Survivable Branch Appliance for Direct Routing

Publisher

Microsoft (Microsoft Learn)

URL

https://learn.microsoft.com/en-us/microsoftteams/direct-routing-survivable-branch-appliance

Published

2026-04-27

Updated

unknown

Accessed

2026-09-06

HTTP status

200

License

Microsoft Learn documentation under Microsoft site terms; short excerpts and locators only

Source notes citing this source

• If a tenant uses Continuous Access Evaluation tokens, the SBA is operational for only about 30 minutes; otherwise the SBA supports expired client authentication tokens for up to seven days from expiry. in context
• The SBA feature is supported on Teams Windows desktop, Teams macOS desktop and Teams Phones; SBA mode activates only on desktop clients on a physical machine, and virtual machines and web clients are not supported. in context
• In SBA offline mode, an incoming PSTN call to a call queue or auto attendant number can be redirected to a local agent or to an alternative call queue or auto attendant number. in context
• In SBA mode, Teams users can still make emergency calls but location information is not shared, and the SBA does not support Emergency Call Routing Policies, so emergency calls fail through the SBA if no pattern in the regular voice routing policy matches the emergency dial strings. in context
• With a Direct Routing Survivable Branch Appliance, during an internet outage the Teams client automatically switches to the SBA and ongoing calls continue without interruption; users can make and receive PSTN calls through the local SBA/SBC. in context
• If the tenant uses Continuous Access Evaluation tokens, the SBA is operational only for about 30 minutes because of the nature of continuous access evaluation, and an alternative is to disable CAE for the tenant. in context
• SBA is supported on Teams Windows desktop, Teams macOS desktop and Teams Phones, and SBA mode activates only on desktop clients on a physical machine - VMs and web clients are not supported. in context
• All Direct Routing SBA configuration is done with Teams PowerShell cmdlets - New-CsTeamsSurvivableBranchAppliance, New-CsTeamsSurvivableBranchAppliancePolicy, Set-CsTeamsSurvivableBranchAppliancePolicy and Grant-CsTeamsSurvivableBranchAppliancePolicy - plus an application registered in Microsoft Entra ID, and the Teams admin center does not yet support the feature. in context
• The Survivable Branch Appliance is distributable code provided by Microsoft to SBC vendors, who embed it in firmware or distribute it separately to run on a separate VM or hardware. in context
• In SBA mode, sharing location information during an emergency call is not supported: users can still make the emergency call but location information will not be shared, and the only UI indicator that the client has switched to Appliance mode is a banner. in context
• SBA does not support Emergency Call Routing Policies; EMER dial strings bypass normalization and are always sent without a leading plus, so if the customer has no pattern in their regular voice routing policy matching the EMER dial strings, emergency calls fail via SBA. in context
• While offline in SBA mode, a Teams client can make and receive PSTN calls through the local SBA and SBC, hold and resume, blind transfer, forward calls to a single number or Teams user, redirect an incoming PSTN call to a call queue or auto attendant number, fall back to PSTN when a VoIP call cannot be initiated, and make VoIP calls between two users registered behind the same SBA. in context
• SBA prerequisites include the SBC being configured for Media Bypass, TLS 1.2 enabled on the SBA VM OS, and firewall openings for ports 3443, 4444 and 8443 (SBA server to Teams client), port 5061 (SBA server to SBC), UDP 123 for NTP and port 443 for Microsoft 365. in context
• SBA mode is supported on the Teams Windows and macOS desktop clients and on Teams Phones, and only on desktop clients running on a physical machine; VMs and web clients are not supported. in context
• In SBA mode, emergency calls can still be placed but location information is not shared, and SBA does not support emergency call routing policies; emergency dial strings bypass normalization, so they fail unless the regular voice routing policy has a matching pattern. in context
• SBA configuration (creating SBAs, creating and assigning the branch survivability policy, and registering an Entra ID application) is done only with Teams PowerShell; the Teams admin center does not yet support the feature. in context
• A Survivable Branch Appliance is Microsoft-supplied code distributed through SBC vendors, and it requires the SBC to be configured for media bypass so branch Teams clients can exchange media directly with the SBC. in context
• SBA accepts expired client authentication tokens for up to 7 days, cannot validate a client that has not connected to it in the last 24 hours, and stays operational for only about 30 minutes if the tenant uses Continuous Access Evaluation tokens. in context
• A banner in the Teams client is the only sign that it has switched to SBA (Appliance) mode. If no banner shows, the user is not in SBA mode and calling will not work. in context
• If the tenant uses Continuous Access Evaluation tokens, the SBA works for only about 30 minutes. Microsoft's alternative is to disable CAE for the tenant. in context
• SBA is supported on the Teams Windows desktop client, the Teams macOS desktop client and Teams Phones. in context
• SBA configuration runs in this order: create the SBAs, create the Teams branch survivability policy, assign the policy to users, then register an SBA application in Microsoft Entra ID. in context
• In SBA mode users can still place emergency calls, but no location information is shared with the call. in context
• The Teams client falls back to normal mode once it detects the internet is back and any outgoing calls have ended. The SBA then uploads its collected call data records to the cloud. in context
• The SBA requires the SBC to use Media Bypass, so the branch Teams client exchanges media directly with the SBC. in context
• SBA does not support Emergency Call Routing Policies. Emergency dial strings skip normalization and are sent without a leading +, so emergency calls through the SBA fail unless the regular voice routing policy has a matching pattern. in context
• SBA mode activates only on desktop clients running on a physical machine; VMs and web clients are not supported. in context
• In SBA mode a Teams client can make and receive PSTN calls through the local SBC, hold and resume, blind transfer, forward to a single number or Teams user, redirect PSTN calls meant for call queues or auto attendants, use VoIP fallback, and call other local users behind the same SBA. in context
• Direct Routing SBA is configured only through Teams PowerShell cmdlets; the Teams admin center does not yet support it. in context
• In SBA mode, expired client authentication tokens are accepted for up to 7 days. A client that must negotiate a new token (for example after a restart) cannot connect to the SBA, and neither can one that has not connected to that SBA in the last 24 hours. in context
• The Teams Survivable Branch Appliance is code that Microsoft gives to SBC vendors, who embed it in SBC firmware or ship it separately to run on its own VM or hardware. in context
• If the tenant uses Continuous Access Evaluation tokens, SBA stays operational for only about 30 minutes. Separately, SBA accepts expired client tokens for up to 7 days, and a client that restarts during an outage can't connect to the SBA. in context
• SBA mode is supported on the Teams Windows and macOS desktop clients and on Teams Phones, and it activates only on desktop clients running on a physical machine. VMs and web clients aren't supported. in context
• In SBA mode, emergency calls don't share location information and Emergency Call Routing Policies aren't supported. Emergency calls fail unless the regular voice routing policy has a pattern matching the emergency dial strings, which are sent without a plus sign. in context
• A Direct Routing Survivable Branch Appliance requires the SBC to be configured for media bypass. SBA code is supplied by Microsoft to SBC vendors, who embed it in their firmware or ship it separately. in context
• The Teams client moves to the SBA only when two conditions hold: the user is assigned a branch survivability policy for an SBA that is up, and the internet is disconnected while the user's device can still reach the SBA. in context
• The SBA application's API permission is 'Skype and Teams Tenant Admin Access' > Application permissions > application_access_custom_sba_appliance. in context
• The SBA application is registered with supported account types set to accounts in this organizational directory only, a Web redirect URI of https://login.microsoftonline.com/common/oauth2/nativeclient, and implicit grant enabled for both access tokens and ID tokens; its name is free choice. in context
• Microsoft orders the application registration as: register the application, set the implicit grant tokens, set the API permissions, create the client secret. in context
• The SBA registration needs two values produced by the Entra application registration: the Application (client) ID, shown on the application's Overview tab, and a client secret. in context
• During an internet outage the Teams client switches to the SBA automatically, ongoing calls continue without interruption, and the user does not need to take any action. in context
• The SBA prerequisites require Azure IP Ranges and Service Tags for the Public Cloud to be defined following Microsoft's published download (download id 56519). in context
• When the Teams client switches to Appliance mode it shows a banner, and that banner is the only UI indicator: if the banner is absent the user is not in SBA mode and calling will not work. in context
• During an internet outage the Teams desktop client can reconnect to the SBA with locally cached authentication information even after a client restart or machine reboot, provided that information was cached before the outage and is still within the supported SBA authentication period. in context
• For tenants using Continuous Access Evaluation tokens, Microsoft names disabling CAE for the tenant as an alternative to the roughly 30-minute SBA operating window. in context
• After connectivity returns, the SBA uploads the Call Data Records it collected to the cloud and call history is updated for review by the tenant administrator. in context
• The Microsoft SBA Server communicates with the Teams client on ports 3443, 4444 and 8443, which must be allowed on the firewall. in context
• Microsoft lists the tenant-side SBA configuration as four steps: create the SBAs, create the Teams branch survivability policy, assign the policy to users, and register an application for the SBA with Microsoft Entra ID. in context
• A failover test consistent with Microsoft's description is to cut the branch's internet path while leaving the client's LAN path to the SBA intact, confirm the SBA banner appears in a desktop client that connected to the SBA within the previous 24 hours, place and receive a PSTN call, then restore the internet and confirm the client returns to normal mode. inferred in context
• Once the Teams client detects that the internet is back and any outgoing calls have finished, it falls back to normal operation mode and reconnects to other Teams services. in context
• SBC vendors either embed the Microsoft-provided SBA code in their SBC firmware or distribute it separately so the SBA runs on a separate VM or hardware, and the customer obtains the latest firmware with the embedded SBA from the SBC vendor. in context
• A branch survivability policy is removed from a user by granting the $Null policy: Grant-CsTeamsSurvivableBranchAppliancePolicy -PolicyName $Null -Identity <user>. in context
• A branch survivability policy is assigned to an individual user with Grant-CsTeamsSurvivableBranchAppliancePolicy -PolicyName <policy> -Identity <user>. in context
• The Microsoft SBA Server uses port 443 to communicate with Microsoft 365, and that port must be allowed on the firewall. in context
• An SBA object is created in the tenant with New-CsTeamsSurvivableBranchAppliance, for example with -Fqdn sba1.contoso.com and -Description, and the resulting Identity equals the FQDN. in context
• After new Survivable Branch Appliances are added, it might take time before they can be used in Survivable Branch Appliance policies. in context
• A site whose users reach the PSTN SBC only across the same internet or WAN link that fails gains nothing from an SBA, because SBA mode depends on the client still reaching the SBA and on the SBA/SBC still reaching the PSTN locally during the outage. inferred in context
• In SBA mode other Teams users cannot be reached by reverse number lookup against Microsoft Entra ID contacts; a dialed number is still processed by the SBA and routed over the PSTN. in context
• In SBA mode a user cannot switch their Teams client to another tenant. in context
• The Microsoft SBA Server uses UDP port 123 to reach an NTP server, and that port must be allowed on the firewall. in context
• In offline mode an incoming PSTN call to a call queue or auto attendant number can be redirected to a local agent or to an alternative call queue or auto attendant number. in context
• In offline mode the Teams client can make and receive PSTN calls through the local SBA/SBC with media through the SBC, hold and resume PSTN calls, blind transfer, and forward calls (always or when unanswered) to a single phone number or Teams user. in context
• In offline mode two users registered behind the same SBA can place a VoIP call to each other that the SBA supports, and if a VoIP call cannot be initiated and the called party has a PSTN number a PSTN call is attempted instead. in context
• Only one Microsoft Entra ID application needs to be registered for use by all the SBAs in a tenant; the registration lets the SBAs read required data from Microsoft 365. in context
• Microsoft frames the SBA for the case where a branch temporarily cannot reach the Microsoft cloud through Direct Routing while the intranet inside the branch still works and users can still connect to the SBC that provides PSTN connectivity. in context
• SBAs are added to or removed from an existing policy with Set-CsTeamsSurvivableBranchAppliancePolicy using -BranchApplianceFqdns @{add="..."} or @{remove="..."}. in context
• A branch survivability policy is created with New-CsTeamsSurvivableBranchAppliancePolicy, taking an -Identity and -BranchApplianceFqdns, and one policy can contain one or more SBAs. in context
• After a Survivable Branch Appliance policy is assigned to a user, it might take time before the SBA is shown in the output of Get-CsOnlineUser. in context
• SBA issues are reported to the SBC vendor's support organization, and the report should state that a Survivable Branch Appliance is configured. in context
• The Microsoft SBA Server communicates with the SBC on port 5061, or whichever port is configured on the SBC, and that port must be allowed on the firewall. in context
• The client secret for the SBA application may use any description and expiration, and it should be copied immediately after it is created. in context
• TLS 1.2 must be enabled on the operating system of the SBA VM. in context
• For step-by-step configuration of the SBC with the embedded SBA, Microsoft defers to SBC vendor documentation and links to four vendors: AudioCodes, Ribbon, Oracle and TE-Systems. in context
• Microsoft states that a tenant using Continuous Access Evaluation tokens may have only about 30 minutes of SBA operation. in context
• In SBA mode web and virtual-machine clients are unsupported emergency location information is not shared and Teams Emergency Call Routing Policies are unsupported. in context
• The Direct Routing SBA requires Media Bypass TLS 1.2 and firewall access for its documented client SBC NTP and Microsoft 365 communication ports. in context
• A Direct Routing Survivable Branch Appliance supports local PSTN calling during a Microsoft-cloud connectivity outage when the branch intranet and SBC remain reachable. in context
• The only UI sign that a Teams client has switched to SBA (Appliance) mode is a banner; if the banner is absent the user is not in SBA mode and calling will not work. in context
• If the tenant uses Continuous Access Evaluation tokens, the SBA works for only about 30 minutes; Microsoft suggests disabling CAE for the tenant as an alternative. in context
• SBA mode works only on the Teams Windows and macOS desktop clients on physical machines and on Teams Phones; VMs and web clients are not supported. in context
• SBA configuration is PowerShell-only (not in the Teams admin center): create the SBAs, create a branch survivability policy, assign it to users, and register one Microsoft Entra ID application for all the tenant's SBAs. in context
• In SBA mode, emergency calls can be placed but location is not shared, and the SBA ignores Emergency Call Routing Policies and sends emergency dial strings without a plus sign, so emergency calls fail unless the regular voice routing policy has a matching pattern. in context
• A Teams client returns from SBA mode to normal operation once it detects the internet is back and any outgoing calls have finished, and the SBA then uploads collected call data records to the cloud. in context
• In SBA mode Teams clients can make and receive PSTN calls through the local SBC, hold and resume, blind transfer, forward to a single number or Teams user, redirect call queue or auto attendant numbers to a local agent or alternative number, use VoIP fallback to PSTN, and call local users over VoIP. in context
• The Teams Survivable Branch Appliance keeps PSTN calling working at a Direct Routing branch that has lost connectivity to the Microsoft cloud but can still reach its SBC over the local network. in context
• In SBA mode, expired client tokens are accepted for up to 7 days, but a client that restarts or has to negotiate a new token cannot connect, and a client cannot validate against an SBA it has not connected to in the last 24 hours. in context
• Microsoft supplies the SBA as distributable code to SBC vendors, who embed it in SBC firmware or ship it separately to run on a VM or hardware; the SBC must be configured for media bypass. in context
• Active-call behaviour at failover differs as documented: Microsoft says ongoing calls continue when Teams switches to the SBA, while Zoom says active calls are dropped when clients fail over to ZPLS. inferred in context
• Across Teams Phone, Webex Calling and Zoom Phone, documented site survivability depends on an on-premises component plus a locally terminated PSTN trunk; cloud-only carrier options such as Teams Calling Plan, Cisco PSTN or Zoom Native numbers do not by themselves give PSTN service during a site outage. inferred in context
• If the tenant uses Continuous Access Evaluation tokens, the Teams SBA is operational for only about 30 minutes; Microsoft gives disabling CAE for the tenant as an alternative. in context
• In Teams SBA mode emergency calls can be placed but location information is not shared, and Emergency Call Routing Policies are not supported, so emergency calls fail unless the voice routing policy matches the emergency dial strings. in context
• The Teams SBA requires the SBC to be configured for media bypass so the branch Teams client can send media directly to the SBC. in context
• Microsoft states that during an internet outage the Teams client switches to the SBA automatically and ongoing calls continue without interruption. in context
• In Teams SBA mode users can make and receive PSTN calls through the local SBC, hold and resume, blind transfer, forward to a single number or Teams user, and redirect call queue or auto attendant calls to a local agent or alternative number. in context
• Teams SBA configuration (appliances, branch survivability policy, user assignment) is done with Teams PowerShell cmdlets; the Teams admin center does not yet support the Direct Routing SBA feature. in context
• SBA mode is supported on the Teams Windows desktop client, the Teams macOS desktop client and Teams Phones; it activates only on physical machines, and virtual machines and web clients are not supported. in context
• The Teams Survivable Branch Appliance is Microsoft code distributed to SBC vendors, who embed it in SBC firmware or ship it to run on a separate VM or hardware, for Direct Routing branch sites. in context

Cite this source record

APA

WarmTransfer. (2026, April 27). Survivable Branch Appliance for Direct Routing. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-learn-direct-routing-sba

BibTeX

@misc{warmtransfer-ms-learn-direct-routing-sba,
  title  = {Survivable Branch Appliance for Direct Routing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-learn-direct-routing-sba},
  note   = {Microsoft (Microsoft Learn), accessed 2026-09-06}
}