Configuration · guide

Setting up media bypass and local media optimization for Teams Direct Routing

Microsoft Teams Phone

Verified 2026-09-30 · 73 sources · tier 1–2

For Teams voice administrators and SBC engineers configuring media bypass and Local Media Optimization.

Media bypass keeps Direct Routing call media between the Session Border Controller (SBC) and the Teams client rather than routing through Microsoft Teams Phone Media Processors 42. Local Media Optimization (LMO) builds on media bypass to keep media inside corporate subnets and reach SBCs that sit behind firewalls on private addresses 27 24.

Before you start

Direct Routing requires a Microsoft-certified SBC, PSTN trunks connected to it, users homed online in Microsoft 365, a public IP, an SBC FQDN in a verified tenant domain (excluding *.onmicrosoft.com) with public DNS, and a publicly trusted TLS certificate 68 69. Microsoft supports Direct Routing only with certified SBCs, expects the SBC vendor to investigate issues first, and may decline support requests involving non-certified hardware 70.

Turning on media bypass requires meeting three conditions: the SBC vendor supports it and documents SBC-side configuration, the trunk is switched with Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $true, and all required firewall ports are open 1. Microsoft notes that a tenant already using media bypass with SBC public IPs does not need to move to Local Media Optimization 12.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

How should media reach the SBC?

What does your SBC estate look like?

How will you move users onto the bypass trunk?

Three questions. One permanent page you can send to your manager.

Step 1 Confirm the SBC is certified for what you chose

Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites

Do

Find your SBC model and firmware in Microsoft's certified SBC list and check the Media bypass column 60. Certification for non-media-bypass and media bypass is listed separately, and some certified products are certified for non-media bypass only 60. Obtain the vendor's SBC-side media bypass instructions, as vendor support and documentation are required prerequisites 1.

Verify

Confirm that your SBC model displays a check mark under Media bypass and that the running firmware meets or exceeds the listed version 60.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Confirm that your SBC model displays a check mark under Media bypass and that the running firmware meets or exceeds the listed version 60.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Review the selected options: media bypass alone requires the Teams client to reach the SBC's public IP address 40. Downstream SBCs have no public IP addresses and communicate only over internal IPs behind a proxy SBC 17 29. Change the optimization selection to lmo to support downstream SBC topology 17 29.

Verify

Suggested check: Confirm that your deployment plan uses Local Media Optimization for proxy and downstream SBC topologies.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Verify

Suggested check: Confirm that your deployment plan uses Local Media Optimization for proxy and downstream SBC topologies.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites

Do

Check the certified SBC list for your model in both the Media bypass column and the separate Support for Local Media Optimization table 60 61. Note that Local Media Optimization support has its own minimum software versions distinct from standard media bypass 61. Obtain the SBC vendor's LMO configuration guide, as Microsoft requires SBCs to be configured according to vendor specifications 16.

Verify

Confirm that your central SBC model is listed in the Local Media Optimization table at or above the required firmware version 61.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Confirm that your central SBC model is listed in the Local Media Optimization table at or above the required firmware version 61.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Check both the proxy SBC and all downstream SBCs against Microsoft's certified SBC list for the Media bypass column and the separate Support for Local Media Optimization table 60 61. Note that Local Media Optimization support has distinct minimum software versions from standard media bypass 61. Obtain the SBC vendor's LMO configuration documentation for both the proxy and downstream devices 16.

Verify

Confirm that the proxy SBC and all downstream SBCs appear in the Support for Local Media Optimization table at or above the listed minimum software versions 61.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Verify

Confirm that the proxy SBC and all downstream SBCs appear in the Support for Local Media Optimization table at or above the listed minimum software versions 61.

Rollback

Suggested rollback: No configuration changes were made in this step.

Step 2 Check the prerequisites that rule bypass out

Do

Confirm that the trunk operates over IPv4, because IPv6 is supported on Direct Routing only for non-media-bypass scenarios, and media bypass is not supported with IPv6 SIP, IPv6 media, or the IPv6 Teams client 10 6. Confirm the trunk does not rely on AMR-WB, which Direct Routing supports only without media bypass 71. Note that media bypass is supported on standalone Teams desktop clients, Android and iOS clients, and Teams Phone devices, whereas Teams web clients and Skype for Business 3PIP phones are automatically converted to non-bypass 41.

Verify

Run Get-CsOnlinePSTNGateway and verify that the trunk is not configured with IPv6 10. Verify on the SBC that the media profile does not require AMR-WB 71.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Run Get-CsOnlinePSTNGateway and verify that the trunk is not configured with IPv6 10. Verify on the SBC that the media profile does not require AMR-WB 71.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Confirm that media bypass is not deployed over IPv6 SIP, media, or Teams clients, verifying IPv4 candidates 10 6. Verify that AMR-WB is not required 71. Note client compatibility rules 41.

Verify

Suggested check: Verify IP and codec prerequisites.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Confirm that media bypass is not deployed over IPv6 SIP, media, or Teams clients, verifying IPv4 candidates 10 6. Verify that AMR-WB is not required 71. Note client compatibility rules 41.

Verify

Suggested check: Verify IP and codec prerequisites.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Confirm the trunk avoids IPv6 SIP or media, confirm IPv4 candidates, verify no dependence on AMR-WB, and confirm client support 10 6 71 41. Confirm that remote split-tunnel VPN users are blocked from reaching the SBC internal interface, because a client detected as external is signalled to the SBC as external even if it can reach the internal interface, which can cause prolonged call setup or no audio 36. Confirm that no cloud proxy services modify Teams clients' source IP addresses, as network configuration lookups are not supported with IP-modifying cloud proxies 55.

Verify

Verify that the trunk has no IPv6 and does not offer AMR-WB 10 71. Confirm that network firewall or VPN access policies block split-tunnel VPN clients from reaching the SBC internal IP 36.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Verify that the trunk has no IPv6 and does not offer AMR-WB 10 71. Confirm that network firewall or VPN access policies block split-tunnel VPN clients from reaching the SBC internal IP 36.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Confirm the trunk avoids IPv6 SIP or media, confirm IPv4 candidates, verify no dependence on AMR-WB, and confirm client support 10 6 71 41. Coordinate with network and VPN administrators to ensure remote split-tunnel VPN users cannot access internal SBC interfaces, preventing prolonged call setup or one-way audio failures 36. Verify that enterprise egress paths do not run through cloud proxy services that rewrite client source IP addresses 55.

Verify

Verify that the trunk has no IPv6 and does not offer AMR-WB 10 71. Confirm that network routing blocks VPN clients from internal downstream and proxy SBC media addresses 36.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Verify

Verify that the trunk has no IPv6 and does not offer AMR-WB 10 71. Confirm that network routing blocks VPN clients from internal downstream and proxy SBC media addresses 36.

Rollback

Suggested rollback: No configuration changes were made in this step.

Step 3 Configure ICE Lite and SRTP on the SBC

Do

Configure ICE Lite and SRTP on the SBC Teams-facing interface per vendor instructions 44 1. Ensure the SBC configuration meets Microsoft's ICE Lite and media specifications:

The SBC must offer only one ICE candidate, and only an IPv4 candidate is supported 6.
The SBC's ICE Lite implementation must respond to every connectivity check received and must not send connectivity check requests 4. RFC 8445 defines lite ICE agents as using only host candidates and not generating connectivity checks or running state machines, while still responding to connectivity checks 59.
The SBC must answer connectivity checks and accept nominations from multiple forked Teams endpoints, before or after 200 OK, and must not change ICE candidates, password, or ufrag between a 183 Session Progress and 200 OK 5.
In bypass mode the SBC must support SRTP cipher AES_CM_128_HMAC_SHA1_80, and its SDP offer must contain SDES (DTLS is optional) 64.
The SBC must answer non-audio m-lines with port 0 per RFC 3264 to reject them, because Direct Routing does not strip non-audio m-lines in bypass mode 63.
Ensure media re-targeting is disabled, because Teams Direct Routing never sends media to a new address signalled mid-call even if negotiated in SIP 62.

Verify

In an SBC SIP and media trace of a test call, verify that the SDP contains a single IPv4 candidate, contains an a=crypto line with AES_CM_128_HMAC_SHA1_80, and shows that the SBC sends no outbound STUN connectivity checks 6 64 4.

Rollback

Revert the ICE Lite settings on the SBC according to vendor procedures 1.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Configure ICE Lite and SRTP on the SBC Teams-facing interface per vendor instructions 44 1. Ensure the SBC configuration meets Microsoft's ICE Lite and media specifications:

The SBC must offer only one ICE candidate, and only an IPv4 candidate is supported 6.
The SBC's ICE Lite implementation must respond to every connectivity check received and must not send connectivity check requests 4. RFC 8445 defines lite ICE agents as using only host candidates and not generating connectivity checks or running state machines, while still responding to connectivity checks 59.
The SBC must answer connectivity checks and accept nominations from multiple forked Teams endpoints, before or after 200 OK, and must not change ICE candidates, password, or ufrag between a 183 Session Progress and 200 OK 5.
In bypass mode the SBC must support SRTP cipher AES_CM_128_HMAC_SHA1_80, and its SDP offer must contain SDES (DTLS is optional) 64.
The SBC must answer non-audio m-lines with port 0 per RFC 3264 to reject them, because Direct Routing does not strip non-audio m-lines in bypass mode 63.
Ensure media re-targeting is disabled, because Teams Direct Routing never sends media to a new address signalled mid-call even if negotiated in SIP 62.

Verify

Rollback

Revert the ICE Lite settings on the SBC according to vendor procedures 1.

Do

Configure ICE Lite and SRTP on the SBC interfaces per vendor instructions 44 1 64.

Verify

Suggested check: Verify ICE Lite and SRTP parameters in SBC logging.

Rollback

Revert the ICE Lite configuration on the SBC 1.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Configure ICE Lite and SRTP on the SBC interfaces per vendor instructions 44 1 64.

Verify

Suggested check: Verify ICE Lite and SRTP parameters in SBC logging.

Rollback

Revert the ICE Lite configuration on the SBC 1.

Do

Configure ICE Lite, single IPv4 candidate gathering, connectivity checks response, non-audio m-line port 0 handling, and SRTP SDES AES_CM_128_HMAC_SHA1_80 on the SBC 44 6 4 63 64. Configure the SBC per vendor specifications to support Local Media Optimization:

Configure the central SBC to parse incoming X-MS-UserLocation and X-MS-MediaPath headers 37.
Configure the SBC to offer its internal IP for media when the user is internal and its external (public) IP when the user is external, while keeping its signaling presence visible to Teams Phone via its external IP only 15.
Ensure the SBC offers local media candidates by default on inbound calls and sends a re-INVITE if the user turns out to be external 20.

Verify

Review the SBC running configuration to verify that ICE Lite is active, internal and external media interfaces are defined, and LMO SIP header handling is enabled 16 15.

Rollback

Revert the LMO and ICE Lite settings on the SBC according to the vendor's procedure 16.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Configure the central SBC to parse incoming X-MS-UserLocation and X-MS-MediaPath headers 37.
Configure the SBC to offer its internal IP for media when the user is internal and its external (public) IP when the user is external, while keeping its signaling presence visible to Teams Phone via its external IP only 15.
Ensure the SBC offers local media candidates by default on inbound calls and sends a re-INVITE if the user turns out to be external 20.

Verify

Review the SBC running configuration to verify that ICE Lite is active, internal and external media interfaces are defined, and LMO SIP header handling is enabled 16 15.

Rollback

Revert the LMO and ICE Lite settings on the SBC according to the vendor's procedure 16.

Do

Configure ICE Lite, candidate handling, and SRTP SDES on the proxy and downstream SBCs 44 6 4 63 64. Configure the proxy and downstream SBCs per vendor specifications:

Enable the proxy SBC to process X-MS-UserLocation, X-MS-MediaPath, and X-MS-UserSite headers and forward traffic across internal IPs to downstream SBCs 37 29.
Configure downstream SBCs to listen on internal interfaces and process direct media from branch users 17.
Ensure inbound calls default to local media candidates and trigger re-INVITE handling when users are external 20.

Verify

Confirm in SBC management interfaces that ICE Lite and LMO header processing are enabled on both the proxy SBC and downstream SBCs 16.

Rollback

Revert LMO and ICE Lite configurations on the downstream SBCs and proxy SBC according to vendor procedures 16.

Do

Configure ICE Lite, candidate handling, and SRTP SDES on the proxy and downstream SBCs 44 6 4 63 64. Configure the proxy and downstream SBCs per vendor specifications:

Enable the proxy SBC to process X-MS-UserLocation, X-MS-MediaPath, and X-MS-UserSite headers and forward traffic across internal IPs to downstream SBCs 37 29.
Configure downstream SBCs to listen on internal interfaces and process direct media from branch users 17.
Ensure inbound calls default to local media candidates and trigger re-INVITE handling when users are external 20.

Verify

Confirm in SBC management interfaces that ICE Lite and LMO header processing are enabled on both the proxy SBC and downstream SBCs 16.

Rollback

Revert LMO and ICE Lite configurations on the downstream SBCs and proxy SBC according to vendor procedures 16.

Step 4 Open the media firewall paths

Do

Open the required network firewall paths for media bypass:

Client to SBC public IP: Allow UDP/SRTP from client ports 50000-50019 to the SBC's media ports in both directions 39. If any network device translates client source ports, open the translated ports towards the SBC 39. For internal clients reaching the SBC public IP, hair-pinning can be configured on the NAT device so traffic never leaves enterprise equipment 40.
Transport Relays to SBC: Microsoft recommends opening the SBC public IP only to the Microsoft cloud so external users are relayed 43. Open Transport Relay IP ranges: 52.112.0.0/14 for Microsoft 365, Office 365, and GCC; 52.127.88.0/21 for GCC High; 52.127.64.0/21 for DoD 50. Note that Microsoft lists both 52.112.0.0/14 and 52.120.0.0/14 in its relay summary and signaling sections, but lists 52.112.0.0/14 only in its relay port requirement section 48.
Relay ports: The SBC must allow UDP/SRTP from relays on source ports 50000-59999 and send to relays on ports 50000-59999 and 3478-3481 (relay version v4 uses 50000-59999 and v6 uses 3478-3481) 49.
Non-bypass ports: Keep Direct Routing Media Processor ports open (UDP/SRTP ports 3478-3481 and 49152-53247 in both directions) because Media Processors remain in the path for voice applications and web clients 72 46.

Verify

Verify from an internal client subnet that UDP traffic to the SBC public media ports is permitted 39. Inspect firewall logs to verify that UDP/SRTP traffic from 52.112.0.0/14 on ports 50000-59999 reaches the SBC 49 50.

Rollback

Suggested rollback: Remove the client-to-SBC and Transport Relay firewall rules while retaining standard Media Processor firewall access.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Open the required network firewall paths for media bypass:

Client to SBC public IP: Allow UDP/SRTP from client ports 50000-50019 to the SBC's media ports in both directions 39. If any network device translates client source ports, open the translated ports towards the SBC 39. For internal clients reaching the SBC public IP, hair-pinning can be configured on the NAT device so traffic never leaves enterprise equipment 40.
Transport Relays to SBC: Microsoft recommends opening the SBC public IP only to the Microsoft cloud so external users are relayed 43. Open Transport Relay IP ranges: 52.112.0.0/14 for Microsoft 365, Office 365, and GCC; 52.127.88.0/21 for GCC High; 52.127.64.0/21 for DoD 50. Note that Microsoft lists both 52.112.0.0/14 and 52.120.0.0/14 in its relay summary and signaling sections, but lists 52.112.0.0/14 only in its relay port requirement section 48.
Relay ports: The SBC must allow UDP/SRTP from relays on source ports 50000-59999 and send to relays on ports 50000-59999 and 3478-3481 (relay version v4 uses 50000-59999 and v6 uses 3478-3481) 49.
Non-bypass ports: Keep Direct Routing Media Processor ports open (UDP/SRTP ports 3478-3481 and 49152-53247 in both directions) because Media Processors remain in the path for voice applications and web clients 72 46.

Verify

Rollback

Suggested rollback: Remove the client-to-SBC and Transport Relay firewall rules while retaining standard Media Processor firewall access.

Do

Open UDP/SRTP client ports 50000-50019 to the SBC media ports, and open Transport Relay IP ranges and ports 39 50 49. Retain Media Processor port rules 72 46.

Verify

Suggested check: Verify firewall rules permitting client and relay traffic to the SBC.

Rollback

Suggested rollback: Remove media bypass firewall allowances.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Open UDP/SRTP client ports 50000-50019 to the SBC media ports, and open Transport Relay IP ranges and ports 39 50 49. Retain Media Processor port rules 72 46.

Verify

Suggested check: Verify firewall rules permitting client and relay traffic to the SBC.

Rollback

Suggested rollback: Remove media bypass firewall allowances.

Do

Open external paths to the central SBC's public interface for external users: client UDP/SRTP ports 50000-50019, Transport Relay ranges (52.112.0.0/14, 52.127.88.0/21, or 52.127.64.0/21), and relay ports 50000-59999 and 3478-3481 39 50 49. Open internal firewall paths between all internal client subnets and the central SBC's internal media IP, because internal LMO users have no fallback to public Transport Relays 25. Maintain Media Processor ports 3478-3481 and 49152-53247 72 46.

Verify

Verify that UDP packets from each internal site subnet reach the central SBC's internal media IP and ports without dropping 25.

Rollback

Suggested rollback: Remove internal firewall allowances directing client subnets to the central SBC internal IP.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Verify that UDP packets from each internal site subnet reach the central SBC's internal media IP and ports without dropping 25.

Rollback

Suggested rollback: Remove internal firewall allowances directing client subnets to the central SBC internal IP.

Do

On the proxy SBC, open external client paths and Transport Relay ranges (52.112.0.0/14, 52.127.88.0/21, 52.127.64.0/21) and ports 39 50 49. Open internal paths allowing each branch subnet to reach its downstream SBC's internal media address, and across all internal subnets if using Always bypass mode 25 22. Allow internal media routing between the proxy SBC and each downstream SBC 17.

Verify

Verify that each downstream SBC internal media IP is reachable via UDP from its local branch subnets and from the proxy SBC 17 25.

Rollback

Suggested rollback: Remove internal network routing and firewall rules connecting downstream SBCs to local subnets and proxy SBCs.

Do

Verify

Verify that each downstream SBC internal media IP is reachable via UDP from its local branch subnets and from the proxy SBC 17 25.

Rollback

Suggested rollback: Remove internal network routing and firewall rules connecting downstream SBCs to local subnets and proxy SBCs.

Step 5 Add external trusted IPs

Do

Skip this step, as trusted IP addresses are required for Local Media Optimization site identification rather than standard media bypass 16.

Verify

Suggested check: Confirm that no trusted IP configuration is required for plain media bypass.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Skip this step, as trusted IP addresses are required for Local Media Optimization site identification rather than standard media bypass 16.

Verify

Suggested check: Confirm that no trusted IP configuration is required for plain media bypass.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Skip this step 16.

Verify

Suggested check: No verification required.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Skip this step 16.

Verify

Suggested check: No verification required.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Add the external internet egress IP addresses that Teams clients present to Microsoft 365 for every site hosting LMO users 34. Configure these using New-CsTenantTrustedIPAddress in PowerShell or navigate to Locations > Network topology > Trusted IPs in the Teams admin center 34 65. Use mask 32 for single IPv4 addresses, 128 for IPv6, and add both families if Microsoft 365 sees both 34.

Verify

Verify under Locations > Network topology > Trusted IPs that all egress IP addresses are listed 65. Note that changes to network settings can take up to 4 hours to propagate to Teams clients 56.

Rollback

In the Teams admin center under Locations > Network topology > Trusted IPs, select and delete or edit the entries added for this configuration 65.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Verify under Locations > Network topology > Trusted IPs that all egress IP addresses are listed 65. Note that changes to network settings can take up to 4 hours to propagate to Teams clients 56.

Rollback

In the Teams admin center under Locations > Network topology > Trusted IPs, select and delete or edit the entries added for this configuration 65.

Do

For each branch office and proxy site with LMO users, configure the public egress IP addresses using New-CsTenantTrustedIPAddress or under Locations > Network topology > Trusted IPs 34 65. Use mask 32 for individual IPv4 addresses and 128 for IPv6, adding both address families if seen by Microsoft 365 34.

Verify

Confirm all branch egress IP entries appear in Locations > Network topology > Trusted IPs 65. Allow up to 4 hours for propagation before testing 56.

Rollback

Remove the configured branch trusted IPs in the Teams admin center under Locations > Network topology > Trusted IPs 65.

Do

Verify

Confirm all branch egress IP entries appear in Locations > Network topology > Trusted IPs 65. Allow up to 4 hours for propagation before testing 56.

Rollback

Remove the configured branch trusted IPs in the Teams admin center under Locations > Network topology > Trusted IPs 65.

Step 6 Define network regions, sites and subnets

Do

Skip this step, as network sites and subnets are not used for plain media bypass 16.

Verify

Suggested check: Confirm no network topology definitions are needed.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Skip this step, as network sites and subnets are not used for plain media bypass 16.

Verify

Suggested check: Confirm no network topology definitions are needed.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Skip this step 16.

Verify

Suggested check: No verification required.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Skip this step 16.

Verify

Suggested check: No verification required.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Define the LMO network topology in PowerShell or in the Teams admin center under Locations > Network topology > Network sites 65 16:

Create network regions using New-CsTenantNetworkRegion 33.
Create network sites using New-CsTenantNetworkSite, tying each site to a region 33. If all SBCs are reachable from any site, a single site can be configured for all users and SBCs 11. Note that site ID values are case sensitive (for example, "Vietnam" and "vietnam" are treated as different sites) 14.
Create subnets with New-CsTenantNetworkSubnet, tying each subnet to exactly one site 33. Cover all internal subnets, because a client whose public IP matches trusted IPs but whose subnet matches no site is treated as external 32.

Verify

Confirm that all subnets appear assigned to their intended network sites under Locations > Network topology > Network sites 65. Note that propagation to clients may take up to 4 hours 56.

Rollback

In the Teams admin center, remove the subnets and network sites created for LMO under Locations > Network topology > Network sites 65.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Define the LMO network topology in PowerShell or in the Teams admin center under Locations > Network topology > Network sites 65 16:

Create network regions using New-CsTenantNetworkRegion 33.
Create network sites using New-CsTenantNetworkSite, tying each site to a region 33. If all SBCs are reachable from any site, a single site can be configured for all users and SBCs 11. Note that site ID values are case sensitive (for example, "Vietnam" and "vietnam" are treated as different sites) 14.
Create subnets with New-CsTenantNetworkSubnet, tying each subnet to exactly one site 33. Cover all internal subnets, because a client whose public IP matches trusted IPs but whose subnet matches no site is treated as external 32.

Verify

Confirm that all subnets appear assigned to their intended network sites under Locations > Network topology > Network sites 65. Note that propagation to clients may take up to 4 hours 56.

Rollback

In the Teams admin center, remove the subnets and network sites created for LMO under Locations > Network topology > Network sites 65.

Do

Create network regions with New-CsTenantNetworkRegion, network sites with New-CsTenantNetworkSite, and subnets with New-CsTenantNetworkSubnet 33. Ensure that every branch subnet egressing through a trusted IP is associated with its corresponding site, maintaining consistent character casing for site IDs 14 32.

Verify

Check Locations > Network topology > Network sites to ensure all branch subnets map to distinct branch sites 65.

Rollback

Remove the created subnets and branch sites under Locations > Network topology > Network sites 65.

Do

Verify

Check Locations > Network topology > Network sites to ensure all branch subnets map to distinct branch sites 65.

Rollback

Remove the created subnets and branch sites under Locations > Network topology > Network sites 65.

Step 7 Turn on media bypass for the trunk

Do

Configure a secondary bypass trunk to execute Microsoft's recommended phased migration 2:

On the SBC, create a second trunk pointing to Teams using a new FQDN and a different TLS signaling port, keeping the same media ports 52.
Ensure the SBC certificate covers both FQDNs using Subject Alternative Name (SAN) entries or a wildcard certificate 38.
Pair the new trunk using New-CsOnlinePSTNGateway -Identity <new_FQDN> and enable bypass with Set-CsOnlinePSTNGateway -Identity <new_FQDN> -MediaBypass $true 1 47.
Create an Online Voice Routing Policy referencing the new bypass trunk and assign it to pilot test users 52.

Verify

Run Get-CsOnlinePSTNGateway -Identity <new_FQDN> and verify that Enabled is True and MediaBypass is True 67 58. Confirm on the SBC that SIP OPTIONS in both directions are answered with 200 OK 67.

Rollback

Reassign the pilot users' voice routing policy back to the existing non-bypass trunk 52. Set Set-CsOnlinePSTNGateway -Identity <new_FQDN> -MediaBypass $false 47.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Enable media bypass on the existing trunk by running Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $true during an authorized maintenance window 1. Note that switching all users at once immediately exposes all production users to initial trunk and port issues 2.

Verify

Run Get-CsOnlinePSTNGateway -Identity <sbc_FQDN> and confirm MediaBypass is True 58. Check Voice > Direct Routing in the Teams admin center to verify TLS connectivity and SIP options status remain healthy 3.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $false, restoring the parameter to its default setting 58. Revert the SBC ICE Lite configuration 1.

Do

Configure a second trunk FQDN on a different TLS signaling port, ensure the TLS certificate covers both FQDNs, pair with New-CsOnlinePSTNGateway, and run Set-CsOnlinePSTNGateway -Identity <new_FQDN> -MediaBypass $true 52 38 47. Assign a voice routing policy pointing to this trunk to pilot users 52.

Verify

Verify Get-CsOnlinePSTNGateway shows MediaBypass as True and OPTIONS respond with 200 OK 67 58.

Rollback

Reassign pilot users to the non-bypass voice routing policy and set -MediaBypass $false 52 58.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Run Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $true on the existing gateway 1.

Verify

Verify MediaBypass shows True via Get-CsOnlinePSTNGateway 58.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $false 58.

Do

Create a second trunk on the central SBC using a distinct FQDN and signaling port with shared media ports 52. Verify SAN or wildcard certificate coverage 38. Pair the gateway and enable media bypass with Set-CsOnlinePSTNGateway -Identity <new_FQDN> -MediaBypass $true, which is required for LMO 24. Route pilot users to this gateway using an Online Voice Routing Policy 52.

Verify

Verify that Get-CsOnlinePSTNGateway -Identity <new_FQDN> displays MediaBypass as True and OPTIONS are answered with 200 OK 67 58.

Rollback

Reassign pilot users back to their original voice routing policy 52. Set -MediaBypass $false on the pilot gateway 58.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Run Set-CsOnlinePSTNGateway -Identity <central_FQDN> -MediaBypass $true on the existing central trunk 1 24.

Verify

Confirm that Get-CsOnlinePSTNGateway -Identity <central_FQDN> returns MediaBypass as True 58.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <central_FQDN> -MediaBypass $false 58.

Do

On the proxy SBC, configure a second trunk FQDN with a unique TLS port and matching certificate SAN, then run Set-CsOnlinePSTNGateway -Identity <new_proxy_FQDN> -MediaBypass $true 52 38 24. Create pilot voice routing policies targeting the new proxy gateway 52.

Verify

Verify MediaBypass is True on <new_proxy_FQDN> via Get-CsOnlinePSTNGateway 58.

Rollback

Reassign users to the non-bypass policy and set -MediaBypass $false on the pilot proxy gateway 52 58.

Do

Run Set-CsOnlinePSTNGateway -Identity <proxy_FQDN> -MediaBypass $true on the proxy SBC gateway 1 24.

Verify

Run Get-CsOnlinePSTNGateway -Identity <proxy_FQDN> and confirm MediaBypass is True 58.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <proxy_FQDN> -MediaBypass $false 58.

Step 8 Place SBCs in the virtual network topology

Do

Leave -BypassMode at its default value of None, and if an SBC does not have -BypassMode set, Direct Routing does not send the X-MS headers used by Local Media Optimization 57 13.

Verify

Run Get-CsOnlinePSTNGateway and confirm that BypassMode is None 57.

Rollback

Suggested rollback: No virtual topology parameters were set in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Leave -BypassMode at its default value of None, and if an SBC does not have -BypassMode set, Direct Routing does not send the X-MS headers used by Local Media Optimization 57 13.

Verify

Run Get-CsOnlinePSTNGateway and confirm that BypassMode is None 57.

Rollback

Suggested rollback: No virtual topology parameters were set in this step.

Do

Leave -BypassMode at its default value of None 57.

Verify

Suggested check: Verify BypassMode is None via Get-CsOnlinePSTNGateway.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Leave -BypassMode at its default value of None 57.

Verify

Suggested check: Verify BypassMode is None via Get-CsOnlinePSTNGateway.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Assign the central SBC to the virtual network topology by executing: Set-CsOnlinePSTNGateway -Identity <gateway_FQDN> -GatewaySiteID <site_ID> -MediaBypass $true -BypassMode Always -ProxySBC $null 18 24. For a single central SBC, -ProxySBC must be set either to $null or to the SBC's own FQDN 31. Always bypass mode indicates a fully routable network between sites and is the simplest mode to configure 57 11. Ensure the casing of <site_ID> matches the defined network site exactly 14.

Verify

Run Get-CsOnlinePSTNGateway -Identity <gateway_FQDN> and confirm GatewaySiteId is populated, MediaBypass is True, and BypassMode is Always 18.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <gateway_FQDN> -BypassMode None -GatewaySiteID $null to stop Direct Routing from sending X-MS headers 57 13.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Assign the central SBC to the virtual network topology by executing: Set-CsOnlinePSTNGateway -Identity <central_FQDN> -GatewaySiteID <site_ID> -MediaBypass $true -BypassMode Always -ProxySBC $null 18 24. For a single central SBC, -ProxySBC must be set either to $null or to the SBC's own FQDN 31. Always bypass mode indicates a fully routable network between sites and is the simplest mode to configure 57 11. Ensure the casing of <site_ID> matches the defined network site exactly 14.

Verify

Run Get-CsOnlinePSTNGateway -Identity <central_FQDN> and confirm GatewaySiteId is populated, MediaBypass is True, and BypassMode is Always 18.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <central_FQDN> -BypassMode None -GatewaySiteID $null to stop Direct Routing from sending X-MS headers 57 13.

Do

Configure the proxy SBC gateway: Set-CsOnlinePSTNGateway -Identity <proxy_FQDN> -GatewaySiteID <hub_site> -MediaBypass $true -BypassMode Always -ProxySBC $null 31 23.
Create each downstream SBC with New-CsOnlinePSTNGateway and set -GatewaySiteID, -MediaBypass, -BypassMode, and -ProxySBC: Set-CsOnlinePSTNGateway -Identity <downstream_FQDN> -GatewaySiteID <branch_site> -MediaBypass $true -BypassMode <Always|OnlyForLocalUsers> -ProxySBC <proxy_FQDN> 18 31.
Select Always where inter-branch connectivity is good, or OnlyForLocalUsers where branch sites connect reliably only to the hub 22 23 57.
If Location-Based Routing (LBR) is configured with LMO, set -GatewaySiteLbrEnabled $true on each downstream SBC (not mandatory for proxy SBCs) 21. Match site ID casing exactly 14.

Verify

Run Get-CsOnlinePSTNGateway for each gateway and verify that GatewaySiteId, BypassMode, and ProxySBC match the planned topology 18.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <gateway_FQDN> -BypassMode None across proxy and downstream gateways 57 13.

Do

Configure the proxy SBC gateway: Set-CsOnlinePSTNGateway -Identity <proxy_FQDN> -GatewaySiteID <hub_site> -MediaBypass $true -BypassMode Always -ProxySBC $null 31 23.
Create each downstream SBC with New-CsOnlinePSTNGateway and set -GatewaySiteID, -MediaBypass, -BypassMode, and -ProxySBC: Set-CsOnlinePSTNGateway -Identity <downstream_FQDN> -GatewaySiteID <branch_site> -MediaBypass $true -BypassMode <Always|OnlyForLocalUsers> -ProxySBC <proxy_FQDN> 18 31.
Select Always where inter-branch connectivity is good, or OnlyForLocalUsers where branch sites connect reliably only to the hub 22 23 57.
If Location-Based Routing (LBR) is configured with LMO, set -GatewaySiteLbrEnabled $true on each downstream SBC (not mandatory for proxy SBCs) 21. Match site ID casing exactly 14.

Verify

Run Get-CsOnlinePSTNGateway for each gateway and verify that GatewaySiteId, BypassMode, and ProxySBC match the planned topology 18.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <gateway_FQDN> -BypassMode None across proxy and downstream gateways 57 13.

Step 9 Route calls to the right SBC

Do

Maintain the routing policies using separate trunks, routing pilot users to the bypass trunk and remaining users to the existing trunk 52.

Verify

Suggested check: Verify that assigned voice routing policies target the appropriate gateway for pilot and standard users.

Rollback

Suggested rollback: Reassign pilot users back to their original voice routing policies.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Retain your existing voice routing policies, as the trunk FQDN remains unchanged 1.

Verify

Suggested check: Verify that existing voice routes continue to resolve to the central SBC gateway FQDN.

Rollback

Suggested rollback: No routing changes were made in this step.

Do

Maintain voice routing policies pointing pilot users to the test trunk 52.

Verify

Suggested check: Verify policy assignments in PowerShell or the Teams admin center.

Rollback

Suggested rollback: Revert pilot user policy assignments.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Retain existing voice routing policies 1.

Verify

Suggested check: Verify existing routing policy resolution.

Rollback

Suggested rollback: No routing changes were made in this step.

Do

Retain voice routes pointing to the central SBC, which handles PSTN connectivity for all branch locations 29.

Verify

Suggested check: Verify that voice routes correctly list the central SBC gateway FQDN.

Rollback

Suggested rollback: No routing changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Retain voice routes pointing to the central SBC, which handles PSTN connectivity for all branch locations 29.

Verify

Suggested check: Verify that voice routes correctly list the central SBC gateway FQDN.

Rollback

Suggested rollback: No routing changes were made in this step.

Do

In the relevant Online Voice Routing Policy, configure two voice routes:

A priority-1 route matching the branch local number pattern (for example, ^+84(\d{9})$), routed to the downstream SBC 28. Note that downstream SBCs can be assigned to voice routes even though they have no public IPs 17.
A priority-2 route matching .*, routed to the proxy SBC, which handles all other calls and catches local calls if the downstream SBC fails 28.

Verify

Place a test call to a local number and verify in SBC signaling traces that the downstream SBC's FQDN appears in the Request-URI 37.

Rollback

Remove the priority-1 voice route pointing to the downstream SBC so that calls fall back to the proxy SBC route 28.

Do

In the relevant Online Voice Routing Policy, configure two voice routes:

A priority-1 route matching the branch local number pattern (for example, ^+84(\d{9})$), routed to the downstream SBC 28. Note that downstream SBCs can be assigned to voice routes even though they have no public IPs 17.
A priority-2 route matching .*, routed to the proxy SBC, which handles all other calls and catches local calls if the downstream SBC fails 28.

Verify

Place a test call to a local number and verify in SBC signaling traces that the downstream SBC's FQDN appears in the Request-URI 37.

Rollback

Remove the priority-1 voice route pointing to the downstream SBC so that calls fall back to the proxy SBC route 28.

Step 10 Confirm trunk health

Do

Verify gateway connectivity by running Get-CsOnlinePSTNGateway -Identity <sbc_FQDN> in PowerShell and monitoring SIP OPTIONS ping transactions directly on the SBC 67. Open Voice > Direct Routing in the Teams admin center to review the Direct Routing health dashboard 3.

Verify

Confirm that Get-CsOnlinePSTNGateway shows Enabled as True and that SBC logs show mutual 200 OK responses to OPTIONS pings 67. In the Direct Routing health dashboard, verify that TLS connectivity and SIP options status report Active, and that network effectiveness is not degraded 3. Note that dashboard jitter, packet loss, and latency metrics are measured between Direct Routing and the SBC, not across the bypassed client media leg 3.

Step 11 Verify the media path with test calls

Do

Place test calls from a Teams desktop client on the enterprise network, from an external Teams desktop client, and from a Teams web client 41. Capture SIP signaling and media packets on the SBC 39.

Verify

Inspect the SBC media stream for each test scenario:

Internal desktop client: Media travels directly between the SBC public IP and the client (or NAT) IP on client ports 50000-50019 39. SIP signaling always flows via the Microsoft cloud 53.
External client: Media arrives from an IP address within the Transport Relay ranges (52.112.0.0/14, 52.127.88.0/21, or 52.127.64.0/21) 50 51.
Web client: Media connects to Microsoft Media Processors 46. If a call fails before reaching Direct Routing internal components, check the SBC logs for detailed error descriptions 54.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Place test calls from a Teams desktop client on the enterprise network, from an external Teams desktop client, and from a Teams web client 41. Capture SIP signaling and media packets on the SBC 39.

Verify

Inspect the SBC media stream for each test scenario:

Internal desktop client: Media travels directly between the SBC public IP and the client (or NAT) IP on client ports 50000-50019 39. SIP signaling always flows via the Microsoft cloud 53.
External client: Media arrives from an IP address within the Transport Relay ranges (52.112.0.0/14, 52.127.88.0/21, or 52.127.64.0/21) 50 51.
Web client: Media connects to Microsoft Media Processors 46. If a call fails before reaching Direct Routing internal components, check the SBC logs for detailed error descriptions 54.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Place test calls from internal, external, and web clients while capturing media traces on the SBC 41 39.

Verify

Verify direct client IP connection on internal calls, Transport Relay addresses on external calls, and Media Processors on web clients 39 51 46.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Place test calls from internal, external, and web clients while capturing media traces on the SBC 41 39.

Verify

Verify direct client IP connection on internal calls, Transport Relay addresses on external calls, and Media Processors on web clients 39 51 46.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Place inbound and outbound test calls from an internal network subnet and from an external network, capturing SIP signaling and media on the central SBC 37.

Verify

Inspect SIP headers and media streams:

Internal user: Outbound and inbound INVITEs contain X-MS-UserLocation: internal and X-MS-UserSite: <site_ID>, and media flows over the central SBC's internal IP address 37 15. If an internal client shows as external, verify trusted IP and subnet-to-site assignments 32.
External user: Signaling contains X-MS-UserLocation: external, and media connects to the SBC's external public IP 37 15.
Inbound call to an external user: Confirm the SBC sends a re-INVITE after the initial offer with local candidates 20.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Place inbound and outbound test calls from an internal network subnet and from an external network, capturing SIP signaling and media on the central SBC 37.

Verify

Inspect SIP headers and media streams:

Internal user: Outbound and inbound INVITEs contain X-MS-UserLocation: internal and X-MS-UserSite: <site_ID>, and media flows over the central SBC's internal IP address 37 15. If an internal client shows as external, verify trusted IP and subnet-to-site assignments 32.
External user: Signaling contains X-MS-UserLocation: external, and media connects to the SBC's external public IP 37 15.
Inbound call to an external user: Confirm the SBC sends a re-INVITE after the initial offer with local candidates 20.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Place test calls from a branch user to a local number, from a remote branch user, and from an external user, capturing SIP messages on the proxy SBC and downstream SBCs 37.

Verify

Inspect the SIP signaling and media routing:

Local branch user: X-MS-UserLocation: internal is present, X-MS-MediaPath lists only the downstream SBC, and media connects directly to the downstream SBC internal IP 26 17.
External user: X-MS-UserLocation: external is present, X-MS-MediaPath lists the proxy SBC and then the downstream SBC, and media flows to the proxy SBC public IP 26 17.
Inter-branch user: If the downstream SBC is in Always mode, media goes directly to its internal IP; if in OnlyForLocalUsers mode, media routes via the proxy SBC 22 23.
Note that users may experience a few seconds of silence during initial call establishment due to architectural complexity 30.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Place test calls from a branch user to a local number, from a remote branch user, and from an external user, capturing SIP messages on the proxy SBC and downstream SBCs 37.

Verify

Inspect the SIP signaling and media routing:

Local branch user: X-MS-UserLocation: internal is present, X-MS-MediaPath lists only the downstream SBC, and media connects directly to the downstream SBC internal IP 26 17.
External user: X-MS-UserLocation: external is present, X-MS-MediaPath lists the proxy SBC and then the downstream SBC, and media flows to the proxy SBC public IP 26 17.
Inter-branch user: If the downstream SBC is in Always mode, media goes directly to its internal IP; if in OnlyForLocalUsers mode, media routes via the proxy SBC 22 23.
Note that users may experience a few seconds of silence during initial call establishment due to architectural complexity 30.

Rollback

Suggested rollback: No configuration changes were made in this step.

Step 12 Check the calls that are expected to leave the direct path

Do

Place calls that trigger non-bypass behavior: escalate a 1:1 call to a multiparty group call, place a call to a federated Teams user, transfer a call to a Skype for Business user, and route an incoming call through an Auto Attendant or Call Queue 45 46.

Verify

Confirm that Microsoft Media Processors are inserted into the media path for these scenarios as expected by design, and confirm that two-way audio functions normally 45 46.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Verify

Confirm that Microsoft Media Processors are inserted into the media path for these scenarios as expected by design, and confirm that two-way audio functions normally 45 46.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Place test calls involving group escalations, federated users, and voice applications 45 46.

Verify

Verify that Media Processors handle audio for voice apps and escalations 46.

Rollback

Suggested rollback: No configuration changes were made in this step.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Place test calls involving group escalations, federated users, and voice applications 45 46.

Verify

Verify that Media Processors handle audio for voice apps and escalations 46.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Test voice application interactions, call hold and resume, and transfers:

Route calls through Auto Attendant and Call Queue services 35.
Place an active call on hold and resume it 19.
Transfer a call from an Auto Attendant to an LMO-enabled user 35.

Verify

Confirm expected media re-routing:

Voice application calls flow through the central/proxy SBC rather than following an optimized path, except when an Auto Attendant transfers directly to an LMO user, which follows the optimized path as a 1:1 call 35.
When a user puts a call on hold and resumes, the call continues via the central/proxy SBC rather than the optimized path, because hold escalates the call to multiparty and is never de-escalated 19.

Rollback

Suggested rollback: No configuration changes were made in this step.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Test voice application interactions, call hold and resume, and transfers:

Route calls through Auto Attendant and Call Queue services 35.
Place an active call on hold and resume it 19.
Transfer a call from an Auto Attendant to an LMO-enabled user 35.

Verify

Confirm expected media re-routing:

Voice application calls flow through the central/proxy SBC rather than following an optimized path, except when an Auto Attendant transfers directly to an LMO user, which follows the optimized path as a 1:1 call 35.
When a user puts a call on hold and resumes, the call continues via the central/proxy SBC rather than the optimized path, because hold escalates the call to multiparty and is never de-escalated 19.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Test calls involving Auto Attendant, Call Queue, and call hold and resume across proxy and downstream SBCs 35 19.

Verify

Verify that voice app calls route through the proxy SBC, Auto Attendant transfers to LMO users optimize directly to the downstream SBC, and resuming held calls routes via the proxy SBC 35 19.

Rollback

Suggested rollback: No configuration changes were made in this step.

Do

Test calls involving Auto Attendant, Call Queue, and call hold and resume across proxy and downstream SBCs 35 19.

Verify

Verify that voice app calls route through the proxy SBC, Auto Attendant transfers to LMO users optimize directly to the downstream SBC, and resuming held calls routes via the proxy SBC 35 19.

Rollback

Suggested rollback: No configuration changes were made in this step.

Step 13 Complete the rollout

Do

Once pilot users validate media path performance, update your production Online Voice Routing Policies to point remaining users to the bypass-enabled trunk 2.

Verify

Verify in Call Analytics and on the Direct Routing health dashboard that production call quality metrics and network effectiveness remain normal 3 54.

Rollback

Revert the production Online Voice Routing Policies back to the original non-bypass trunk FQDN 52.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Monitor tenant call quality and SBC health in the Direct Routing health dashboard and Call Analytics following the cutover 3 54.

Verify

Confirm that network effectiveness and average call duration metrics on the Direct Routing health dashboard remain steady 3.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $false to revert the trunk to non-bypass operation 58.

Do

Migrate remaining production users by updating their voice routing policy to use the bypass trunk 2.

Verify

Check Call Analytics and health dashboard metrics 3.

Rollback

Revert voice routing policies back to non-bypass trunks 52.

Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP

Do

Monitor Direct Routing dashboard metrics and SBC logs 3 54.

Verify

Confirm trunk effectiveness remains stable 3.

Rollback

Set Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $false 58.

Do

Point the remaining production users' Online Voice Routing Policies to the LMO-enabled trunk 2.

Verify

Verify call metrics across migrated sites on the Direct Routing health dashboard 3.

Rollback

Reassign voice routing policies to the non-bypass trunk 52.

Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites

Do

Monitor the health dashboard and SBC logs for unexpected call drops or media path failures across all sites 3 54.

Verify

Verify that network effectiveness ratings in the Direct Routing health dashboard remain uncompromised 3.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <central_FQDN> -MediaBypass $false -BypassMode None 58 57.

Do

Update branch user Online Voice Routing Policies to target downstream and proxy SBC routes across the organization 2 28.

Verify

Check that call volume establishes across downstream SBCs with stable network effectiveness on the Direct Routing dashboard 3.

Rollback

Revert user voice routing policies to routes pointing exclusively to non-bypass trunks 52.

Do

Monitor post-cutover performance across downstream and proxy SBCs using the Direct Routing health dashboard and Call Analytics 3 54.

Verify

Confirm that call completion rates and health dashboard metrics remain stable 3.

Rollback

Run Set-CsOnlinePSTNGateway -Identity <gateway_FQDN> -MediaBypass $false -BypassMode None on proxy and downstream gateways 58 57.

Applicability

Applies to: Microsoft Teams Phone Direct Routing, Microsoft Teams admin center, Microsoft Teams Phone, MicrosoftTeams PowerShell module, and IETF ICE. Deployments: on-premises, multi-tenant, dod, gcc, and gcc-high. Sources checked 2026-09-30. For government environments, Transport Relay ranges apply to GCC (52.112.0.0/14), GCC High (52.127.88.0/21), and DoD (52.127.64.0/21) 50. SIP signaling endpoints connect over port 5061 to sip.pstnhub.microsoft.com (commercial and GCC), sip.pstnhub.gov.teams.microsoft.us (GCC High), or sip.pstnhub.dod.teams.microsoft.us (DoD) 73. Direct Routing requires certified SBC firmware versions, such as Ribbon SBC Core 8.2 or higher, anynode 4.0.1+, or Avaya ASBCE 10.1.2 or higher for Local Media Optimization 61.

What remains uncertain

Whether Microsoft has officially retired the v4 Transport Relay port range (50000-59999) in favor of v6 ports (3478-3481) is not covered by the sources below. Whether Local Media Optimization is supported in GCC High and DoD sovereign clouds is not covered by the sources below. PowerShell cmdlets for deleting tenant network subnets, sites, and regions during rollback are not covered by the sources below.

Sources

1
Microsoft lists three conditions to turn on media bypass: the SBC vendor supports it and documents SBC-side configuration, the trunk is switched with Set-CsOnlinePSTNGateway -Identity <sbc_FQDN> -MediaBypass $true, and the required ports are open.
Configure media bypass with Direct Routing · Introductory numbered list (conditions 1-3) · Checked 2026-09-30
2
Microsoft recommends a phased migration to media bypass (new trunk for the same SBC on a different port, tested, then users' voice routing policy pointed to it) over switching all users at once, which exposes all production users to initial trunk and port issues.
Configure media bypass with Direct Routing · Migrate from non-bypassed trunks to bypass-enabled trunks · Checked 2026-09-30
3
The Direct Routing health dashboard, under Voice > Direct Routing in the Teams admin center, shows per-SBC TLS connectivity, SIP options status, network effectiveness and concurrent calls, and jitter, packet loss and latency measured from the Direct Routing interface to the SBC.
Health dashboard for Direct Routing · View the health dashboard; The SBCs tab; Detailed information for each SBC · Checked 2026-09-30
4
The SBC's ICE Lite implementation must respond to every connectivity check it receives and must not send connectivity check requests; Microsoft warns that sending them can surface unexpected peer-derived candidates and cause call failures.
Direct Routing support for media bypass - Microsoft Teams · ICE Lite requirements > Connectivity checks · Checked 2026-09-30
5
Because an inbound call can fork to several Teams endpoints of one user, the SBC must answer connectivity checks and accept nominations from multiple endpoints, before or after the 200 OK, and must not change ICE candidates, password or ufrag between a 183 and the 200 OK.
Direct Routing support for media bypass - Microsoft Teams · ICE Lite requirements > Nominations and Converging for forking; Scenarios > Outbound call to SBC, Note · Checked 2026-09-30
6
In media bypass the SBC must offer only one ICE candidate, and only IPv4 candidates are currently supported.
Direct Routing support for media bypass - Microsoft Teams · ICE Lite requirements > Candidate gathering · Checked 2026-09-30
7
Plain media bypass cannot serve branch SBCs that lack public IPs, because bypass requires the client to reach the SBC's public IP while downstream SBCs are reachable by Teams only through a proxy SBC defined in the LMO virtual topology; a proxy/downstream design therefore implies Local Media Optimization.inferred
Local Media Optimization for Direct Routing · Proxy SBC with connected downstream SBCs; combined with ms-learn-dr-media-bypass 'Call flow if the user has direct access to the public IP address of the SBC' and ms-learn-set-csonlinepstngateway -ProxySbc ('Used in Local Media Optimization configurations') · Checked 2026-09-30
8
In a proxy/downstream LMO design the proxy SBC must have IP reachability to each downstream SBC's internal address, since external users' media and Only-for-local-users cross-site media are relayed by the proxy to the downstream SBC.inferred
Local Media Optimization for Direct Routing · Proxy SBC with connected downstream SBCs, External user; Mode 2 Scenario 2 (proxy redirects to internal IP of downstream SBC) · Checked 2026-09-30
9
Microsoft's monitoring pages describe no dedicated indicator of whether a given call was bypassed, so the practical evidence of the media path is on the SBC: the negotiated remote media address (client, Transport Relay or Media Processor range) and, with LMO, the X-MS headers received.inferred
Monitor Direct Routing · Whole page (no media-bypass indicator described); combined with ms-learn-dr-health-dashboard and ms-learn-dr-media-bypass port/range tables · Checked 2026-09-30
10
IPv6 on Direct Routing is supported only for non-media-bypass scenarios: media bypass is not supported with IPv6 SIP or media or with the IPv6 Teams client.
Connect your Session Border Controller (SBC) to Direct Routing · Use PowerShell > Connect the SBC to the tenant > Considerations, IPAddressVersion bullet · Checked 2026-09-30
11
Always Bypass is the simplest LMO mode to configure, and the tenant administrator can configure a single site for all users and SBCs if all SBCs are reachable from any site.
Configure Local Media Optimization for Direct Routing · Call flows > Always Bypass mode, paragraph 1 · Checked 2026-09-30
12
Microsoft recommends Local Media Optimization for keeping media inside the intranet, but says a tenant that already uses media bypass with only the public IPs of its SBCs does not need to move to Local Media Optimization.
Local Media Optimization for Direct Routing · Introduction, Note · Checked 2026-09-30
13
If an SBC does not have -BypassMode set, Direct Routing does not send the X-MS headers that Local Media Optimization relies on.
Configure Local Media Optimization for Direct Routing · Define the virtual network topology, notes bullet 3 · Checked 2026-09-30
14
LMO configuration parameters are case sensitive, so GatewaySiteID values such as "Vietnam" and "vietnam" are treated as different sites.
Configure Local Media Optimization for Direct Routing · Define the network topology, paragraph 2; Define the virtual network topology, notes bullet 4 · Checked 2026-09-30
15
In the central-SBC scenario the SBC offers its internal IP for media when the user is on the corporate network and its external (public) IP when the user is outside it, while being visible to Teams Phone through its external IP only.
Local Media Optimization for Direct Routing · Central SBC with centralized trunks; Internal user and External user subsections · Checked 2026-09-30
16
Configuring Local Media Optimization requires configuring the user and SBC sites (external trusted IPs, network regions, sites and subnets, then assigning SBCs to sites with modes and proxy values) and configuring the SBCs per the SBC vendor's specification; the network part can be done in the Teams admin center or PowerShell.
Configure Local Media Optimization for Direct Routing · Introduction numbered list; Configure the user and the SBC sites, numbered list · Checked 2026-09-30
17
Downstream SBCs have no public IPs but can be assigned to voice routes; users in the downstream SBC's branch send media to it directly, while external users send media to the proxy SBC's public IP, which proxies it to the downstream SBC.
Local Media Optimization for Direct Routing · Proxy SBC with connected downstream SBCs, paragraphs 2-3 · Checked 2026-09-30
18
The LMO virtual network topology is defined by creating each SBC with New-CsOnlinePSTNGateway and then setting -GatewaySiteID, -MediaBypass, -BypassMode (Always or OnlyForLocalUsers) and -ProxySBC with Set-CsOnlinePSTNGateway.
Configure Local Media Optimization for Direct Routing · Define the virtual network topology, paragraph 1 and syntax block · Checked 2026-09-30
19
After a Teams user puts an LMO call on hold and resumes it, the call continues via the central (proxy) SBC rather than the optimized path, because hold escalates the call to multiparty and it is by design never de-escalated.
Local Media Optimization for Direct Routing · Known behaviors table, row 2 · Checked 2026-09-30
20
On an inbound LMO call the user's location is unknown to the SBC, which offers local media candidates by default and must send a re-INVITE if the user turns out to be external; Direct Routing calculates the media path from the Record-Route and Contact fields the SBC supplies.
Configure Local Media Optimization for Direct Routing · Call flows > Always Bypass mode > Inbound calls and the user is in the same location as the SBC; Inbound calls and the user is external · Checked 2026-09-30
21
When Local Media Optimization and Location-Based Routing are configured together, each downstream SBC must have GatewaySiteLbrEnabled set to $true; this is not mandatory for the proxy SBC.
Configure Local Media Optimization for Direct Routing · Define the virtual network topology, Note after example commands · Checked 2026-09-30
22
In Always bypass mode an internal user's media goes to the downstream SBC's internal IP wherever in the corporate network the user is, and Microsoft recommends this mode when connectivity between branch offices is good.
Local Media Optimization for Direct Routing · Local Media Optimization modes, Mode 1; Mode 1: Always bypass, paragraph 1 · Checked 2026-09-30
23
In Only for local users mode media goes directly to the downstream SBC's internal IP only for internal users in the same branch; Microsoft recommends it when links between branches are poor but each branch links well to a regional office, with the regional proxy SBC set to Always and downstream SBCs set to OnlyForLocalUsers.
Local Media Optimization for Direct Routing · Local Media Optimization modes, Mode 2; Mode 2: Only for local users, paragraphs 1-3 · Checked 2026-09-30
24
The -MediaBypass parameter must be set to $true for an SBC to support Local Media Optimization.
Configure Local Media Optimization for Direct Routing · Define the virtual network topology, notes bullet 2 · Checked 2026-09-30
25
With Local Media Optimization, internal users must have media connectivity to the SBC's internal IP; there is no fallback to public Transport Relays because the SBC offers an internal IP.
Local Media Optimization for Direct Routing · Local Media Optimization modes, Note · Checked 2026-09-30
26
In Microsoft's Always-bypass examples, an outbound call from an internal user at the downstream site carries X-MS-UserLocation: internal and X-MS-MediaPath naming only the downstream SBC, while an external user's call carries X-MS-UserLocation: external and X-MS-MediaPath listing the proxy SBC then the downstream SBC.
Configure Local Media Optimization for Direct Routing · Call flows > Always Bypass mode > Outbound calls and the user is in the same location as the SBC / Outbound calls and the user is external, header tables · Checked 2026-09-30
27
Local Media Optimization lets administrators keep media local within corporate network subnets and allows media between Teams clients and SBCs even when the SBCs sit behind corporate firewalls with private IPs not directly visible to Microsoft.
Local Media Optimization for Direct Routing · Introduction, bulleted list · Checked 2026-09-30
28
Microsoft's LMO examples use an Online Voice Routing Policy whose priority-1 route sends local numbers (for example ^+84(\d{9})$) to the downstream SBC and whose priority-2 route .* sends all other calls, and local calls if the downstream SBC fails, to the proxy SBC.
Local Media Optimization for Direct Routing · Mode 2: Only for local users > Scenario 1, paragraph and Table 5 · Checked 2026-09-30
29
Local Media Optimization supports two scenarios: a central SBC with centralized trunks serving all branches, and a proxy SBC paired with Teams through its external IP with downstream branch SBCs that communicate over internal IPs and are not directly visible to Teams Phone.
Local Media Optimization for Direct Routing · Introduction, 'Local Media Optimization supports two scenarios' · Checked 2026-09-30
30
With Local Media Optimization a user might hear a few seconds of silence while a call is being established, which Microsoft attributes to the complexity of the architecture.
Local Media Optimization for Direct Routing · Known behaviors table, row 3 · Checked 2026-09-30
31
For a single SBC (the central SBC with centralized trunks scenario), -ProxySBC must be set either to $null or to that SBC's own FQDN; Microsoft's example sets the proxy SBC itself with -ProxySBC $null and each downstream SBC with -ProxySBC set to the proxy's FQDN.
Configure Local Media Optimization for Direct Routing · Define the virtual network topology, notes bullet 1 and example commands · Checked 2026-09-30
32
A Teams client is not identified as internal when its public IP matches the trusted IP list but its subnet matches no network site; Local Media Optimization requires a matching network site for every connection from a listed trusted IP.
Local Media Optimization for Direct Routing · Known behaviors table, row 1 · Checked 2026-09-30
33
The LMO network topology is defined with New-CsTenantNetworkRegion, New-CsTenantNetworkSite (each site tied to a region) and New-CsTenantNetworkSubnet (each subnet tied to exactly one site).
Configure Local Media Optimization for Direct Routing · Define the network topology > Define network regions / sites / subnets · Checked 2026-09-30
34
For Local Media Optimization, the external internet IPs that Teams clients use to reach Microsoft 365 must be added for every site with LMO users using New-CsTenantTrustedIPAddress, with mask 32 for single IPv4 addresses, 128 for IPv6, and both families added if Microsoft 365 sees both.
Configure Local Media Optimization for Direct Routing · Manage external trusted IP addresses · Checked 2026-09-30
35
Calls involving voice apps such as Auto Attendant and Call Queue are not optimized by Local Media Optimization and flow through the proxy SBC, except transfers from an Auto Attendant to an LMO user, which follow the optimized path as a direct 1:1 call.
Local Media Optimization for Direct Routing · Known behaviors table, row 4 (Voice apps) · Checked 2026-09-30
36
With split-tunnel VPN, a client detected as external is signalled to the SBC as external even if it can reach the SBC's internal interface, which can cause prolonged call setup or no audio on PSTN calls; Microsoft says VPN administrators must block access between remote VPN users and the SBC internal interface.
Configure Local Media Optimization for Direct Routing · Configure the user and the SBC sites, Note · Checked 2026-09-30
37
When BypassMode is defined, Direct Routing adds X-MS-UserLocation (internal or external), X-MS-MediaPath (the ordered SBCs for the media path, target SBC last) and X-MS-UserSite (the administrator-defined site) to INVITEs and re-INVITEs, and puts the target SBC FQDN in the Request-URI even when that SBC is not directly connected.
Configure Local Media Optimization for Direct Routing · Define the virtual network topology, X-MS Headers table · Checked 2026-09-30
38
When two trunks share one SBC, the SBC certificate must cover both FQDNs, either as two SAN names or with a wildcard certificate.
Plan for media bypass with Direct Routing · Configure separate trunks for media bypass and non-media bypass, paragraph after the example table · Checked 2026-09-30
39
Direct media between client and SBC is UDP/SRTP with client ports 50000-50019 and SBC ports defined on the SBC, in both directions; if a network device translates client source ports, the translated ports must be opened towards the SBC.
Plan for media bypass with Direct Routing · Media traffic: IP and Port ranges > Requirements for direct media traffic, table and Note · Checked 2026-09-30
40
For media bypass the Teams client must be able to reach the SBC's public IP address even from the internal network; Microsoft notes hairpinning can be configured on the NAT device so that traffic never leaves enterprise network equipment.
Plan for media bypass with Direct Routing · Call flow if the user has direct access to the public IP address of the SBC, bullet 1; Requirements for direct media traffic, Note · Checked 2026-09-30
41
Media bypass is supported on standalone Teams desktop clients, Android and iOS clients and Teams Phone devices; calls on other endpoints, including Teams web clients and Skype for Business 3PIP phones, are automatically converted to non-bypass.
Plan for media bypass with Direct Routing · Client endpoints supported with media bypass · Checked 2026-09-30
42
With media bypass, Direct Routing media is kept between the SBC and the Teams client instead of passing through Microsoft Teams Phone, and Microsoft states the SBC and client must be in the same location or network for it to apply.
Plan for media bypass with Direct Routing · About media bypass with Direct Routing, paragraph 1 · Checked 2026-09-30
43
Microsoft recommends not exposing the SBC public IP to external clients and instead opening it only to the Microsoft cloud so external users' bypassed media is relayed by Teams Transport Relays; letting external clients reach the SBC public IP directly is listed as not recommended.
Plan for media bypass with Direct Routing · Call flow if the user doesn't have access to the public IP address of the SBC; Call flow if a user is outside the network and has access to the public IP of the SBC, Note · Checked 2026-09-30
44
Media bypass uses ICE on the Teams client and ICE Lite on the SBC to find the most direct media path.
Plan for media bypass with Direct Routing · About media bypass with Direct Routing, paragraph after the Frankfurt example · Checked 2026-09-30
45
Even on a bypass trunk, Media Processors are always inserted when a call escalates from 1:1 to a group call, goes to a federated Teams user, or is forwarded or transferred to a Skype for Business user.
Plan for media bypass with Direct Routing · Use of Teams Media Processors if trunk is configured for media bypass · Checked 2026-09-30
46
Media Processors are never in the media path for bypassed end-user calls but are always in the path for voice applications such as Call Park, Auto Attendant and Call Queues, and for Teams web clients.
Plan for media bypass with Direct Routing · Use of Media Processors and Transport Relays, bullets and summary table; Requirements for using media processors · Checked 2026-09-30
47
Media bypass is controlled per SBC with Set-CsOnlinePSTNGateway and the -MediaBypass parameter set to true or false; enabling it does not mean all media stays inside the corporate network.
Plan for media bypass with Direct Routing · About media bypass with Direct Routing, paragraph 2 · Checked 2026-09-30
48
Microsoft's media bypass planning page lists both 52.112.0.0/14 and 52.120.0.0/14 in its Media Processor and Transport Relay summary and as the subnets the pstnhub signaling FQDNs resolve to, but its Transport Relay and Media Processor port-requirement sections for Microsoft 365, Office 365 and GCC list 52.112.0.0/14 only.
Plan for media bypass with Direct Routing · Use of Media Processors and Transport Relays, 'The IP ranges are'; SIP Signaling: FQDNs; Requirements for using Transport Relays; Requirements for using media processors · Checked 2026-09-30
49
For bypassed calls relayed by Teams Transport Relays, the SBC must allow UDP/SRTP from relays on source ports 50000-59999 and send to relays on 50000-59999 and 3478-3481, because relay version v4 uses only 50000-59999 and v6 uses 3478-3481.
Plan for media bypass with Direct Routing · Requirements for using Transport Relays, port table and Note · Checked 2026-09-30
50
Transport Relays for bypassed calls use the same ranges as Media Processors: 52.112.0.0/14 for Microsoft 365, Office 365 and GCC, 52.127.88.0/21 for GCC High and 52.127.64.0/21 for DoD.
Plan for media bypass with Direct Routing · Requirements for using Transport Relays, per-environment subsections · Checked 2026-09-30
51
Transport Relays are in the path of a bypassed end-user call only when the client cannot reach the SBC on its public IP address, and because relays are not B2BUAs the codec is never changed between client and SBC.
Plan for media bypass with Direct Routing · Use of Media Processors and Transport Relays, summary table and transcoding explanation · Checked 2026-09-30
52
To trial media bypass, Microsoft describes creating a second trunk with a different FQDN on the same SBC with media bypass enabled, using a different TLS signaling port but the same media ports, then a new Online Voice Routing Policy routing to that trunk assigned to the test users.
Plan for media bypass with Direct Routing · Configure separate trunks for media bypass and non-media bypass, high-level steps · Checked 2026-09-30
53
With media bypass, SIP signaling always flows via the Microsoft cloud; only media takes the direct path.
Plan for media bypass with Direct Routing · Call flow and firewall planning > Call flow if the user has direct access to the public IP address of the SBC, bullet 3 · Checked 2026-09-30
54
Call Analytics shows SIP codes only for calls that reach Direct Routing's internal components; for pairing problems or rejected INVITEs Microsoft directs administrators to the SBC logs, where Direct Routing's detailed error descriptions appear.
Monitor Direct Routing · Monitor Call Quality Analytics dashboard and SBC logs, final paragraph · Checked 2026-09-30
55
A client whose external IP matches no trusted IP is classified as being at an unknown location, and network configuration lookups are not supported with cloud proxy services that modify Teams clients' source IP addresses.
Network settings for cloud voice features · Trusted IP address section, final paragraph and Important note · Checked 2026-09-30
56
Changes to Teams network settings can take up to four hours to propagate to Teams clients.
Network settings for cloud voice features · Introduction, paragraph 4 · Checked 2026-09-30
57
Set-CsOnlinePSTNGateway -BypassMode accepts None, Always and OnlyForLocalUsers with a default of None; Always indicates a fully routable network between sites, OnlyForLocalUsers indicates no direct connection between sites.
Set-CsOnlinePSTNGateway (MicrosoftTeams) · Parameters > -BypassMode · Checked 2026-09-30
58
The -MediaBypass parameter of Set-CsOnlinePSTNGateway indicates that the SBC supports media bypass and the administrator wants to use it, and its default value is $false.
Set-CsOnlinePSTNGateway (MicrosoftTeams) · Parameters > -MediaBypass · Checked 2026-09-30
59
RFC 8445 defines lite ICE agents as using only host candidates and not generating connectivity checks or running state machines, while still responding to connectivity checks; RFC 8445 obsoletes RFC 5245, which Microsoft's pages still cite.
RFC 8445: Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal · Section 2.5 (Lite implementations); Section 4 (Terminology); document header · Checked 2026-09-30
60
Microsoft's certified SBC list marks non-media-bypass and media-bypass certification separately, and some certified products (for example Thinktel Think 365 SBC, Patton SmartNode eSBC and Frafos ABC SBC) are certified for non-media bypass only.
Session Border Controllers certified for Direct Routing - Microsoft Teams · Certified SBC vendors table, Media bypass column · Checked 2026-09-30
61
Local Media Optimization support is listed in a separate table with its own minimum software versions (for example Ribbon SBC Core 8.2 or higher, anynode 4.0.1+, Avaya ASBCE 10.1.2 or higher), distinct from the media bypass certification versions.
Session Border Controllers certified for Direct Routing - Microsoft Teams · Support for Local Media Optimization table · Checked 2026-09-30
62
Media re-targeting is not supported: if the SBC signals a new media IP during a Direct Routing call, Teams Direct Routing never sends media to the new address even though it was negotiated in SIP.
Session Border Controllers certified for Direct Routing - Microsoft Teams · Final Note on the page · Checked 2026-09-30
63
With media bypass, Direct Routing does not strip non-audio m-lines (for example m=video on a forwarded video call), so the SBC must answer each non-audio m-line with port zero per RFC 3264 to reject it.
Direct Routing support for media bypass - Microsoft Teams · Scenarios > Handling M lines in SDP · Checked 2026-09-30
64
In bypass mode the SBC must support SRTP cipher AES_CM_128_HMAC_SHA1_80, and its SDP offer must contain SDES (DTLS optional); if a client is DTLS-only, Direct Routing inserts a Media Processor and converts the call to non-bypass.
Direct Routing support for media bypass - Microsoft Teams · SRTP support requirements; SDES support requirements; Format for offer from SBC in bypass mode · Checked 2026-09-30
65
In the Teams admin center, network sites (with region and subnets) are configured under Locations > Network topology > Network sites, and external trusted IPs under Locations > Network topology > Trusted IPs.
Manage your network topology for cloud voice features in Microsoft Teams · Configure network settings in the Microsoft Teams admin center; Manage external trusted IP addresses · Checked 2026-09-30
66
The SBC settings table in Microsoft's connect-the-SBC article lists no media bypass, bypass mode, gateway site or proxy SBC field for the Teams admin center, so PowerShell (Set-CsOnlinePSTNGateway) is the documented way to apply them; GCC High and DoD must use PowerShell to connect SBCs in any case.inferred
Connect your Session Border Controller (SBC) to Direct Routing · SBC settings table; opening Note on GCC High and DoD · Checked 2026-09-30
67
Microsoft's documented pairing check is Get-CsOnlinePSTNGateway -Identity <FQDN> showing the SBC with Enabled True, plus confirming in the SBC management interface that OPTIONS in both directions are answered with 200 OK.
Connect your Session Border Controller (SBC) to Direct Routing · Verify the SBC connection · Checked 2026-09-30
68
Direct Routing requires a Microsoft-certified SBC, PSTN trunks to it, users homed online, a public IP, an SBC FQDN in a verified tenant domain (not *.onmicrosoft.com) with public DNS, and a publicly trusted TLS certificate.
Plan Direct Routing · Plan Direct Routing, section 'Infrastructure requirements' table and section 'SBC domain names' · Checked 2026-09-24
69
Direct Routing requires users to be homed online in Microsoft 365.
Plan Direct Routing · Infrastructure requirements table, User registrar row · Checked 2026-09-25
70
Microsoft supports Teams Phone with Direct Routing only when certified SBCs are used, expects the SBC vendor to investigate first and escalate, and may decline support requests involving non-certified SBCs.
Plan Direct Routing · Plan Direct Routing, sections 'Supported Session Border Controllers (SBCs)' and 'Support boundaries' · Checked 2026-09-24
71
Direct Routing supports SILK, G.711, G.722, G.729 and AMR-WB between Teams and the SBC, with AMR-WB supported only without media bypass.
Plan Direct Routing · Plan Direct Routing, section 'Supported codecs' · Checked 2026-09-24
72
Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP ports 3478-3481 and 49152-53247 in both directions, and Microsoft recommends at least two media ports per concurrent call on the SBC.
Plan Direct Routing · Plan Direct Routing, section 'Media ports' table and Tip · Checked 2026-09-24
73
For Microsoft 365, Office 365 and GCC, the SBC connects to sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com in priority order over SIP/TLS to port 5061; GCC High uses sip.pstnhub.gov.teams.microsoft.us and DoD uses sip.pstnhub.dod.teams.microsoft.us.
Plan Direct Routing · Plan Direct Routing, sections 'SIP signaling: FQDNs', 'SIP signaling: GCC High', 'SIP signaling: DoD', 'SIP signaling ports' · Checked 2026-09-24

Documents

tier 1 standards and regulators

Cite this page

APA

WarmTransfer. (2026, September 30). Setting up media bypass and local media optimization for Teams Direct Routing. WarmTransfer. https://warmtransfer.net/guides/teams-media-bypass-setup

BibTeX

@misc{warmtransfer-teams-media-bypass-setup,
  title  = {Setting up media bypass and local media optimization for Teams Direct Routing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/teams-media-bypass-setup},
  note   = {Verified 2026-09-30}
}