Setting up a Survivable Branch Appliance for Teams Direct Routing

See also

Sources

1. 1
   The Teams client moves to the SBA only when two conditions hold: the user is assigned a branch survivability policy for an SBA that is up, and the internet is disconnected while the user's device can still reach the SBA.

   Survivable Branch Appliance for Direct Routing · How it works, 'The following conditions must be met' list · Checked 2026-09-30
2. 2
   TE-SYSTEMS states that the SBA is an additional Windows application that ships automatically, as a service, with every Windows-based anynode deployment.

   Microsoft Teams SBA - anynode · Page body, SBA description paragraph · Checked 2026-09-30
3. 3
   The SBA application's API permission is 'Skype and Teams Tenant Admin Access' > Application permissions > application_access_custom_sba_appliance.

   Survivable Branch Appliance for Direct Routing · Configuration > Register an application for the SBA with Microsoft Entra ID, 'API permissions' bullet · Checked 2026-09-30
4. 4
   The SBA application is registered with supported account types set to accounts in this organizational directory only, a Web redirect URI of https://login.microsoftonline.com/common/oauth2/nativeclient, and implicit grant enabled for both access tokens and ID tokens; its name is free choice.

   Survivable Branch Appliance for Direct Routing · Configuration > Register an application for the SBA with Microsoft Entra ID, 'keep the following in mind' list · Checked 2026-09-30
5. 5
   Microsoft orders the application registration as: register the application, set the implicit grant tokens, set the API permissions, create the client secret.

   Survivable Branch Appliance for Direct Routing · Configuration > Register an application for the SBA with Microsoft Entra ID, closing numbered list · Checked 2026-09-30
6. 6
   The SBA registration needs two values produced by the Entra application registration: the Application (client) ID, shown on the application's Overview tab, and a client secret.

   Survivable Branch Appliance for Direct Routing · Configuration > Register an application for the SBA with Microsoft Entra ID, 'you need the following values' list · Checked 2026-09-30
7. 7
   AudioCodes markets Direct Routing SBA products as a physical Mediant 800C SBA appliance and as a virtual appliance.

   Survivability Products (SBA) for Microsoft Teams · Product comparison table · Checked 2026-09-30
8. 8
   During an internet outage the Teams client switches to the SBA automatically, ongoing calls continue without interruption, and the user does not need to take any action.

   Survivable Branch Appliance for Direct Routing · How it works, first paragraph · Checked 2026-09-30
9. 9
   The SBA prerequisites require Azure IP Ranges and Service Tags for the Public Cloud to be defined following Microsoft's published download (download id 56519).

   Survivable Branch Appliance for Direct Routing · Prerequisites, bullet 7 · Checked 2026-09-30
10. 10
    When the Teams client switches to Appliance mode it shows a banner, and that banner is the only UI indicator: if the banner is absent the user is not in SBA mode and calling will not work.

    Survivable Branch Appliance for Direct Routing · How it works, 'Connection to the SBA on the Teams client side' bullet · Checked 2026-09-30
11. 11
    For direct media between the Teams client and the SBC, the client uses UDP/SRTP ports 50000-50019 and must reach the media ports defined on the SBC.

    Plan for media bypass with Direct Routing · Requirements for direct media traffic (between the Teams client and the SBC), table · Checked 2026-09-30
12. 12
    Media bypass is controlled per SBC with Set-CsOnlinePSTNGateway and its -MediaBypass parameter set to true or false.

    Plan for media bypass with Direct Routing · About media bypass with Direct Routing, second paragraph · Checked 2026-09-30
13. 13
    For media bypass the Teams client must have access to the public IP address of the SBC even from an internal network, and hairpinning can be configured on the NAT device so that traffic never leaves the enterprise network equipment.

    Plan for media bypass with Direct Routing · Call flow if the user has direct access to the public IP address of the SBC; Requirements for direct media traffic, Note · Checked 2026-09-30
14. 14
    With media bypass enabled in normal operation, SIP signaling still always flows via the Microsoft cloud; only media stays local.

    Plan for media bypass with Direct Routing · Call flow if the user has direct access to the public IP address of the SBC, third bullet · Checked 2026-09-30
15. 15
    During an internet outage the Teams desktop client can reconnect to the SBA with locally cached authentication information even after a client restart or machine reboot, provided that information was cached before the outage and is still within the supported SBA authentication period.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations > In SBA mode, second sub-bullet · Checked 2026-09-30
16. 16
    For tenants using Continuous Access Evaluation tokens, Microsoft names disabling CAE for the tenant as an alternative to the roughly 30-minute SBA operating window.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations, CAE bullet · Checked 2026-09-30
17. 17
    Microsoft Entra's CAE setting now lives in Conditional Access: it is toggled when creating a Conditional Access policy through the 'Customize continuous access evaluation' session control, which can be set to Disabled.

    Continuous access evaluation in Microsoft Entra · Enable or disable CAE, first paragraph and Migration table · Checked 2026-09-30
18. 18
    After connectivity returns, the SBA uploads the Call Data Records it collected to the cloud and call history is updated for review by the tenant administrator.

    Survivable Branch Appliance for Direct Routing · How it works, second paragraph · Checked 2026-09-30
19. 19
    The Microsoft SBA Server communicates with the Teams client on ports 3443, 4444 and 8443, which must be allowed on the firewall.

    Survivable Branch Appliance for Direct Routing · Prerequisites, bullet 3 · Checked 2026-09-30
20. 20
    Microsoft's cmdlet reference says the SBA cmdlets are intended exclusively for tenant administrators and SBC vendors and are inoperative in a tenant that has no SBA configuration.

    New-CsTeamsSurvivableBranchAppliance (MicrosoftTeams) · Description · Checked 2026-09-30
21. 21
    Microsoft lists the tenant-side SBA configuration as four steps: create the SBAs, create the Teams branch survivability policy, assign the policy to users, and register an application for the SBA with Microsoft Entra ID.

    Survivable Branch Appliance for Direct Routing · Configuration, numbered list · Checked 2026-09-30
22. 22
    A failover test consistent with Microsoft's description is to cut the branch's internet path while leaving the client's LAN path to the SBA intact, confirm the SBA banner appears in a desktop client that connected to the SBA within the previous 24 hours, place and receive a PSTN call, then restore the internet and confirm the client returns to normal mode.inferred

    Survivable Branch Appliance for Direct Routing · How it works (conditions, banner, offline functionality list); Known issues and considerations · Checked 2026-09-30
23. 23
    Once the Teams client detects that the internet is back and any outgoing calls have finished, it falls back to normal operation mode and reconnects to other Teams services.

    Survivable Branch Appliance for Direct Routing · How it works, second paragraph · Checked 2026-09-30
24. 24
    SBC vendors either embed the Microsoft-provided SBA code in their SBC firmware or distribute it separately so the SBA runs on a separate VM or hardware, and the customer obtains the latest firmware with the embedded SBA from the SBC vendor.

    Survivable Branch Appliance for Direct Routing · Prerequisites, first two paragraphs · Checked 2026-09-30
25. 25
    Get-CsTeamsSurvivableBranchAppliancePolicy returns the SBA policies defined in the tenant, optionally narrowed by -Identity or by -Filter on a partial Identity match.

    Get-CsTeamsSurvivableBranchAppliancePolicy (MicrosoftTeams) · Synopsis; Syntax; Parameters > -Identity, -Filter · Checked 2026-09-30
26. 26
    Get-CsTeamsSurvivableBranchAppliance returns the SBAs configured in the tenant, optionally narrowed by -Identity or by -Filter on a partial Identity match.

    Get-CsTeamsSurvivableBranchAppliance (MicrosoftTeams) · Synopsis; Syntax; Parameters > -Identity, -Filter · Checked 2026-09-30
27. 27
    Grant-CsTeamsSurvivableBranchAppliancePolicy has three parameter sets: per user (-Identity), per group (-Group with an optional -Rank relative to other group assignments of the same policy type), and tenant-wide (-Global, which applies the policy to all users in the tenant).

    Grant-CsTeamsSurvivableBranchAppliancePolicy (MicrosoftTeams) · Syntax (Identity, GrantToTenant, GrantToGroup); Parameters > -Global, -Group, -Rank · Checked 2026-09-30
28. 28
    A branch survivability policy is removed from a user by granting the $Null policy: Grant-CsTeamsSurvivableBranchAppliancePolicy -PolicyName $Null -Identity <user>.

    Survivable Branch Appliance for Direct Routing · Configuration > Assign a policy to a user, second example · Checked 2026-09-30
29. 29
    A branch survivability policy is assigned to an individual user with Grant-CsTeamsSurvivableBranchAppliancePolicy -PolicyName <policy> -Identity <user>.

    Survivable Branch Appliance for Direct Routing · Configuration > Assign a policy to a user · Checked 2026-09-30
30. 30
    The Microsoft SBA Server uses port 443 to communicate with Microsoft 365, and that port must be allowed on the firewall.

    Survivable Branch Appliance for Direct Routing · Prerequisites, bullet 6 · Checked 2026-09-30
31. 31
    An SBA object is created in the tenant with New-CsTeamsSurvivableBranchAppliance, for example with -Fqdn sba1.contoso.com and -Description, and the resulting Identity equals the FQDN.

    Survivable Branch Appliance for Direct Routing · Configuration > Create the SBAs, parameter table and example · Checked 2026-09-30
32. 32
    After new Survivable Branch Appliances are added, it might take time before they can be used in Survivable Branch Appliance policies.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations, penultimate bullet · Checked 2026-09-30
33. 33
    A site whose users reach the PSTN SBC only across the same internet or WAN link that fails gains nothing from an SBA, because SBA mode depends on the client still reaching the SBA and on the SBA/SBC still reaching the PSTN locally during the outage.inferred

    Survivable Branch Appliance for Direct Routing · Introduction, second paragraph; How it works, 'Network status check' bullet · Checked 2026-09-30
34. 34
    In SBA mode other Teams users cannot be reached by reverse number lookup against Microsoft Entra ID contacts; a dialed number is still processed by the SBA and routed over the PSTN.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations > unsupported user actions, last sub-bullet · Checked 2026-09-30
35. 35
    In SBA mode a user cannot switch their Teams client to another tenant.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations > unsupported user actions, first sub-bullet · Checked 2026-09-30
36. 36
    The Microsoft SBA Server uses UDP port 123 to reach an NTP server, and that port must be allowed on the firewall.

    Survivable Branch Appliance for Direct Routing · Prerequisites, bullet 5 · Checked 2026-09-30
37. 37
    In offline mode an incoming PSTN call to a call queue or auto attendant number can be redirected to a local agent or to an alternative call queue or auto attendant number.

    Survivable Branch Appliance for Direct Routing · How it works, offline functionality list, items 7-8 · Checked 2026-09-30
38. 38
    In offline mode the Teams client can make and receive PSTN calls through the local SBA/SBC with media through the SBC, hold and resume PSTN calls, blind transfer, and forward calls (always or when unanswered) to a single phone number or Teams user.

    Survivable Branch Appliance for Direct Routing · How it works, offline functionality list, items 1-6 · Checked 2026-09-30
39. 39
    In offline mode two users registered behind the same SBA can place a VoIP call to each other that the SBA supports, and if a VoIP call cannot be initiated and the called party has a PSTN number a PSTN call is attempted instead.

    Survivable Branch Appliance for Direct Routing · How it works, offline functionality list, items 9-10 · Checked 2026-09-30
40. 40
    Only one Microsoft Entra ID application needs to be registered for use by all the SBAs in a tenant; the registration lets the SBAs read required data from Microsoft 365.

    Survivable Branch Appliance for Direct Routing · Configuration > Register an application for the SBA with Microsoft Entra ID, paragraphs 1 and 3 · Checked 2026-09-30
41. 41
    Microsoft frames the SBA for the case where a branch temporarily cannot reach the Microsoft cloud through Direct Routing while the intranet inside the branch still works and users can still connect to the SBC that provides PSTN connectivity.

    Survivable Branch Appliance for Direct Routing · Introduction, second paragraph · Checked 2026-09-30
42. 42
    SBAs are added to or removed from an existing policy with Set-CsTeamsSurvivableBranchAppliancePolicy using -BranchApplianceFqdns @{add="..."} or @{remove="..."}.

    Survivable Branch Appliance for Direct Routing · Configuration > Create the Teams Branch Survivability Policy, Set- example · Checked 2026-09-30
43. 43
    A branch survivability policy is created with New-CsTeamsSurvivableBranchAppliancePolicy, taking an -Identity and -BranchApplianceFqdns, and one policy can contain one or more SBAs.

    Survivable Branch Appliance for Direct Routing · Configuration > Create the Teams Branch Survivability Policy · Checked 2026-09-30
44. 44
    After a Survivable Branch Appliance policy is assigned to a user, it might take time before the SBA is shown in the output of Get-CsOnlineUser.

    Survivable Branch Appliance for Direct Routing · Known issues and considerations, last bullet · Checked 2026-09-30
45. 45
    The -PolicyName passed to Grant-CsTeamsSurvivableBranchAppliancePolicy is the policy Identity without its scope prefix, that is without the leading 'Tag:'.

    Grant-CsTeamsSurvivableBranchAppliancePolicy (MicrosoftTeams) · Parameters > -PolicyName · Checked 2026-09-30
46. 46
    Remove-CsTeamsSurvivableBranchAppliancePolicy removes an SBA policy from the tenant and takes a mandatory -Identity, the policy instance name.

    Remove-CsTeamsSurvivableBranchAppliancePolicy (MicrosoftTeams) · Synopsis; Syntax; Parameters > -Identity · Checked 2026-09-30
47. 47
    Remove-CsTeamsSurvivableBranchAppliance removes an SBA from the tenant and takes a mandatory -Identity, the unique identifier of the SBA.

    Remove-CsTeamsSurvivableBranchAppliance (MicrosoftTeams) · Synopsis; Syntax; Parameters > -Identity · Checked 2026-09-30
48. 48
    SBA issues are reported to the SBC vendor's support organization, and the report should state that a Survivable Branch Appliance is configured.

    Survivable Branch Appliance for Direct Routing · Report an issue · Checked 2026-09-30
49. 49
    New-CsTeamsSurvivableBranchAppliance accepts an optional -Site parameter naming the TenantNetworkSite where the SBA is located and an optional free-text -Description.

    New-CsTeamsSurvivableBranchAppliance (MicrosoftTeams) · Parameters > -Site and -Description · Checked 2026-09-30
50. 50
    The Microsoft SBA Server communicates with the SBC on port 5061, or whichever port is configured on the SBC, and that port must be allowed on the firewall.

    Survivable Branch Appliance for Direct Routing · Prerequisites, bullet 4 · Checked 2026-09-30
51. 51
    The client secret for the SBA application may use any description and expiration, and it should be copied immediately after it is created.

    Survivable Branch Appliance for Direct Routing · Configuration > Register an application for the SBA with Microsoft Entra ID, 'Client secret' bullets · Checked 2026-09-30
52. 52
    TLS 1.2 must be enabled on the operating system of the SBA VM.

    Survivable Branch Appliance for Direct Routing · Prerequisites, bullet 2 · Checked 2026-09-30
53. 53
    For step-by-step configuration of the SBC with the embedded SBA, Microsoft defers to SBC vendor documentation and links to four vendors: AudioCodes, Ribbon, Oracle and TE-Systems.

    Survivable Branch Appliance for Direct Routing · Session Border Controller configuration · Checked 2026-09-30
54. 54
    SBA mode is supported on the Teams Windows and macOS desktop clients and on Teams Phones, and only on desktop clients running on a physical machine; VMs and web clients are not supported.

    Survivable Branch Appliance for Direct Routing · Direct Routing SBA, sections 'Supported Teams clients' and 'How it works' · Checked 2026-09-24
55. 55
    Direct Routing lets an organization use any PSTN operator by connecting it through a certified SBC that is procured, installed and managed by the customer, an integrator or a Direct-Routing-as-a-Service provider.

    PSTN connectivity options · PSTN connectivity options, bullet 'Direct Routing' · Checked 2026-09-24
56. 56
    Direct Routing requires a Microsoft-certified SBC, PSTN trunks to it, users homed online, a public IP, an SBC FQDN in a verified tenant domain (not *.onmicrosoft.com) with public DNS, and a publicly trusted TLS certificate.

    Plan Direct Routing · Plan Direct Routing, section 'Infrastructure requirements' table and section 'SBC domain names' · Checked 2026-09-24
57. 57
    In SBA mode, emergency calls can still be placed but location information is not shared, and SBA does not support emergency call routing policies; emergency dial strings bypass normalization, so they fail unless the regular voice routing policy has a matching pattern.

    Survivable Branch Appliance for Direct Routing · Direct Routing SBA, section 'Known issues and considerations', 'In SBA mode, the following user actions aren't supported' · Checked 2026-09-24
58. 58
    A Survivable Branch Appliance is Microsoft-supplied code distributed through SBC vendors, and it requires the SBC to be configured for media bypass so branch Teams clients can exchange media directly with the SBC.

    Survivable Branch Appliance for Direct Routing · Direct Routing SBA, section 'Prerequisites' · Checked 2026-09-24
59. 59
    SBA configuration (creating SBAs, creating and assigning the branch survivability policy, and registering an Entra ID application) is done only with Teams PowerShell; the Teams admin center does not yet support the feature.

    Survivable Branch Appliance for Direct Routing · Direct Routing SBA, section 'Configuration' · Checked 2026-09-24
60. 60
    Direct Routing requires specific emergency call routing policies, whereas with the other PSTN options the carrier handles much of the emergency call routing configuration.

    Plan and manage emergency calling · Plan and manage emergency calling, section 'Emergency call routing' · Checked 2026-09-24
61. 61
    SBA accepts expired client authentication tokens for up to 7 days, cannot validate a client that has not connected to it in the last 24 hours, and stays operational for only about 30 minutes if the tenant uses Continuous Access Evaluation tokens.

    Survivable Branch Appliance for Direct Routing · Direct Routing SBA, section 'Known issues and considerations' · Checked 2026-09-24
62. 62
    Microsoft supports Teams Phone with Direct Routing only when certified SBCs are used, expects the SBC vendor to investigate first and escalate, and may decline support requests involving non-certified SBCs.

    Plan Direct Routing · Plan Direct Routing, sections 'Supported Session Border Controllers (SBCs)' and 'Support boundaries' · Checked 2026-09-24
63. 63
    In GCC High and DoD clouds, Microsoft lists as not yet available: secondary ringer, voicemail and enhanced delegation call settings; transfer to voicemail mid-call; calling a number from the search bar; Entra ID reverse number lookup; Private Line and Multi-line; skip internal VoIP reverse number lookup; and Shared Calling.

    Teams Phone features · Teams Phone features, section 'Availability in GCC High and DoD clouds' · Checked 2026-09-24
64. 64
    Shared Calling is available in public clouds only; it is listed as not yet available in GCC High and DoD.

    Plan for Shared Calling · Plan for Shared Calling, Note after the introductory paragraph · Checked 2026-09-24

Documents

Cite this page

WarmTransfer. (2026, September 30). Setting up a Survivable Branch Appliance for Teams Direct Routing. WarmTransfer. https://warmtransfer.net/guides/teams-sba-setup

@misc{warmtransfer-teams-sba-setup,
  title  = {Setting up a Survivable Branch Appliance for Teams Direct Routing},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/teams-sba-setup},
  note   = {Verified 2026-09-30}
}