for the E-SBC.inferred
Release Notes: New Features in S-Cz8.3.0m1 · SIP Header Automation for Microsoft Teams, read against oracle-docs-ocsbc-930-realm-config and oracle-docs-ocsbc-930-session-agent · Checked 2026-09-30
21
An SBC can be connected to Direct Routing only if the domain portion of its FQDN matches a domain registered in the tenant other than *.onmicrosoft.com, and a subdomain used in the FQDN must itself be registered in the tenant.
Connect your Session Border Controller (SBC) to Direct Routing · Use the Microsoft Teams admin center, step 3; Connect the SBC to the tenant, Considerations · Checked 2026-09-30
22
Besides registering the SBC's domain, the tenant needs a user in that domain with an E3 or E5 license, and the domain's authentication type must be Managed; otherwise pairing fails with an error that the domain was not configured for the tenant.
Connect your Session Border Controller (SBC) to Direct Routing · Connect the SBC to the tenant, Considerations, second and third bullets · Checked 2026-09-30
23
Microsoft grants Direct Routing certification to specific SBC firmware versions and supports firmware higher than the documented version only while the major.minor version stays the same.
Session Border Controllers certified for Direct Routing - Microsoft Teams · Introductory note above the Certified SBC vendors table · Checked 2026-09-30
24
Online PSTN gateway settings include Enabled (default False), SipSignalingPort (required), SendSipOptions (default True; turning it off excludes the SBC from monitoring and alerts), MaxConcurrentSessions (alerts at 90 percent), FailoverResponseCodes (default 408, 503, 504) and FailoverTimeSeconds (default 10).
Connect your Session Border Controller (SBC) to Direct Routing · SBC settings table · Checked 2026-09-30
25
Configuring the global (org-wide default) online voice routing policy applies it to every voice-enabled user, which can send Calling Plan and Operator Connect users' PSTN calls to a Direct Routing trunk; Microsoft advises custom policies assigned per user instead.
Configure call routing for Direct Routing · Voice routing policy considerations, Caution item 1 · Checked 2026-09-30
26
Since ESBC S-Cz8.3.0m1, the E-SBC can format SIP headers the way Microsoft Teams requires through built-in parameters (session-agent ping-response and realm-config Teams parameters) instead of custom header manipulation rules.
Release Notes: New Features in S-Cz8.3.0m1 · SIP Header Automation for Microsoft Teams · Checked 2026-09-30
27
The Oracle ice-profile (media-manager > ice-profile) sets stun-conn-timeout (default 10 s), stun-keepalive-interval (default 15 s), stun-rate-limit (default 100 per minute), rtcp-stun (default disabled) and a mode parameter described for Teams media path optimization with values None, DOWNSTREAM and PROXY.
ACLI Reference Guide: ice-profile · ice-profile parameters and path · Checked 2026-09-30
28
New-CsOnlinePSTNGateway has an IPAddressVersion option (IPv4 or IPv6); with IPv6 the SBC must use IPv6 for both signaling and media, and Microsoft does not support media bypass with IPv6 SIP, IPv6 media or the IPv6 Teams client, nor mixed IPv4/IPv6 SIP and media.
Connect your Session Border Controller (SBC) to Direct Routing · Connect the SBC to the tenant, Considerations, IPAddressVersion bullet · Checked 2026-09-30
29
An Oracle local-policy matches on from-address, to-address and source-realm, and its policy-attributes set a next-hop (which may be a session agent group written SAG:<name>) and an egress realm.
ACLI Reference Guide: local-policy · local-policy parameters; policy-attributes next-hop and realm · Checked 2026-09-30
30
Call Analytics only helps once calls reach Direct Routing's internal components; for pairing failures or rejected INVITEs such as a misconfigured trunk FQDN, Microsoft says to read the SBC logs, where Direct Routing sends detailed descriptions.
Monitor Direct Routing · Monitor Call Quality Analytics dashboard and SBC logs · Checked 2026-09-30
31
Microsoft Teams SIP interface certificates chain to one of seven roots (DigiCert Global Root CA, DigiCert Global Root G2, DigiCert Global Root G3, DigiCert TLS ECC P384 Root G5, DigiCert TLS RSA 4096 Root G5, Microsoft ECC Root Certificate Authority 2017, Microsoft RSA Root Certificate Authority 2017), and SBCs must trust all of them for both client and server certificates.
What's New Direct Routing · Update on upcoming certificate changes (December 12, 2025), Changes and call to action and Summary · Checked 2026-09-30
32
With media-sec-policy pass-through disabled (the default), the Oracle SBC blocks end-to-end security negotiation and terminates the SRTP session with each endpoint itself; enabled, it lets the endpoints negotiate directly and only relays SRTP.
ACLI Reference Guide: media-sec-policy · media-sec-policy notes: pass-through mode · Checked 2026-09-30
33
Microsoft's planning page says that if mutual TLS is enabled, all required Microsoft Trusted Root certificates must be installed on the SBC.
Plan Direct Routing · Public trusted certificate for the SBC, final paragraph · Checked 2026-09-30
34
Microsoft states that certificates from a new CA were rolled out on Direct Routing SIP endpoints in production at the end of July 2026, that the sip.g1.pstnhub.microsoft.com test endpoint is discontinued, and that SBCs failing outbound TLS or rejecting inbound connections during rollout point to trust issues with the new certificate.
What's New Direct Routing · Testing endpoint for upcoming certificate changes (February 16, 2026) warning; Validation test entry (June 30, 2026) · Checked 2026-09-30
35
Microsoft does not support mapping multiple IP addresses to the same FQDN on the SBC side.
Connect your Session Border Controller (SBC) to Direct Routing · Connect the SBC to the tenant, Considerations, fourth bullet · Checked 2026-09-30
36
Microsoft states that SBC SIP OPTIONS pings must not exceed one transaction every 60 seconds per configured trunk per endpoint, and the same sentence also sets a 180-second bound that it does not word clearly.
Connect your Session Border Controller (SBC) to Direct Routing · Connect the SBC to the tenant, Considerations, SIP OPTIONS bullet · Checked 2026-09-30
37
Direct Routing considers an SBC healthy if it sent SIP OPTIONS within the last three minutes (three one-minute intervals); an SBC that did not is demoted and tried only after the other SBCs in the route, and equal healthy SBCs get calls distributed by Fisher-Yates shuffle.
Monitor Direct Routing · Monitoring availability of Session Border Controllers using SIP options messages · Checked 2026-09-30
38
To validate pairing, Microsoft says to confirm on the SBC that its outgoing OPTIONS get 200 OK and that it answers Direct Routing's incoming OPTIONS with 200 OK; Direct Routing starts sending OPTIONS to the SBC FQDN from the Contact header of the OPTIONS it received.
Connect your Session Border Controller (SBC) to Direct Routing · Verify the SBC connection, Validate SIP options · Checked 2026-09-30
39
Microsoft's certified-SBC list for Direct Routing includes the Oracle AP 1100, AP 3900, AP 4600, AP 6300, AP 6350, VME, AP 3950, AP 4900 and AP 6400, each marked as certified for both non-media-bypass and media bypass and as 911 service provider and ELIN capable.
Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Oracle rows · Checked 2026-09-30
40
Microsoft lists Oracle SBC software 9.x and 10.x as supported for Direct Routing on most Oracle platforms, with the AP 6300 listed for 9.x only and the AP 6400 for 10.x only, and recommends the latest version.
Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Oracle rows, Software version column · Checked 2026-09-30
41
An SBC is paired with New-CsOnlinePSTNGateway -Fqdn <FQDN> -SipSignalingPort <port> -MaxConcurrentSessions <n> -Enabled $true, or in the Teams admin center under Voice > Direct Routing > SBCs > Add (not available in GCC High and DoD, where PowerShell is required), and Get-CsOnlinePSTNGateway should then show Enabled True.
Connect your Session Border Controller (SBC) to Direct Routing · Use the Microsoft Teams admin center; Connect the SBC to the tenant; Check whether the SBC is on the list of paired SBCs · Checked 2026-09-30
42
The Oracle session-agent parameter ping-response (default disabled), used for Teams deployments, makes the SBC treat OPTIONS received from that agent as pings and answer them locally.
ACLI Reference Guide: session-agent · session-agent parameters: ping-response · Checked 2026-09-30
43
For calls into Teams, the phone numbers in the Request-URI and From header must include a leading plus sign, and Microsoft recommends always adding user=phone to the Request-URI.
Teams Phone System Direct Routing: SIP protocol · Request-URI; From Header; Use of Request-URI parameter user=phone · Checked 2026-09-30
44
An Oracle realm-config is bound to exactly one network-interface and refers by name to its media-sec-policy, ice-profile and codec-policy; its rtcp-mux parameter defaults to disabled.
ACLI Reference Guide: realm-config · realm-config parameters: network-interface, media-sec-policy, ice-profile, codec-policy, rtcp-mux · Checked 2026-09-30
45
The Direct Routing SIP proxy sends REFER to the SBC (acting as transferor) only when the SBC lists REFER in its Allow header; this is the preferred method, it is mandatory for media bypass certification, and call transfer without SBC REFER handling is not supported in media bypass mode.
Teams Phone System Direct Routing: SIP protocol · Call transfer; SIP proxy send the Refer to the SBC and acts as a Transferor · Checked 2026-09-30
46
Microsoft's SIP protocol page tells administrators to make sure the SBC does not use Replaces headers in SIP requests, because Direct Routing rejects SIP requests that carry them.disputed
Teams Phone System Direct Routing: SIP protocol · Processing the incoming request: finding the tenant and user, Note, third bullet · Checked 2026-09-30
47
Microsoft's SIP protocol page states that the SBC must support Invite with Replaces.disputed
Teams Phone System Direct Routing: SIP protocol · Replaces option · Checked 2026-09-30
48
Oracle's rtcp-stun feature for ICE-lite requires rtcp-mux disabled on both call realms, is mutually exclusive with hnt-rtcp, does not support Teams-to-Teams scenarios and does not support two Microsoft Teams hold scenarios where RTP and RTCP flow asymmetrically.
Configuration Guide: Additional STUN Candidate for RTCP · Additional STUN Candidate for RTCP, limitations list · Checked 2026-09-30
49
An Oracle session-agent takes a hostname (FQDN or IP), a port (default 5060), a transport-method (default UDP; StaticTLS keeps a persistent TLS connection), a realm-id, a ping-method such as OPTIONS and a ping-interval in seconds (default 0).
ACLI Reference Guide: session-agent · session-agent parameters: hostname, port, transport-method, realm-id, ping-method, ping-interval · Checked 2026-09-30
50
An Oracle session-agent-group lists destinations in dest, and its strategy defaults to Hunt, which selects session agents in the listed order; RoundRobin, LeastBusy, PropDist and LowSusRate are the alternatives.
ACLI Reference Guide: session-agent-group · session-agent-group parameters: strategy, dest · Checked 2026-09-30
51
The Oracle sdes-profile (security > media-security > sdes-profile) sets the SRTP crypto-list, and AES_CM_128_HMAC_SHA1_80 is supported on every listed Acme Packet platform and on virtual platforms; srtp-encrypt and srtcp-encrypt default to enabled.
ACLI Reference Guide: sdes-profile · sdes-profile parameters; Supported Ciphers · Checked 2026-09-30
52
Oracle's ESBC S-Cz8.3.0m1 release notes name the Teams realm-config parameter sdp-active-only.disputed
Release Notes: New Features in S-Cz8.3.0m1 · SIP Header Automation for Microsoft Teams, parameter list · Checked 2026-09-30
53
Oracle's 9.3.0 ACLI reference names a realm-config parameter sdp-inactive-only (default disabled) that rewrites sendonly and recvonly to inactive in outgoing SDP for Teams deployments and does the reverse in incoming SDP.disputed
ACLI Reference Guide: realm-config · realm-config parameters: sdp-inactive-only · Checked 2026-09-30
54
An Oracle sip-interface applies SIP header manipulation rules to traffic entering through it via in-manipulationid and to traffic leaving through it via out-manipulationid.
ACLI Reference Guide: sip-interface · sip-interface parameters: in-manipulationid, out-manipulationid · Checked 2026-09-30
55
An Oracle sip-interface listens through sip-ports entries (session-router > sip-interface > sip-ports), each with an address, a port (default 5060), a transport-protocol (default UDP; TCP, UDP, TLS or SCTP), a tls-profile reference (default none) and allow-anonymous (default all; agents-only is one of the other values).
ACLI Reference Guide: sip-interface > sip-ports · sip-ports parameters: address, port, transport-protocol, tls-profile, allow-anonymous; Path · Checked 2026-09-30
56
An Oracle steering-pool (media-manager > steering-pool) defines the media port range for a realm through ip-address, start-port, end-port and realm-id, and the combination of ip-address, start-port and realm-id must be unique.
ACLI Reference Guide: steering-pool · steering-pool parameters and uniqueness constraint · Checked 2026-09-30
57
Microsoft's example Direct Routing SDP offer to the SBC uses RTP/SAVP with an a=crypto line of AES_CM_128_HMAC_SHA1_80, and Microsoft lists TCP/RTP/SAVP and UDP/RTP/SAVP as Direct Routing media transports.
What's New Direct Routing · AMR-WB is enabled for Direct Routing trunks on non bypass calls, Before/After SDP examples · Checked 2026-09-30
58
The Oracle realm-config parameter teams-fqdn-in-uri (default disabled) replaces the IP address with an FQDN in the From and Contact headers of SIP requests for Teams, uses the hostname configured under network-interface, and also makes the SBC send the proprietary X-MS-SBC header on the egress realm.
ACLI Reference Guide: realm-config · realm-config parameters: teams-fqdn-in-uri · Checked 2026-09-30
59
On the Oracle SBC, the tls-profile element (security > tls-profile) names an end-entity-certificate and trusted-ca-certificates records and has mutual-authenticate (default disabled) and tls-version (default tlsv13; values tlsv12, tlsv13, compatibility), where compatibility negotiates down from the highest version.
ACLI Reference Guide: tls-profile · tls-profile parameters: end-entity-certificate, trusted-ca-certificates, mutual-authenticate, tls-version · Checked 2026-09-30
60
Because Microsoft forces TLS 1.2 on the Direct Routing SIP interface and Oracle's tls-profile defaults to tlsv13, the Teams-facing tls-profile probably needs tls-version set to tlsv12 or compatibility for the TLS session to establish.inferred
ACLI Reference Guide: tls-profile · tls-version parameter, read together with ms-learn-dr-connect-sbc Considerations TLS1.2 bullet · Checked 2026-09-30
61
Microsoft forces TLS 1.2 on the Direct Routing SIP interface and requires the SBC to connect with one of four cipher suites: ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-SHA384 or ECDHE-RSA-AES128-SHA256.
Connect your Session Border Controller (SBC) to Direct Routing · Connect the SBC to the tenant, Considerations, TLS1.2 bullet · Checked 2026-09-30
62
Microsoft's post-configuration checklist is: SBC shows a healthy connection, inbound and outbound PSTN calls work, emergency calling works if configured, failover between SIP connection points works, voice routing policies are assigned correctly and call quality is acceptable.
Plan Direct Routing · Verify your deployment · Checked 2026-09-30
63
Direct Routing call routing uses PSTN usages, voice routes (number pattern plus online PSTN gateway list) and online voice routing policies, built with Set-CsOnlinePstnUsage, New-CsOnlineVoiceRoute, New-CsOnlineVoiceRoutingPolicy and assigned with Grant-CsOnlineVoiceRoutingPolicy.
Configure call routing for Direct Routing · Call routing overview; Example 1 Using PowerShell steps 1-4 · Checked 2026-09-30
64
Microsoft describes Teams Phone as its technology for call control and PBX capabilities delivered in the Microsoft 365 cloud.
What is Teams Phone · What is Teams Phone, opening paragraph · Checked 2026-09-24
65
Direct Routing lets an organization use any PSTN operator by connecting it through a certified SBC that is procured, installed and managed by the customer, an integrator or a Direct-Routing-as-a-Service provider.
PSTN connectivity options · PSTN connectivity options, bullet 'Direct Routing' · Checked 2026-09-24
66
Direct Routing requires a Microsoft-certified SBC, PSTN trunks to it, users homed online, a public IP, an SBC FQDN in a verified tenant domain (not *.onmicrosoft.com) with public DNS, and a publicly trusted TLS certificate.
Plan Direct Routing · Plan Direct Routing, section 'Infrastructure requirements' table and section 'SBC domain names' · Checked 2026-09-24
67
Microsoft supports Teams Phone with Direct Routing only when certified SBCs are used, expects the SBC vendor to investigate first and escalate, and may decline support requests involving non-certified SBCs.
Plan Direct Routing · Plan Direct Routing, sections 'Supported Session Border Controllers (SBCs)' and 'Support boundaries' · Checked 2026-09-24
68
Direct Routing is not supported in Islands coexistence mode.
Plan Direct Routing · Plan Direct Routing, section 'Licensing requirements', Note · Checked 2026-09-24
69
Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP ports 3478-3481 and 49152-53247 in both directions, and Microsoft recommends at least two media ports per concurrent call on the SBC.
Plan Direct Routing · Plan Direct Routing, section 'Media ports' table and Tip · Checked 2026-09-24
70
For Microsoft 365, Office 365 and GCC, the SBC connects to sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com in priority order over SIP/TLS to port 5061; GCC High uses sip.pstnhub.gov.teams.microsoft.us and DoD uses sip.pstnhub.dod.teams.microsoft.us.
Plan Direct Routing · Plan Direct Routing, sections 'SIP signaling: FQDNs', 'SIP signaling: GCC High', 'SIP signaling: DoD', 'SIP signaling ports' · Checked 2026-09-24
71
To use PSTN telephony with Teams Phone, a user account must be licensed with the Teams Phone application and also be equipped with a PSTN solution from a PSTN service provider.
PSTN connectivity options · PSTN connectivity options, section 'What is the Public Switched Telephone Network (PSTN)?' · Checked 2026-09-24

Documents

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, September 30). Setting up an Oracle SBC for Teams Direct Routing. WarmTransfer. https://warmtransfer.net/guides/oracle-sbc-teams-direct-routing-setup

BibTeX

@misc{warmtransfer-oracle-sbc-teams-direct-routing-setup,
  title  = {Setting up an Oracle SBC for Teams Direct Routing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/oracle-sbc-teams-direct-routing-setup},
  note   = {Verified 2026-09-30}
}