Teams Phone Direct Routing and SBC certification

See also

Sources

1. 1
   Microsoft lists Bandwidth Dynamic Location Routing, Intrado Emergency Routing Service and Inteliquent as the certified 911 service providers for Direct Routing, and may reject support cases that use a non-certified provider.

   Session Border Controllers certified for Direct Routing - Microsoft Teams · footnote '911 service providers' below the 'Certified SBC vendors' table · Checked 2026-09-23
2. 2
   On non-bypass Direct Routing trunks, Teams outbound offers to the SBC include AMR-WB and telephone-event/16000. On inbound calls, AMR-WB is selected if the SBC's offer includes it.

   What's New Direct Routing · entry 'AMR-WB is enabled for Direct Routing trunks on non bypass calls' · Checked 2026-09-23
3. 3
   Media bypass is controlled per SBC with the -MediaBypass parameter of Set-CsOnlinePSTNGateway. It uses ICE on the Teams client and ICE Lite on the SBC, and signaling always flows through the Microsoft cloud.

   Plan for media bypass with Direct Routing · sections 'About media bypass with Direct Routing' and 'Call flow if the user has direct access to the public IP address of the SBC' · Checked 2026-09-23
4. 4
   With media bypass, Teams clients send media to the SBC's public IP from UDP source ports 50000–50019. Transport Relays use 50000–59999 (v4 relays) and 3478–3481 (v6 relays) toward the SBC.

   Plan for media bypass with Direct Routing · sections 'Requirements for direct media traffic' and 'Requirements for using Transport Relays' tables and Note · Checked 2026-09-23
5. 5
   Microsoft planned a staged validation test for 2026-06-30 at 09:00 UTC that moved Direct Routing SIP endpoints to certificates from a new CA across geos over 2 to 4 days; SBC TLS failures during the test indicated trust issues.

   What's New Direct Routing · entry 'Validation test that switches Microsoft Teams Direct Routing SIP endpoints to certificates issued by a new CA (June 30, 2026)' · Checked 2026-09-23
6. 6
   In the multi-tenant carrier model, the carrier and customer tenants must be in the same cloud. A Public-cloud carrier tenant can't serve a GCC High customer tenant.

   Configure a Session Border Controller for multiple tenants · introductory Note, second paragraph · Checked 2026-09-23
7. 7
   In the multi-tenant carrier model, the carrier's SBC uses a certificate with CN or SAN *.base_domain (for example *.sbc1.adatum.biz), and each customer tenant registers a unique subdomain under that base domain.

   Configure a Session Border Controller for multiple tenants · section 'Register a base domain and subdomains - Overview' · Checked 2026-09-23
8. 8
   The Direct Routing SBC certificate should carry the SBC FQDN in the CN or SAN, be signed by a CA in the Microsoft Trusted Root Program and include the Server Authentication EKU. Microsoft recommends generating the CSR on the SBC.

   Plan Direct Routing · section 'Public trusted certificate for the SBC' · Checked 2026-09-23
9. 9
   Microsoft's December 2025 update said Microsoft would in future require all SBC certificates to include the Client Authentication EKU.

   What's New Direct Routing · entry 'Update on upcoming certificate changes (December 12, 2025)' > 'Summary', second bullet · Checked 2026-09-23
10. 10
    Microsoft SIP endpoints currently trust Direct Routing SBC certificates that lack the Client Authentication EKU. Microsoft expects this to continue for the foreseeable future and says it will announce any change in advance.

    What's New Direct Routing · entry 'Clarification on Client Authentication Extended Key Usage (EKU)' · Checked 2026-09-23
11. 11
    Direct Routing supports SILK, G.711, G.722 and G.729 between Teams and the SBC, plus AMR-WB on non-bypass calls only.

    Plan Direct Routing · section 'Supported codecs' · Checked 2026-09-23
12. 12
    Every OPTIONS and INVITE sent to the Microsoft SIP proxy must carry the paired SBC FQDN, matching the certificate CN or SAN, in the Contact header. A Contact header with an IP address is refused with 403 Forbidden.

    Teams Phone System Direct Routing: SIP protocol · section 'Detailed requirements for Contact header and Request-URI' > 'Contact header' · Checked 2026-09-23
13. 13
    In the carrier model, the carrier creates a single carrier trunk in its own tenant with New-CsOnlinePSTNGateway, and customer tenants add a derived-trunk FQDN to their voice routes without creating a gateway. Derived trunks inherit the carrier trunk's settings and health status.

    Configure a Session Border Controller for multiple tenants · section 'Create a trunk and provision users' > 'Provisioning logic and example' · Checked 2026-09-23
14. 14
    Number translation rules on a carrier trunk don't apply to its derived trunks. Microsoft lists this as a known issue, and the workaround is to create translation rules in each customer tenant.

    Configure a Session Border Controller for multiple tenants · section 'Create a trunk and provision users', Note after the examples list · Checked 2026-09-23
15. 15
    The Direct Routing SBC FQDN must belong to a verified domain in the Microsoft 365 tenant, and the default *.onmicrosoft.com domain can't be used.

    Plan Direct Routing · section 'SBC domain names' · Checked 2026-09-23
16. 16
    In GCC High and DoD, the SBC must be connected with PowerShell, because the connect-SBC option isn't available in the Teams admin center there.

    Connect your Session Border Controller (SBC) to Direct Routing · Note under the introductory step list · Checked 2026-09-23
17. 17
    GCC High uses the single Direct Routing FQDN sip.pstnhub.gov.teams.microsoft.us (52.127.88.0/21), and DoD uses sip.pstnhub.dod.teams.microsoft.us (52.127.64.0/21). Neither has secondary or tertiary FQDNs.

    Plan for media bypass with Direct Routing · sections 'Office 365 GCC DoD environment' and 'Office 365 GCC High environment' under 'SIP Signaling: FQDNs' · Checked 2026-09-23
18. 18
    Direct Routing can run in the same tenant alongside Microsoft Calling Plan, Operator Connect and Teams Phone Mobile, for example Operator Connect for PSTN with Direct Routing for third-party PBXs and analog devices.

    Plan Direct Routing · sections 'Why choose Direct Routing?' and 'Direct Routing with Calling Plan and Operator Connect' · Checked 2026-09-23
19. 19
    Direct Routing supports IPv6 only for non-media-bypass calls where both SIP and media use IPv6, selected with IPAddressVersion on New-CsOnlinePSTNGateway. Mixed IPv4/IPv6 SIP and media isn't supported.

    What's New Direct Routing · entry 'IPv6 with non media bypass is now supported for Teams Phone' · Checked 2026-09-23
20. 20
    Direct Routing isn't supported in Teams Islands coexistence mode.

    Plan Direct Routing · section 'Licensing requirements', Note · Checked 2026-09-23
21. 21
    The media bypass planning article lists only 52.112.0.0/14 as the Media Processor and Transport Relay IPv4 range for Office 365 and GCC.disputed

    Plan for media bypass with Direct Routing · sections 'Requirements for using Transport Relays' and 'Requirements for using media processors' · Checked 2026-09-23
22. 22
    The Plan Direct Routing article lists 52.112.0.0/14 and 52.120.0.0/14 as the Media Processor IPv4 ranges to allow for Microsoft 365 and Office 365.disputed

    Plan Direct Routing · section 'Media processor IP ranges' > 'Microsoft 365 / Office 365' · Checked 2026-09-23
23. 23
    Non-bypass Direct Routing media between Microsoft Media Processors and the SBC uses UDP/SRTP on ports 3478–3481 and 49152–53247. Microsoft recommends at least two media ports on the SBC per concurrent call.

    Plan Direct Routing · section 'Media ports' table and Tip · Checked 2026-09-23
24. 24
    Even on media-bypass trunks, Teams Media Processors are always in the media path for voice applications such as Call Park, Auto Attendant and Call Queues, and for web clients.

    Plan for media bypass with Direct Routing · sections 'Use of Media Processors and Transport Relays' and 'Requirements for using media processors' · Checked 2026-09-23
25. 25
    Microsoft states that Direct Routing SIP endpoint certificates issued by a new CA were rolled out in production at the end of July 2026, and the sip.g1.pstnhub.microsoft.com test endpoint has been discontinued.

    What's New Direct Routing · entry 'Testing endpoint for upcoming certificate changes (February 16, 2026)', Warning box · Checked 2026-09-23
26. 26
    Direct Routing doesn't support Delayed Offer INVITEs (INVITE without SDP) and doesn't support SIPS URIs.

    Teams Phone System Direct Routing: SIP protocol · Note in 'Non-media bypass flow' (Delayed Offer) and Note under the OPTIONS example table (SIPS) · Checked 2026-09-23
27. 27
    Direct Routing does not support media re-targeting. If the SBC signals a new media IP during a call, Teams never sends media to the new address.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · final Note at end of page · Checked 2026-09-23
28. 28
    As of the page's last update, Microsoft states it is not accepting new nominations for Direct Routing SBC certification until further notice.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · sentence immediately above heading 'Certified SBC vendors' · Checked 2026-09-23
29. 29
    Because certification nominations are closed, an SBC product not already in the certified table is unlikely to gain Direct Routing certification in the near term, so SBC selection is effectively limited to the listed vendors and products.inferred

    Session Border Controllers certified for Direct Routing - Microsoft Teams · sentence above 'Certified SBC vendors' plus the table under that heading · Checked 2026-09-23
30. 30
    Microsoft reserves the right to reject support cases where a non-certified device is connected to Teams Phone through Direct Routing.

    Session Border Controllers certified for Direct Routing - Microsoft Teams · introductory Note above the example block, before 'Certified SBC vendors' · Checked 2026-09-23
31. 31
    An SBC is paired with the tenant by running New-CsOnlinePSTNGateway, with the minimum parameters being the FQDN or Identity, SipSignalingPort, MaxConcurrentSessions and Enabled.

    Connect your Session Border Controller (SBC) to Direct Routing · section 'Connect the SBC to the tenant' · Checked 2026-09-23
32. 32
    If the SBC advertises REFER in its Allow header, the Direct Routing SIP proxy sends REFER to the SBC and acts as Transferor (RFC 5589 section 6). Otherwise the proxy terminates the client's REFER itself and acts as Referee.

    Teams Phone System Direct Routing: SIP protocol · section 'Call transfer' · Checked 2026-09-23
33. 33
    SBC handling of REFER is mandatory for devices seeking Direct Routing media bypass certification, and call transfer without SBC REFER support isn't supported in media bypass mode.

    Teams Phone System Direct Routing: SIP protocol · section 'SIP proxy send the Refer to the SBC and acts as a Transferor', first paragraph · Checked 2026-09-23
34. 34
    For incoming calls, the phone number in the Request-URI (and in the From header, for blocking and reverse lookup) must contain a leading plus sign.

    Teams Phone System Direct Routing: SIP protocol · sections 'Request-URI' and 'From Header' · Checked 2026-09-23
35. 35
    If the tenant uses Continuous Access Evaluation tokens, SBA stays operational for only about 30 minutes. Separately, SBA accepts expired client tokens for up to 7 days, and a client that restarts during an outage can't connect to the SBA.

    Survivable Branch Appliance for Direct Routing · section 'Known issues and considerations' · Checked 2026-09-23
36. 36
    SBA mode is supported on the Teams Windows and macOS desktop clients and on Teams Phones, and it activates only on desktop clients running on a physical machine. VMs and web clients aren't supported.

    Survivable Branch Appliance for Direct Routing · sections 'Supported Teams clients' and 'How it works' · Checked 2026-09-23
37. 37
    In SBA mode, emergency calls don't share location information and Emergency Call Routing Policies aren't supported. Emergency calls fail unless the regular voice routing policy has a pattern matching the emergency dial strings, which are sent without a plus sign.

    Survivable Branch Appliance for Direct Routing · section 'Known issues and considerations', 'In SBA mode, the following user actions aren't supported' · Checked 2026-09-23
38. 38
    A Direct Routing Survivable Branch Appliance requires the SBC to be configured for media bypass. SBA code is supplied by Microsoft to SBC vendors, who embed it in their firmware or ship it separately.

    Survivable Branch Appliance for Direct Routing · section 'Prerequisites' · Checked 2026-09-23
39. 39
    Default Direct Routing SBC settings are Enabled False, SendSipOptions True, ForwardCallHistory False, ForwardPai False, FailoverTimeSeconds 10 and FailoverResponseCodes 408, 503 and 504.

    Connect your Session Border Controller (SBC) to Direct Routing · section 'SBC settings' table, Default column · Checked 2026-09-23
40. 40
    If the primary Direct Routing region becomes unavailable, Microsoft redirects SBC signaling to the secondary and then the tertiary region without administrator intervention.

    Plan Direct Routing · section 'SIP signaling failover' · Checked 2026-09-23
41. 41
    For Microsoft 365, Office 365 and GCC, the Direct Routing SIP connection points are sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com, configured in that priority order.

    Plan Direct Routing · section 'SIP signaling: FQDNs', first table · Checked 2026-09-23
42. 42
    The Direct Routing signaling FQDNs resolve to 52.112.0.0/14 and 52.120.0.0/14 (IPv6: 2603:1063:400::/40). Microsoft says the firewall must allow all of these ranges, not only the addresses returned by DNS.

    Plan Direct Routing · section 'SIP signaling: FQDNs', IP range lists and Important box · Checked 2026-09-23
43. 43
    SIP/TLS from the SBC to the Microsoft SIP proxy uses destination port 5061. Traffic from the proxy to the SBC uses the port configured on the SBC, from source ports 1024 to 65535.

    Plan for media bypass with Direct Routing · section 'SIP Signaling: Ports' table · Checked 2026-09-23
44. 44
    The Connect-SBC article sets a frequency limit on SBC SIP OPTIONS pings per trunk per endpoint, but its wording (no more than one every 60 seconds, and neither more nor less frequent than one every 180 seconds) is internally inconsistent.

    Connect your Session Border Controller (SBC) to Direct Routing · section 'Connect the SBC to the tenant' > 'Considerations', SIP OPTIONS bullet · Checked 2026-09-23
45. 45
    If the SBC FQDN uses a subdomain such as sbc.service.contoso.com, that subdomain (service.contoso.com) must itself be registered in the tenant before the SBC is paired.

    Connect your Session Border Controller (SBC) to Direct Routing · section 'Use the Microsoft Teams admin center', step 3 · Checked 2026-09-23
46. 46
    On an incoming call, Direct Routing finds the tenant by looking up the full Contact-header FQDN as a registered domain, then falls back to the FQDN minus its host portion. If neither matches, the call fails.

    Teams Phone System Direct Routing: SIP protocol · section 'Processing the incoming request: finding the tenant and user', steps 2 and 3 · Checked 2026-09-23
47. 47
    Direct Routing enforces TLS 1.2 on its SIP interface, and the SBC must be able to connect using one of four ECDHE-RSA cipher suites (AES-256-GCM-SHA384, AES-128-GCM-SHA256, AES-256-CBC-SHA384 or AES-128-CBC-SHA256).

    Connect your Session Border Controller (SBC) to Direct Routing · section 'Connect the SBC to the tenant' > 'Considerations', TLS1.2 bullet · Checked 2026-09-23
48. 48
    SBCs must trust all seven root CAs Microsoft lists for the Teams SIP interface: DigiCert Global Root CA, DigiCert Global Root G2, DigiCert Global Root G3, DigiCert TLS ECC P384 Root G5, DigiCert TLS RSA 4096 Root G5, Microsoft ECC Root CA 2017 and Microsoft RSA Root CA 2017.

    What's New Direct Routing · entry 'Update on upcoming certificate changes (December 12, 2025)' > 'Changes and call to action' and 'Summary' · Checked 2026-09-23
49. 49
    Direct Routing users require Microsoft Teams and Teams Phone licensing and must be homed online in Microsoft 365.

    Plan Direct Routing · sections 'Infrastructure requirements' (User registrar row) and 'Licensing requirements' · Checked 2026-09-23
50. 50
    Wildcard SBC certificates are supported for Direct Routing when they follow RFC 2818 matching, where *.a.com matches foo.a.com but not bar.foo.a.com.

    Teams Phone System Direct Routing: SIP protocol · section 'Detailed requirements for Contact header and Request-URI' > 'Contact header' · Checked 2026-09-23
51. 51
    Direct Routing connects customer telephony infrastructure to Teams Phone through a supported customer-provided Session Border Controller.

    Plan Direct Routing · Plan Direct Routing, introduction · Checked 2026-09-06
52. 52
    Microsoft's Direct Routing plan puts infrastructure and licensing before SBC selection and connectivity then routing and user assignment and requires inbound outbound emergency failover policy and call-quality validation before production rollout.

    Plan Direct Routing · Deployment overview and Verify your deployment · Checked 2026-09-06
53. 53
    The current Direct Routing plan requires a Microsoft-certified SBC telephony trunks a Microsoft 365 tenant with online users a verified domain a public IP address and DNS record for the SBC FQDN a public certificate and permitted signaling and media paths.

    Plan Direct Routing · Infrastructure requirements table · Checked 2026-09-06
54. 54
    Microsoft states that Direct Routing is not supported in Islands mode.

    Plan Direct Routing · Licensing requirements, note after the list · Checked 2026-09-06
55. 55
    A Direct Routing SBC FQDN must belong to a verified Microsoft 365 tenant domain and cannot use the default onmicrosoft.com domain.

    Plan Direct Routing · SBC domain names · Checked 2026-09-06
56. 56
    Microsoft documents Direct Routing alongside other Teams Phone PSTN models and names third-party PBXs analog devices and specialized routing as uses for the Direct Routing leg.

    Plan Direct Routing · Direct Routing with Calling Plan and Operator Connect · Checked 2026-09-06
57. 57
    Microsoft states that a tenant using Continuous Access Evaluation tokens may have only about 30 minutes of SBA operation.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations, CAE token bullet · Checked 2026-09-06
58. 58
    In SBA mode web and virtual-machine clients are unsupported emergency location information is not shared and Teams Emergency Call Routing Policies are unsupported.

    Survivable Branch Appliance for Direct Routing · How it works and Known issues and considerations · Checked 2026-09-06
59. 59
    The Direct Routing SBA requires Media Bypass TLS 1.2 and firewall access for its documented client SBC NTP and Microsoft 365 communication ports.

    Survivable Branch Appliance for Direct Routing · Prerequisites · Checked 2026-09-06
60. 60
    A Direct Routing Survivable Branch Appliance supports local PSTN calling during a Microsoft-cloud connectivity outage when the branch intranet and SBC remain reachable.

    Survivable Branch Appliance for Direct Routing · Survivable Branch Appliance, opening scenario · Checked 2026-09-06

Documents

Cite this page

WarmTransfer. (2026, September 23). Teams Phone Direct Routing and SBC certification. WarmTransfer. https://warmtransfer.net/knowledge/teams-direct-routing

@misc{warmtransfer-teams-direct-routing,
  title  = {Teams Phone Direct Routing and SBC certification},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/teams-direct-routing},
  note   = {Verified 2026-09-23}
}