Troubleshooting phones signing in through Teams SIP Gateway

See also

Sources

1. 1
   Error AADSTS530036 means a refresh token is invalid because of Conditional Access authentication flow checks (protocol tracking); with the policy enabled Microsoft gives no remediation, and after disabling it or setting it to report-only a fresh token may be needed.

   Authentication flows as a condition in Conditional Access policy · Authentication flows as a condition in Conditional Access policy > Troubleshooting unexpected blocks (and Note) · Checked 2026-10-02
2. 2
   Algo says that if an Algo device cannot generate a Teams pairing code, or the Teams section is missing from its Status page, DNS is the likely cause; devices with a static IP must have a valid DNS server configured.

   Microsoft Teams Configuration with Algo IP Devices Using the Device Web Interface · Microsoft Teams Configuration with Algo IP Devices > troubleshooting section · Checked 2026-10-02
3. 3
   The AllowCallRedirect calling policy parameter enables local call redirection for SIP devices connecting through the Teams SIP gateway, with values Enabled and Disabled; UserOverride is listed but not available for use.

   Set-CsTeamsCallingPolicy (MicrosoftTeams) · Set-CsTeamsCallingPolicy > Parameters > -AllowCallRedirect · Checked 2026-10-02
4. 4
   Users are enabled for SIP Gateway by setting AllowSIPDevicesCalling to True in their Teams calling policy (Teams admin center setting 'SIP devices can be used for calls'); Microsoft's configure article states the default is False.

   Configure SIP Gateway · Configure SIP Gateway > Enable SIP Gateway for the users in your organization > By using Teams admin center; By using PowerShell · Checked 2026-10-02
5. 5
   The device location shown in the Microsoft Entra web authentication app during SIP Gateway pairing is the SIP Gateway datacenter the device is connected to, not the phone's site.

   Configure SIP Gateway · Configure SIP Gateway > How to sign in and sign out > User pairing and sign-in > first Note · Checked 2026-10-02
6. 6
   Accounts in a bulk sign-in request must have the CommonAreaPhone policy, must not have MFA enabled, must have a phone number assigned and must have the SIP device calling policy; the tenant BulkSignIn setting must be Enabled and Teams PowerShell 5.6.0 or later is required.

   Configure SIP Gateway · Configure SIP Gateway > Bulk sign in > Bulk sign in prerequisites > 3-9 · Checked 2026-10-02
7. 7
   The bulk sign-in error 'Public IP not configured as Trusted IP' means either the tenant ID in the provisioning URL is wrong or the device's public IP is not listed as a trusted IP in Teams admin center.

   Configure SIP Gateway · Configure SIP Gateway > Bulk sign in error messages table, row 'Public IP not configured as Trusted IP.' · Checked 2026-10-02
8. 8
   Bulk sign-in works for new SIP devices within 72 hours of onboarding to SIP Gateway, or for signed-out devices within 7 days (168 hours) of sign-out; batches hold up to 100 devices with at most 3 concurrent batches per region.

   Configure SIP Gateway · Configure SIP Gateway > Bulk sign in (intro and scenario list) · Checked 2026-10-02
9. 9
   For bulk sign-in, the tenant ID must be added to the device provisioning URL (for example http://noam.ipp.sdg.teams.microsoft.com/tenantid/<tenant-GUID>, with /$PSN.xml appended for Cisco and mac.ini for analog lines on AudioCodes ATAs).

   Configure SIP Gateway · Configure SIP Gateway > Bulk sign in > Bulk sign in prerequisites > 2 · Checked 2026-10-02
10. 10
    Bulk sign-in requires the site public IP addresses to be added as trusted IPs in Teams admin center at least 24 hours before running the bulk sign-in cmdlets.

    Configure SIP Gateway · Configure SIP Gateway > Bulk sign in > Bulk sign in prerequisites > 1 · Checked 2026-10-02
11. 11
    The tenant-wide BulkSignIn setting for SIP devices is set with Set-CsTeamsSipDevicesConfiguration -BulkSignIn Enabled or Disabled, which requires a role such as Teams Administrator or Teams Communication Administrator.

    Set-CsTeamsSipDevicesConfiguration (MicrosoftTeams) · Set-CsTeamsSipDevicesConfiguration > Description; Parameters > -BulkSignIn · Checked 2026-10-02
12. 12
    Starting 1 January 2026, the same tenants must also exclude additional SIP Gateway service IPs in the 70.152.0.0 space (for North America 70.152.106.56, 70.152.136.2, 70.152.120.55 and 70.152.38.25, with separate EMEA and APAC lists).

    Configure SIP Gateway · Configure SIP Gateway > Configure conditional access > 'Starting 1st January 2026' list · Checked 2026-10-02
13. 13
    If the tenant uses Conditional Access, Microsoft says to exclude the site public IP addresses and the SIP Gateway API app (app ID 0ab9de21-b802-4d77-b279-1ad41ca233b4), because SIP devices are not Intune-managed and get stricter checks.

    Configure SIP Gateway · Configure SIP Gateway > Configure conditional access · Checked 2026-10-02
14. 14
    An Entra authentication flows policy that blocks device code flow for all resources is likely to block SIP Gateway pairing unless the SIP Gateway apps or site are excluded, because SIP Gateway pairing follows the device authorization grant pattern; Microsoft's SIP Gateway pages do not state this directly.inferred

    Authentication flows as a condition in Conditional Access policy · Authentication flows as a condition in Conditional Access policy > Device code flow; Troubleshooting unexpected blocks · Checked 2026-10-02
15. 15
    Tenants using bulk sign-in, or whose SIP devices were signed in before July 2023, need location-based Conditional Access exclusions for the SIP Gateway service IPs (North America 52.170.38.140 and 40.112.144.212; EMEA 40.112.71.149 and 40.113.112.67; APAC 20.92.120.71 and 13.73.115.90).

    Configure SIP Gateway · Configure SIP Gateway > Configure conditional access > Note · Checked 2026-10-02
16. 16
    The SIP Gateway resources cannot be directly excluded from Conditional Access policies; Microsoft documents a dynamic app filter using a custom security attribute instead, and notes the SIP Gateway apps own no scopes and depend on the Teams app.

    Set up dynamic filters for SIP Gateway - Microsoft Teams · Set up dynamic filters for SIP Gateway > introduction (second paragraph) · Checked 2026-10-02
17. 17
    For failures to make or receive calls on a SIP Gateway device, Microsoft says to check the device is registered, restart it, and test the same call to or from the same remote address in the Teams app.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > I can't make calls; I can't receive calls · Checked 2026-10-02
18. 18
    SIP phones on SIP Gateway depend on Call Redirect, so the admin must set AllowCallRedirect to Enabled in the user's Teams calling policy; local call forwarding on the device also needs it.

    Configure SIP Gateway · Configure SIP Gateway > Sync policy changes to SIP devices to enforce policies · Checked 2026-10-02
19. 19
    For Cisco 6821-6871, 7811-7861 and 8811-8865 phones, SIP Gateway's minimum firmware is 11.1.1MPP and the approved version is 12-0-7MPP; the Cisco 8832 minimum is 11.3.5MPP.

    Plan SIP Gateway · Plan SIP Gateway > Compatible devices table > Cisco rows · Checked 2026-10-02
20. 20
    Compatible Cisco SIP IP phones support dynamic emergency location discovery with SIP Gateway over LLDP only; devices that share no location attributes fall back to registered addresses.

    Configure SIP Gateway · Configure SIP Gateway > Emergency calling (paragraph and Note) · Checked 2026-10-02
21. 21
    Cisco IP phones must be converted to multiplatform (MPP) firmware before they can be onboarded to SIP Gateway; phones on enterprise firmware cannot onboard as-is.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note · Checked 2026-10-02
22. 22
    For Cisco devices, /$PSN.xml must be appended to the SIP Gateway provisioning server URL.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note · Checked 2026-10-02
23. 23
    Microsoft Entra Conditional Access can target device code flow as an authentication flow condition, and Microsoft recommends blocking device code flow wherever possible and allowing it only where necessary.

    Authentication flows as a condition in Conditional Access policy · Authentication flows as a condition in Conditional Access policy > Device code flow · Checked 2026-10-02
24. 24
    In-scope SIP phones are not OAuth-capable, so SIP Gateway authenticates the user through a web authentication app and pairs the device with the user's credentials, and Microsoft points to the OAuth 2.0 device authorization grant flow for background.

    Configure SIP Gateway · Configure SIP Gateway > How to sign in and sign out > User pairing and sign-in > first Note · Checked 2026-10-02
25. 25
    For Cisco, Poly and AudioCodes phones, the SIP Gateway provisioning URL is delivered with DHCP option 160.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note · Checked 2026-10-02
26. 26
    Microsoft notes DHCP option 42 can specify the NTP server and DHCP option 2 the UTC offset in seconds for SIP Gateway devices, and the troubleshooting article points to DHCP settings when a device displays the wrong time.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP · Checked 2026-10-02
27. 27
    For Yealink and Alcatel-Lucent Enterprise phones, the SIP Gateway provisioning URL is delivered with DHCP option 66.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note · Checked 2026-10-02
28. 28
    In the Microsoft identity platform's generic device code flow, the user has 15 minutes from the device authorization request to sign in, the default expires_in value; this is not documented as SIP Gateway's pairing code lifetime.

    OAuth 2.0 device authorization grant - Microsoft identity platform · OAuth 2.0 device authorization grant > Device authorization request · Checked 2026-10-02
29. 29
    Microsoft requires each SIP device used with Teams SIP Gateway to be reset to factory default settings before SIP Gateway is configured.

    Configure SIP Gateway · Configure SIP Gateway > Before you can configure SIP Gateway, do the following > Reset SIP devices to factory default settings · Checked 2026-10-02
30. 30
    Microsoft's workaround for the unavailable one-time-code enrolment in GCC is Zero Touch Common Area Phone sign-in, which uses the SIP remote login portal with the CAP account, a region (NOAM, EMEA or APAC) and the device MAC in XX-XX-XX-XX-XX-XX format.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > I can't enroll my device by using a one-time verification code (workaround) · Checked 2026-10-02
31. 31
    SIP Gateway supports only IPv4, even though the Teams service and client support both IPv4 and IPv6.

    Configure SIP Gateway · Configure SIP Gateway > Microsoft Teams and IPv6 · Checked 2026-10-02
32. 32
    Microsoft 365 endpoint set ID 11 (Teams, Optimize Required) lists UDP 3478-3481 to 52.112.0.0/14, 52.122.0.0/15 and 2603:1063::/38; this is a different port list from the UDP 49152-53247 range the SIP Gateway configure article specifies.

    Microsoft 365 URLs and IP address ranges · Microsoft 365 URLs and IP address ranges > Microsoft Teams table > ID 11 · Checked 2026-10-02
33. 33
    SIP devices must be on the minimum supported firmware version listed in the Plan for SIP Gateway article to onboard; during onboarding SIP Gateway pushes default configuration and the authentication UI to the device.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP (final paragraph) · Checked 2026-10-02
34. 34
    Microsoft's SIP Gateway troubleshooting article has no section on one-way or no audio; its call sections cover only failures to make or receive calls.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > full list of H2 sections · Checked 2026-10-02
35. 35
    SIP Gateway is not yet available for the US Government DoD cloud.

    Plan SIP Gateway · Plan SIP Gateway > Requirements to use SIP Gateway > Note · Checked 2026-10-02
36. 36
    After factory-resetting an offboarded phone, Microsoft says to re-enter the regional Teams SIP provisioning URL under Auto Provisioning in the phone's admin menu or web interface, save, and restart the phone.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > Teams SIP phone is offboarded · Checked 2026-10-02
37. 37
    One-way or no audio on SIP Gateway calls where signalling works is most plausibly caused by blocked outbound UDP 49152-53247 to 52.112.0.0/14 and 52.122.0.0/15, since TCP 5061 can succeed independently; Microsoft does not document this diagnosis.inferred

    Configure SIP Gateway · Configure SIP Gateway > Before you can configure SIP Gateway > Open the UDP port; Open the TCP port · Checked 2026-10-02
38. 38
    If a device does not update after a successful sign-in, one cause Microsoft lists is a user from a different tenant who signed in and did not sign out gracefully; that user should sign in and sign out again.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > My device doesn't update after I sign in successfully > step 3 · Checked 2026-10-02
39. 39
    For common area phone enrolment, the admin generates a one-time verification code per MAC address in Teams admin center and the code is dialled on the device after feature code *55* (for example *55*123456); the device must already be onboarded to SIP Gateway.

    Configure SIP Gateway · Configure SIP Gateway > Provision and enroll SIP devices as common area phones > Note and step 4 · Checked 2026-10-02
40. 40
    Enrolling SIP devices by dialling *55* plus a one-time verification code is not available in the GCC environment.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > I can't enroll my device by using a one-time verification code · Checked 2026-10-02
41. 41
    The pairing code shown after pressing Sign-in on a SIP phone is time-sensitive; if it expires the user must press Back on the phone and start sign-in again.

    Configure SIP Gateway · Configure SIP Gateway > How to sign in and sign out > User pairing and sign-in > step 1 · Checked 2026-10-02
42. 42
    Only local sign-in (on the device) is supported for users' personal SIP devices; remote sign-in methods apply to common area phones.

    Configure SIP Gateway · Configure SIP Gateway > How to sign in and sign out (first sentence); Zero Touch Common Area Phone sign in · Checked 2026-10-02
43. 43
    After enabling SIP devices in a calling policy, policy propagation may take up to 24 hours.

    Configure SIP Gateway · Configure SIP Gateway > Enable SIP Gateway for the users in your organization > By using PowerShell > Note · Checked 2026-10-02
44. 44
    User details and policies are fetched to the SIP device at sign-in, and later policy changes for signed-in users sync to the device within one hour.

    Configure SIP Gateway · Configure SIP Gateway > Sync policy changes to SIP devices to enforce policies · Checked 2026-10-02
45. 45
    Poly VVX models are listed for SIP Gateway with minimum firmware 5.9.5, with approved versions of 5.9.7.3480 (VVX x00/x10 models) or 6.4.x (VVX 150, x01, x11 and x50 models).

    Plan SIP Gateway · Plan SIP Gateway > Compatible devices table > Poly VVX rows · Checked 2026-10-02
46. 46
    A SIP phone that has been successfully provisioned to SIP Gateway displays the Teams logo and a soft button for sign-in.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP · Checked 2026-10-02
47. 47
    The SIP Gateway provisioning server URLs are http://emea.ipp.sdg.teams.microsoft.com for EMEA, http://noam.ipp.sdg.teams.microsoft.com for the Americas and http://apac.ipp.sdg.teams.microsoft.com for APAC.

    Configure SIP Gateway · Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP · Checked 2026-10-02
48. 48
    SIP devices used with SIP Gateway must not sit behind a corporate HTTP/HTTPS proxy; their http/s traffic must bypass any proxy.

    Configure SIP Gateway · Configure SIP Gateway > Before you can configure SIP Gateway > Make sure the SIP devices are not behind a proxy · Checked 2026-10-02
49. 49
    Teams users must have a phone number with PSTN calling enabled to use SIP Gateway; Microsoft lists a missing number as a cause when a device does not update after successful sign-in.

    Plan SIP Gateway · Plan SIP Gateway > Requirements to use SIP Gateway · Checked 2026-10-02
50. 50
    When a device cannot register to Teams, Microsoft says to check firewall and proxy blocking of the required endpoints and ports, check whether other SIP devices have the same issue (which may mean the service is unavailable), and restart the device.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > I can't register my device to Teams · Checked 2026-10-02
51. 51
    If remote sign-in to a device fails, Microsoft says to verify the device was enrolled correctly and to try local sign-in.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > I can't sign in to my device remotely · Checked 2026-10-02
52. 52
    When a device signs itself out, Microsoft says to check that SIP Gateway is still enabled for the user and whether settings changed, for example the user's phone number being removed.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > My device signs itself out · Checked 2026-10-02
53. 53
    To see whether device code flow is used, Microsoft suggests running the Conditional Access policy in report-only mode or filtering Entra sign-in logs with the Authentication protocol filter; the Conditional Access tab of a blocked sign-in shows whether an authentication flows policy matched.

    Authentication flows as a condition in Conditional Access policy · Authentication flows as a condition in Conditional Access policy > Sign-in logs; Troubleshooting unexpected blocks · Checked 2026-10-02
54. 54
    The dynamic filter procedure tags the SIP Gateway API (0ab9de21-b802-4d77-b279-1ad41ca233b4) and SIP Gateway UserApp (582b2e88-6cca-4418-83d2-2451801e1d26) service principals, plus Teams SIP Gateway (61c8fd69-c13e-4ee6-aaa6-24ff71c09bca) when bulk sign-in is used, creating the service principals first if they are absent.

    Set up dynamic filters for SIP Gateway - Microsoft Teams · Set up dynamic filters for SIP Gateway > Step 3: Add SIP Gateway Service Principals to your tenant; Step 4 · Checked 2026-10-02
55. 55
    SIP Gateway automatically offboards stale devices: paired (signed-in) devices after 30 days without connecting and unpaired (signed-out) devices after 14 days; an offboarded device can be onboarded again after a factory reset.

    Plan SIP Gateway · Plan SIP Gateway > Benefits of SIP Gateway > Off board stale devices · Checked 2026-10-02
56. 56
    A SIP device appears in Teams admin center under Teams devices > SIP devices only after a user has signed in to it at least once, and a signed-out device shows as offline.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > My device isn't listed in the Teams admin center; My device is listed in the Teams admin center, but shows wrong state · Checked 2026-10-02
57. 57
    SIP Gateway requires TCP port 5061 to be open towards the IP ranges 52.112.0.0/14 and 52.122.0.0/15, and the firewall rules are needed for outbound traffic only.

    Configure SIP Gateway · Configure SIP Gateway > Before you can configure SIP Gateway > Open the TCP port; Open your firewall to Microsoft 365 and Teams · Checked 2026-10-02
58. 58
    SIP Gateway requires UDP ports 49152 to 53247 to be open towards the IP ranges 52.112.0.0/14 and 52.122.0.0/15.

    Configure SIP Gateway · Configure SIP Gateway > Before you can configure SIP Gateway > Open the UDP port · Checked 2026-10-02
59. 59
    When a device cannot onboard, Microsoft says to verify the provisioning server URL begins with HTTP and not HTTPS.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > I can't onboard my device > step 3 · Checked 2026-10-02
60. 60
    When web app authentication fails during SIP Gateway sign-in, Microsoft says to confirm the credentials by signing in to the Teams app with them and, if Conditional Access is used, to make sure the SIP Gateway IP addresses are excluded.

    Common Issues When Using SIP Devices With Teams · Common Issues When Using SIP Devices With Teams > Web app authentication fails when I try to sign in · Checked 2026-10-02

Documents

Cite this page

WarmTransfer. (2026, October 2). Troubleshooting phones signing in through Teams SIP Gateway. WarmTransfer. https://warmtransfer.net/knowledge/teams-sip-gateway-troubleshooting

@misc{warmtransfer-teams-sip-gateway-troubleshooting,
  title  = {Troubleshooting phones signing in through Teams SIP Gateway},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/teams-sip-gateway-troubleshooting},
  note   = {Verified 2026-10-02}
}