Connect your Session Border Controller (SBC) to Direct Routing

Publisher

Microsoft

URL

https://learn.microsoft.com/en-us/microsoftteams/direct-routing-connect-the-sbc

Published

2026-04-26

Updated

unknown

Accessed

2026-09-21

HTTP status

200

License

Microsoft Learn terms of use; no-redistribution; short excerpts and locators only

Source notes citing this source

• Microsoft's Connect-the-SBC page says SIP OPTIONS pings must not be sent more often than one transaction every 60 seconds per configured trunk per endpoint; the page's companion 180-second clause is garbled. in context
• To validate Direct Routing pairing, the SBC should receive 200 OK to its outgoing OPTIONS and answer Direct Routing's OPTIONS with 200 OK; Direct Routing sends its OPTIONS to the FQDN in the Contact header of the SBC's OPTIONS. in context
• Microsoft forces TLS 1.2 on the Direct Routing SIP interface and lists four ECDHE-RSA AES cipher suites the SBC must be able to use. in context
• When MaxConcurrentSessions is set, the alerting system notifies at 90 percent or more of that value; without a value no alerts are generated. in context
• The SBC's Enabled setting turns the SBC on for outbound calls and can be used to take it temporarily out of service during maintenance; its default is False. in context
• FailoverTimeSeconds (default 10) sends an outbound call that the gateway has not answered within that time to the next available trunk, and drops it if there is none; Microsoft warns this can drop calls unnecessarily on slow networks. in context
• With ForwardCallHistory turned on (default False), the Microsoft 365 proxy sends History-Info and Referred-By headers through the trunk. in context
• An SBC can be paired only if the domain part of its FQDN is a domain registered in the tenant other than *.onmicrosoft.com, a subdomain used in the FQDN must itself be registered, and the domain needs a user with an E3 or E5 license assigned. in context
• Mapping multiple IP addresses to the same SBC FQDN is not supported for Direct Routing. in context
• An SBC is paired with New-CsOnlinePSTNGateway using at minimum its FQDN, SIP signaling port, and Enabled set to true, or through Voice > Direct Routing > SBCs in the Teams admin center (PowerShell only for GCC High and DoD). in context
• If the SBC's Send SIP options setting is turned off, the SBC is excluded from Direct Routing's monitoring and alert system; Microsoft highly recommends leaving it on. in context
• Microsoft forces TLS 1.2 on the Direct Routing SIP interface, and the SBC must connect using one of four listed ECDHE-RSA AES-GCM or AES-CBC cipher suites. in context
• Microsoft's verification of a paired SBC is that Get-CsOnlinePSTNGateway lists it with Enabled True and that the SBC management interface shows 200 OK responses to its outgoing SIP OPTIONS and 200 OK replies to OPTIONS received from Direct Routing. in context
• When MaxConcurrentSessions is set the alerting system notifies the administrator at 90 percent or more of that value, and when it is not set no alerts are generated although the monitoring system still reports concurrent sessions every 24 hours. in context
• Besides the domain being registered in the tenant, a user with that domain and an assigned E3 or E5 licence must exist, and the domain's configured authentication type must be Managed, otherwise pairing fails with a domain-not-configured error. in context
• The trunk failover defaults are response codes 408, 503 and 504 and a FailoverTimeSeconds of 10 seconds, after which an unanswered outbound call is routed to the next available trunk or dropped if none exists. in context
• ForwardCallHistory and ForwardPai both default to False; turning on call history makes Microsoft 365 send History-Info and Referred-By headers, and turning on PAI also sends the Privacy:ID header. in context
• An SBC can only be paired if the domain portion of its FQDN matches a domain registered in the tenant, and *.onmicrosoft.com domain names are not supported for the SBC FQDN. in context
• New-CsOnlinePSTNGateway has an IPAddressVersion option of IPv4 or IPv6, and when IPv6 is set the SBC must use IPv6 for both signalling and media, with media bypass unsupported and mixed IPv6/IPv4 SIP and media unsupported. in context
• SIP OPTIONS pings must not exceed a frequency of one transaction every 60 seconds and must not be more or less frequent than one transaction every 180 seconds for each configured trunk for each endpoint. in context
• An SBC is paired to Direct Routing with New-CsOnlinePSTNGateway using -Fqdn, -SipSignalingPort, -MaxConcurrentSessions and -Enabled $true as the minimum parameters. in context
• SendSIPOptions defaults to True and Microsoft highly recommends leaving it on, because when it is off the SBC is excluded from the Monitoring and Alert system. in context
• Multiple IP addresses mapped to the same FQDN on the SBC side are not supported for Direct Routing. in context
• An SBC can be connected either in the Microsoft Teams admin center or with PowerShell, but for GCC High and DoD clouds PowerShell must be used because the admin center option is not available. in context
• Microsoft forces TLS 1.2 on the Direct Routing SIP interface and the SBC must be able to connect with one of four ECDHE-RSA cipher suites using AES 128 or 256 in GCM or CBC mode. in context
• Pairing is verified by running Get-CsOnlinePSTNGateway and confirming the SBC appears with Enabled set to True, and by confirming in the SBC management interface that outgoing OPTIONS receive 200 OK and that the SBC answers incoming OPTIONS from Direct Routing with 200 OK. in context
• The Direct Routing FailoverResponseCodes setting (default 408, 503, 504) applies to responses to an SBC-terminated initial INVITE. It does not concern OPTIONS. in context
• FailoverTimeSeconds defaults to 10 seconds. An outbound call the gateway does not answer within that time is routed to the next available trunk, or dropped if there is no other trunk. in context
• The 180-second clause in Microsoft's OPTIONS frequency rule contradicts itself as written ('more or less frequent'). Read together with the three-minute health window on the monitoring page, the likely intent is that an SBC sends OPTIONS no more often than every 60 seconds and no less often than every 180 seconds. inferred in context
• Microsoft's SBC connection guidance says SIP OPTIONS pings MUST NOT be sent more often than one transaction every 60 seconds per configured trunk per endpoint, and adds a second clause that refers to 180 seconds. in context
• When Direct Routing receives OPTIONS from an SBC, it starts sending its own OPTIONS to the SBC FQDN given in the Contact header of those incoming OPTIONS. in context
• The SBC setting SendSipOptions ('Send SIP options' in the Teams admin center) defaults to True, and Microsoft strongly recommends leaving it on. in context
• If Send SIP options is turned off, the SBC is left out of the Direct Routing Monitoring and Alert system. in context
• To validate pairing, check on the SBC that its outgoing OPTIONS receive 200 OK, and that it answers the OPTIONS arriving from Direct Routing with 200 OK. in context
• The Direct Routing FailoverTimeSeconds setting defaults to 10 seconds: an outbound call the gateway has not answered within that time moves to the next available trunk, or is dropped if there is none. in context
• The Direct Routing ForwardPAI setting defaults to False; when it is on, the P-Asserted-Identity header is forwarded with the call and a Privacy:ID header is also sent. in context
• When MaxConcurrentSessions is set on a Direct Routing SBC, the alerting system notifies at 90 percent or more of the value; if it is unset, no alerts are generated. in context
• Direct Routing starts sending its own OPTIONS only after it receives OPTIONS from the SBC, and sends them to the SBC FQDN in the Contact header of those incoming OPTIONS. in context
• Microsoft's step for validating a new Direct Routing SBC pairing is to confirm in the SBC management interface that its outgoing SIP OPTIONS get 200 OK and that it answers Direct Routing's incoming OPTIONS with 200 OK. in context
• The Direct Routing connect article says SBC OPTIONS pings must not exceed one transaction every 60 seconds and must not be more or less frequent than one every 180 seconds, per trunk per endpoint; read with the monitor article, the working interval is between 60 and 180 seconds. inferred in context
• Turning off SendSIPOptions on a Direct Routing SBC excludes it from the Monitoring and Alert system; Microsoft highly recommends leaving it on, which is the default. in context
• Microsoft forces TLS 1.2 on the Direct Routing SIP interface, and the SBC must connect with one of four listed ECDHE-RSA AES cipher suites (256/128-bit GCM, or 256/128-bit CBC with SHA-384/SHA-256). in context
• In GCC High and DoD, the SBC must be connected with PowerShell, because the connect-SBC option isn't available in the Teams admin center there. in context
• An SBC is paired with the tenant by running New-CsOnlinePSTNGateway, with the minimum parameters being the FQDN or Identity, SipSignalingPort, MaxConcurrentSessions and Enabled. in context
• Default Direct Routing SBC settings are Enabled False, SendSipOptions True, ForwardCallHistory False, ForwardPai False, FailoverTimeSeconds 10 and FailoverResponseCodes 408, 503 and 504. in context
• Media bypass is not supported when IPv6 is used for SIP or media or with the IPv6 Teams client, and mixed IPv6/IPv4 SIP and media is not supported. in context
• Besides registering the SBC domain, the tenant needs a user in that domain with an assigned E3 or E5 license, otherwise pairing fails with an error that the domain was not configured for this tenant. in context
• To assign a user in the SBC domain, the configured authentication type of that domain must be Managed. in context
• The SBC Enabled setting turns the SBC on for outbound calls, defaults to False, and can be used to temporarily remove the SBC from service during updates or maintenance. in context
• FailoverResponseCodes defaults to 408, 503 and 504 and makes Direct Routing try another SBC in the user's voice routing policy on those responses to an initial INVITE, but only when no prior non-100 provisional response was received. in context
• If the SBC FQDN uses a subdomain such as sbc.service.contoso.com, the subdomain service.contoso.com must also be registered in the tenant. in context
• An SBC can only be connected if the domain portion of its FQDN matches a domain registered in the tenant, and *.onmicrosoft.com domains are not supported for the SBC FQDN. in context
• In the GCC High and DoD clouds the SBC must be connected with PowerShell because the option is not available in the Teams admin center. in context
• Because the phased bypass trunk is a separately paired SBC FQDN, its domain portion has to meet the same tenant-domain and licensed-user conditions as the first trunk FQDN. inferred in context
• An SBC is paired either in the Teams admin center under Voice > Direct Routing > SBCs > Add, or with New-CsOnlinePSTNGateway using -Fqdn, -SipSignalingPort, -MaxConcurrentSessions and -Enabled $true. in context
• The SendSIPOptions setting defaults to True and Microsoft highly recommends leaving it on, because an SBC with it off is excluded from the Monitoring and Alert system. in context
• Microsoft forces TLS 1.2 on the Direct Routing SIP interface, and the SBC must support TLS 1.2 with one of four ECDHE-RSA cipher suites: AES256-GCM-SHA384, AES128-GCM-SHA256, AES256-SHA384 or AES128-SHA256. in context
• After pairing, Get-CsOnlinePSTNGateway -Identity <FQDN> should list the SBC with Enabled set to True. in context
• Pairing is validated on the SBC management interface by confirming the SBC receives 200 OK to its outgoing OPTIONS and answers 200 OK to OPTIONS arriving from Direct Routing, which Direct Routing sends to the FQDN in the Contact header of the SBC's OPTIONS. in context
• The Connect-SBC article sets a frequency limit on SBC SIP OPTIONS pings per trunk per endpoint, but its wording (no more than one every 60 seconds, and neither more nor less frequent than one every 180 seconds) is internally inconsistent. in context
• If the SBC FQDN uses a subdomain such as sbc.service.contoso.com, that subdomain (service.contoso.com) must itself be registered in the tenant before the SBC is paired. in context
• Direct Routing enforces TLS 1.2 on its SIP interface, and the SBC must be able to connect using one of four ECDHE-RSA cipher suites (AES-256-GCM-SHA384, AES-128-GCM-SHA256, AES-256-CBC-SHA384 or AES-128-CBC-SHA256). in context
• The SBC's Enabled setting turns it on for outbound calls and can be used to take the SBC temporarily out of service. in context
• An SBC can be paired with Direct Routing only if the domain portion of its FQDN is registered in the tenant; *.onmicrosoft.com is not supported, and a user with that domain holding an E3 or E5 license must exist. in context
• The SBC is paired with New-CsOnlinePSTNGateway using at minimum the FQDN, SipSignalingPort, MaxConcurrentSessions and Enabled parameters, or through Voice > Direct Routing > SBCs in the Teams admin center. in context
• Direct Routing enforces TLS 1.2 on its SIP interface, and the SBC must support one of four listed ECDHE-RSA AES cipher suites. in context
• SBC pairing is verified by confirming with Get-CsOnlinePSTNGateway that the SBC is listed with Enabled True, and on the SBC that its outgoing SIP OPTIONS receive 200 OK and it answers Direct Routing OPTIONS with 200 OK. in context
• Microsoft validates SBC pairing by confirming that SIP OPTIONS in both directions between the SBC and Direct Routing receive 200 OK. in context
• An SBC is paired with New-CsOnlinePSTNGateway (Fqdn, SipSignalingPort, Enabled), and Get-CsOnlinePSTNGateway should then list it with Enabled True; the module also provides Set-CsOnlinePSTNGateway and Remove-CsOnlinePSTNGateway, and setting Enabled to False temporarily removes an SBC from service. in context
• A Direct Routing SBC FQDN must be in a domain registered in the tenant (not *.onmicrosoft.com), and the tenant needs a user in that domain with an E3 or E5 licence. in context
• Direct Routing enforces TLS 1.2 on its SIP interface and accepts only a listed set of ECDHE-RSA AES cipher suites. in context

Cite this source record

APA

WarmTransfer. (2026, April 26). Connect your Session Border Controller (SBC) to Direct Routing. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-learn-dr-connect-sbc

BibTeX

@misc{warmtransfer-ms-learn-dr-connect-sbc,
  title  = {Connect your Session Border Controller (SBC) to Direct Routing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-learn-dr-connect-sbc},
  note   = {Microsoft, accessed 2026-09-21}
}