Configure a Session Border Controller for multiple tenants

Publisher

Microsoft

URL

https://learn.microsoft.com/en-us/microsoftteams/direct-routing-sbc-multiple-tenants

Published

2026-09-10

Updated

unknown

Accessed

2026-09-23

HTTP status

200

License

Microsoft Learn terms of use (CC-BY-4.0 applies to some Learn docs; not confirmed for this page); no-redistribution; short excerpts and locators only

Source notes citing this source

• Number translation rules applied on a Teams carrier trunk do not apply to derived trunks. Microsoft lists this as a known issue, so translation rules must be created in each customer tenant. in context
• In the Teams carrier model, a derived trunk in a customer tenant takes all of its configuration from the carrier trunk. SIP OPTIONS are sent only to the carrier trunk FQDN, and its health status applies to every derived trunk. in context
• For the Teams SBC hosting scenario, the carrier requests a certificate with CN and/or SAN of *.base_domain (for example *.sbc1.adatum.biz) to authenticate connections to multiple tenants from one SBC. in context
• Direct Routing lets one SBC serve multiple Microsoft 365 tenants, and Microsoft describes this scenario as designed for Microsoft partners and PSTN carriers. in context
• In the Teams hosting model, each customer subdomain must match both the FQDN of the trunk configured for that customer and the FQDN the SBC puts in the Contact header when it sends the INVITE. in context
• The base domain in the carrier tenant and each subdomain in a customer tenant must be activated by adding at least one Teams-licensed user or a resource account with a Teams Phone Resource Account license whose UPN uses that exact FQDN. in context
• In the multi-tenant (carrier) model, the carrier registers a base domain in its own tenant and gets a wildcard certificate for *.base_domain, and each customer tenant gets a subdomain of it; that subdomain must match both the customer's trunk FQDN and the FQDN the SBC puts in the Contact header, because Direct Routing identifies the tenant from the Contact header. in context
• For the multi-tenant model, the carrier tenant and customer tenants must be in the same cloud, so a carrier tenant in the public cloud cannot serve a GCC High customer tenant. in context
• Number translation rules applied to a carrier trunk do not apply to derived trunks, which Microsoft calls a known issue; translation rules must be created in each customer tenant instead. in context
• In the current carrier model, the carrier creates one carrier trunk in its own tenant with New-CSOnlinePSTNGateway; customer tenants add the derived trunk FQDN (for example customer.sbc1.base) to voice routes without registering it, derived trunks inherit all carrier-trunk settings including media bypass and port, OPTIONS go only to the carrier trunk FQDN, and the carrier must publish DNS resolving each derived FQDN to the SBC. in context
• A Global Administrator adds each customer subdomain in the customer's Microsoft 365 admin center and verifies it with a TXT record created at the carrier's DNS host, then ensures the status reads Setup complete. in context
• In the multi-tenant carrier model, the carrier and customer tenants must be in the same cloud. A Public-cloud carrier tenant can't serve a GCC High customer tenant. in context
• In the multi-tenant carrier model, the carrier's SBC uses a certificate with CN or SAN *.base_domain (for example *.sbc1.adatum.biz), and each customer tenant registers a unique subdomain under that base domain. in context
• In the carrier model, the carrier creates a single carrier trunk in its own tenant with New-CsOnlinePSTNGateway, and customer tenants add a derived-trunk FQDN to their voice routes without creating a gateway. Derived trunks inherit the carrier trunk's settings and health status. in context
• Number translation rules on a carrier trunk don't apply to its derived trunks. Microsoft lists this as a known issue, and the workaround is to create translation rules in each customer tenant. in context

Cite this source record

APA

WarmTransfer. (2026, September 10). Configure a Session Border Controller for multiple tenants. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-learn-dr-sbc-multiple-tenants

BibTeX

@misc{warmtransfer-ms-learn-dr-sbc-multiple-tenants,
  title  = {Configure a Session Border Controller for multiple tenants},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-learn-dr-sbc-multiple-tenants},
  note   = {Microsoft, accessed 2026-09-23}
}