# Troubleshooting phones signing in through Teams SIP Gateway

Canonical: https://warmtransfer.net/knowledge/teams-sip-gateway-troubleshooting

Last verified: 2026-10-02

Teams SIP Gateway onboarding requires each SIP device to be reset to factory default settings, to be on the minimum supported firmware version, and to have its http/s traffic bypass any proxy before a user can sign in[^29][^33][^48]. Microsoft's troubleshooting guidance covers devices that cannot onboard, cannot register, fail web app authentication, do not update after sign-in, or sign themselves out[^59][^50][^60][^38][^52].

## How sign-in works

During onboarding, SIP Gateway pushes default configuration and the authentication UI to the device[^33]. A SIP phone that has been successfully provisioned to SIP Gateway displays the Teams logo and a soft button for sign-in[^46].

Microsoft states that in-scope SIP phones are not OAuth-capable[^24]. SIP Gateway therefore authenticates the user through a web authentication app and pairs the device with the user's credentials[^24]. Microsoft points to the OAuth 2.0 device authorization grant flow for background[^24].

The pairing code shown after pressing Sign-in on the phone is time-sensitive[^41]. If it expires, the user must press Back on the phone and start sign-in again[^41]. The device location shown in the Microsoft Entra web authentication app during pairing is the SIP Gateway datacenter the device is connected to, not the phone's site[^5].

Only local sign-in on the device is supported for users' personal SIP devices[^42]. Remote sign-in methods apply to common area phones[^42]. User details and policies are fetched to the device at sign-in[^44]. Later policy changes for signed-in users sync to the device within 1 hour[^44].

## Network prerequisites

SIP Gateway requires UDP ports 49152 to 53247 to be open towards the IP ranges 52.112.0.0/14 and 52.122.0.0/15[^58]. SIP Gateway also requires TCP port 5061 to be open towards the same ranges, and the firewall rules are needed for outbound traffic only[^57]. SIP devices must not sit behind a corporate HTTP/HTTPS proxy, and their http/s traffic must bypass any proxy[^48].

A Microsoft 365 Teams endpoint set categorised as Optimize Required lists UDP 3478-3481 to 52.112.0.0/14, 52.122.0.0/15 and 2603:1063::/38[^32]. That is a different port list from the UDP 49152-53247 range that the SIP Gateway configure article specifies[^32]. SIP Gateway supports only IPv4, even though the Teams service and client support both IPv4 and IPv6[^31].

## User and policy prerequisites

- Users are enabled for SIP Gateway by setting AllowSIPDevicesCalling to True in their Teams calling policy, which is the Teams admin center setting "SIP devices can be used for calls"[^4].
- Microsoft's configure article states that the default for AllowSIPDevicesCalling is False[^4].
- After SIP devices are enabled in a calling policy, policy propagation may take up to 24 hours[^43].
- Teams users must have a phone number with PSTN calling enabled to use SIP Gateway[^49].
- SIP phones on SIP Gateway depend on Call Redirect, so the admin must set AllowCallRedirect to Enabled in the user's Teams calling policy[^18].
- Local call forwarding on the device also needs AllowCallRedirect[^18].
- AllowCallRedirect accepts the values Enabled and Disabled, and UserOverride is listed but not available for use[^3].

## Provisioning URL and DHCP

The regional SIP Gateway provisioning server URLs are `http://emea.ipp.sdg.teams.microsoft.com` for EMEA, `http://noam.ipp.sdg.teams.microsoft.com` for the Americas, and `http://apac.ipp.sdg.teams.microsoft.com` for APAC[^47]. When a device cannot onboard, Microsoft says to verify that the provisioning server URL begins with HTTP and not HTTPS[^59].

| Phone vendor | DHCP option for provisioning URL |
|---|---|
| Yealink, Alcatel-Lucent Enterprise | 66[^27] |
| Cisco, Poly, AudioCodes | 160[^25] |

For Cisco devices, `/$PSN.xml` must be appended to the provisioning server URL[^22]. Microsoft notes that DHCP option 42 can specify the NTP server and DHCP option 2 the UTC offset in seconds for SIP Gateway devices[^26]. Microsoft's troubleshooting article points to DHCP settings when a device displays the wrong time[^26].

## Firmware requirements

Cisco IP phones must be converted to multiplatform (MPP) firmware before they can be onboarded to SIP Gateway, and phones on enterprise firmware cannot onboard as-is[^21].

| Models | Minimum firmware | Approved firmware |
|---|---|---|
| Cisco 6821-6871, 7811-7861, 8811-8865 | 11.1.1MPP[^19] | 12-0-7MPP[^19] |
| Poly VVX x00/x10 | 5.9.5[^45] | 5.9.7.3480[^45] |
| Poly VVX 150, x01, x11, x50 | 5.9.5[^45] | 6.4.x[^45] |

The Cisco 8832 minimum firmware is 11.3.5MPP[^19].

## Conditional Access

If the tenant uses Conditional Access, Microsoft says to exclude the site public IP addresses and the SIP Gateway API app (app ID 0ab9de21-b802-4d77-b279-1ad41ca233b4)[^13]. Microsoft gives the reason that SIP devices are not Intune-managed and get stricter checks[^13].

The SIP Gateway resources cannot be directly excluded from Conditional Access policies[^16]. Microsoft instead documents a dynamic app filter that uses a custom security attribute[^16]. Microsoft also notes that the SIP Gateway apps own no scopes and depend on the Teams app[^16].

The dynamic filter procedure tags the following service principals, and it creates them first if they are absent[^54]:

- SIP Gateway API (0ab9de21-b802-4d77-b279-1ad41ca233b4)[^54]
- SIP Gateway UserApp (582b2e88-6cca-4418-83d2-2451801e1d26)[^54]
- Teams SIP Gateway (61c8fd69-c13e-4ee6-aaa6-24ff71c09bca), when bulk sign-in is used[^54]

Some tenants need location-based Conditional Access exclusions for the SIP Gateway service IPs[^15]. This applies to tenants that use bulk sign-in or whose SIP devices were signed in before July 2023[^15]. The service IPs are as follows[^15]:

- North America: 52.170.38.140 and 40.112.144.212[^15]
- EMEA: 40.112.71.149 and 40.113.112.67[^15]
- APAC: 20.92.120.71 and 13.73.115.90[^15]

Starting 1 January 2026, the same tenants must also exclude additional SIP Gateway service IPs in the 70.152.0.0 space[^12]. For North America, these are 70.152.106.56, 70.152.136.2, 70.152.120.55 and 70.152.38.25, and separate lists exist for EMEA and APAC[^12].

Microsoft Entra Conditional Access can target device code flow as an authentication flow condition[^23]. Microsoft recommends blocking device code flow wherever possible and allowing it only where necessary[^23]. To see whether device code flow is used, Microsoft suggests running the policy in report-only mode or filtering Entra sign-in logs with the Authentication protocol filter[^53]. The Conditional Access tab of a blocked sign-in shows whether an authentication flows policy matched[^53].

Error AADSTS530036 means a refresh token is invalid because of Conditional Access authentication flow checks (protocol tracking)[^1]. Whether SIP Gateway sign-ins hit this error in a specific way is not covered by the sources below. While the policy is enabled, Microsoft gives no remediation[^1]. After the policy is disabled or set to report-only, a fresh token may be needed[^1].

## Common area phones and bulk sign-in

### One-time code enrolment

For common area phone enrolment, the admin generates a one-time verification code per MAC address in Teams admin center[^39]. The code is dialled on the device after feature code *55*, for example *55*123456[^39]. The device must already be onboarded to SIP Gateway[^39].

### Remote sign-in

If remote sign-in to a device fails, Microsoft says to verify that the device was enrolled correctly and to try local sign-in[^51].

### Bulk sign-in timing and limits

Bulk sign-in works for new SIP devices within 72 hours of onboarding to SIP Gateway[^8]. It also works for signed-out devices within 7 days (168 hours) of sign-out[^8]. Batches hold up to 100 devices, with at most 3 concurrent batches per region[^8].

### Bulk sign-in prerequisites

- The site public IP addresses must be added as trusted IPs in Teams admin center at least 24 hours before the bulk sign-in cmdlets are run[^10].
- The tenant ID must be added to the device provisioning URL, for example `http://noam.ipp.sdg.teams.microsoft.com/tenantid/<tenant-GUID>`[^9].
- For Cisco, `/$PSN.xml` is appended to the tenant ID URL, and for analog lines on AudioCodes ATAs, mac.ini is appended[^9].
- Accounts in a bulk sign-in request must have the CommonAreaPhone policy, must not have MFA enabled, must have a phone number assigned, and must have the SIP device calling policy[^6].
- The tenant BulkSignIn setting must be Enabled[^6].
- Teams PowerShell 5.6.0 or later is required[^6].

The tenant-wide BulkSignIn setting is set with Set-CsTeamsSipDevicesConfiguration -BulkSignIn Enabled or Disabled[^11]. Running that cmdlet requires a role such as Teams Administrator or Teams Communication Administrator[^11].

### Bulk sign-in error

The bulk sign-in error "Public IP not configured as Trusted IP" means either the tenant ID in the provisioning URL is wrong or the device's public IP is not listed as a trusted IP in Teams admin center[^7].

## Diagnosing by symptom

### Device cannot onboard

- Verify that the provisioning URL begins with HTTP, not HTTPS[^59].
- Confirm that the device is on the minimum supported firmware[^33].
- For Cisco phones, confirm that the device runs MPP firmware[^21].

### Device cannot register to Teams

Microsoft says to check whether a firewall or proxy is blocking the required endpoints and ports[^50]. Microsoft also says to check whether other SIP devices have the same issue, which may mean the service is unavailable, and then to restart the device[^50].

### Web app authentication fails

Microsoft says to confirm the credentials by signing in to the Teams app with them[^60]. If Conditional Access is used, Microsoft says to make sure the SIP Gateway IP addresses are excluded[^60].

### Device does not update after a successful sign-in

One cause Microsoft lists is a user from a different tenant who signed in and did not sign out gracefully[^38]. In that case, that user should sign in and sign out again[^38]. Microsoft also lists a missing phone number as a cause[^49].

### Device signs itself out

Microsoft says to check that SIP Gateway is still enabled for the user[^52]. Microsoft also says to check whether settings changed, for example the removal of the user's phone number[^52].

### Device is missing from Teams admin center or shows the wrong state

A SIP device appears under Teams devices > SIP devices only after a user has signed in to it at least once[^56]. A signed-out device shows as offline[^56].

### Device was offboarded

SIP Gateway automatically offboards stale devices[^55]. Paired (signed-in) devices are offboarded after 30 days without connecting, and unpaired (signed-out) devices after 14 days[^55]. An offboarded device can be onboarded again after a factory reset[^55]. After the reset, Microsoft says to re-enter the regional Teams SIP provisioning URL under Auto Provisioning in the phone's admin menu or web interface, save, and restart the phone[^36].

### Device shows the wrong time

Microsoft's troubleshooting article points to the DHCP settings, where option 42 can specify the NTP server and option 2 the UTC offset in seconds[^26].

### Calls cannot be made or received

Microsoft says to check that the device is registered and to restart it[^17]. Microsoft then says to test the same call to or from the same remote address in the Teams app[^17].

## Platform differences

Compatible Cisco SIP IP phones support dynamic emergency location discovery with SIP Gateway over LLDP only[^20]. Devices that share no location attributes fall back to registered addresses[^20]. In GCC, enrolling SIP devices by dialling *55* plus a one-time verification code is not available[^40]. Microsoft's workaround is Zero Touch Common Area Phone sign-in[^30]. That workaround uses the SIP remote login portal with the CAP account, a region (NOAM, EMEA or APAC), and the device MAC in XX-XX-XX-XX-XX-XX format[^30].

## See also

- [Setting up SIP Gateway for Cisco and Poly phones on Teams](https://warmtransfer.net/knowledge/teams-sip-gateway-setup)
- [Troubleshooting Teams phone sign-in and provisioning](https://warmtransfer.net/knowledge/teams-phone-sign-in-troubleshooting)
- [Teams Rooms and common area phones calling](https://warmtransfer.net/knowledge/teams-rooms-common-area-phones)
- [Identity SSO and directory provisioning for UC](https://warmtransfer.net/knowledge/identity-sso-provisioning)
- [Setting up dynamic emergency calling in Microsoft Teams](https://warmtransfer.net/knowledge/teams-dynamic-e911-setup)
- [One-way and no-way audio diagnosis](https://warmtransfer.net/knowledge/one-way-audio)

## Applicability

Applies to: Microsoft Teams SIP Gateway, Microsoft 365, MicrosoftTeams PowerShell module, Microsoft Entra ID, and Microsoft identity platform. Deployments: multi-tenant, dod, and gcc. Sources checked 2026-10-02. SIP Gateway is not yet available for the US Government DoD cloud[^35]. In GCC, one-time verification code enrolment with *55* is not available[^40]. The additional Conditional Access service IPs in the 70.152.0.0 space apply starting 1 January 2026[^12]. Bulk sign-in requires Teams PowerShell 5.6.0 or later[^6].

## What remains uncertain

Microsoft added a further set of SIP Gateway service IPs for Conditional Access exclusions starting 1 January 2026[^12]. Whether the service IP lists have changed since then is not covered by the sources below. Cisco phones support dynamic emergency location discovery over LLDP only and fall back to registered addresses[^20]. How to diagnose dynamic emergency location failures on SIP Gateway devices is not covered by the sources below.

Microsoft's SIP Gateway troubleshooting article has no section on one-way or no audio, and its call sections cover only failures to make or receive calls[^34]. One-time code enrolment is unavailable in GCC[^40]. Broader SIP Gateway feature parity in GCC and GCC High is not covered by the sources below. Compatibility table rows beyond the Cisco and Poly VVX models listed above, including approved firmware builds for AudioCodes and Yealink phones, are not covered by the sources below.

Microsoft describes the SIP Gateway pairing code only as time-sensitive[^41]. The 15-minute default in the generic Microsoft identity platform device code flow is not documented as SIP Gateway's pairing code lifetime[^28]. Whether blocking device code flow in Conditional Access affects SIP Gateway pairing is not covered by the sources below. The procedure and licence for converting Cisco phones from enterprise to MPP firmware are not covered by the sources below. How to collect device and SIP Gateway logs for a Microsoft support case is not covered by the sources below.

## Sources

[^1]: Error AADSTS530036 means a refresh token is invalid because of Conditional Access authentication flow checks (protocol tracking); with the policy enabled Microsoft gives no remediation, and after disabling it or setting it to report-only a fresh token may be needed. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Authentication flows as a condition in Conditional Access policy > Troubleshooting unexpected blocks (and Note). Checked 2026-10-02.
[^2]: Algo says that if an Algo device cannot generate a Teams pairing code, or the Teams section is missing from its Status page, DNS is the likely cause; devices with a static IP must have a valid DNS server configured. Source: [Microsoft Teams Configuration with Algo IP Devices Using the Device Web Interface](https://docs.algosolutions.com/docs/microsoft-teams-configuration), Microsoft Teams Configuration with Algo IP Devices > troubleshooting section. Checked 2026-10-02.
[^3]: The AllowCallRedirect calling policy parameter enables local call redirection for SIP devices connecting through the Teams SIP gateway, with values Enabled and Disabled; UserOverride is listed but not available for use. Source: [Set-CsTeamsCallingPolicy (MicrosoftTeams)](https://learn.microsoft.com/en-us/powershell/module/microsoftteams/set-csteamscallingpolicy), Set-CsTeamsCallingPolicy > Parameters > -AllowCallRedirect. Checked 2026-10-02.
[^4]: Users are enabled for SIP Gateway by setting AllowSIPDevicesCalling to True in their Teams calling policy (Teams admin center setting 'SIP devices can be used for calls'); Microsoft's configure article states the default is False. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Enable SIP Gateway for the users in your organization > By using Teams admin center; By using PowerShell. Checked 2026-10-02.
[^5]: The device location shown in the Microsoft Entra web authentication app during SIP Gateway pairing is the SIP Gateway datacenter the device is connected to, not the phone's site. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > How to sign in and sign out > User pairing and sign-in > first Note. Checked 2026-10-02.
[^6]: Accounts in a bulk sign-in request must have the CommonAreaPhone policy, must not have MFA enabled, must have a phone number assigned and must have the SIP device calling policy; the tenant BulkSignIn setting must be Enabled and Teams PowerShell 5.6.0 or later is required. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Bulk sign in > Bulk sign in prerequisites > 3-9. Checked 2026-10-02.
[^7]: The bulk sign-in error 'Public IP not configured as Trusted IP' means either the tenant ID in the provisioning URL is wrong or the device's public IP is not listed as a trusted IP in Teams admin center. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Bulk sign in error messages table, row 'Public IP not configured as Trusted IP.'. Checked 2026-10-02.
[^8]: Bulk sign-in works for new SIP devices within 72 hours of onboarding to SIP Gateway, or for signed-out devices within 7 days (168 hours) of sign-out; batches hold up to 100 devices with at most 3 concurrent batches per region. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Bulk sign in (intro and scenario list). Checked 2026-10-02.
[^9]: For bulk sign-in, the tenant ID must be added to the device provisioning URL (for example http://noam.ipp.sdg.teams.microsoft.com/tenantid/<tenant-GUID>, with /$PSN.xml appended for Cisco and mac.ini for analog lines on AudioCodes ATAs). Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Bulk sign in > Bulk sign in prerequisites > 2. Checked 2026-10-02.
[^10]: Bulk sign-in requires the site public IP addresses to be added as trusted IPs in Teams admin center at least 24 hours before running the bulk sign-in cmdlets. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Bulk sign in > Bulk sign in prerequisites > 1. Checked 2026-10-02.
[^11]: The tenant-wide BulkSignIn setting for SIP devices is set with Set-CsTeamsSipDevicesConfiguration -BulkSignIn Enabled or Disabled, which requires a role such as Teams Administrator or Teams Communication Administrator. Source: [Set-CsTeamsSipDevicesConfiguration (MicrosoftTeams)](https://learn.microsoft.com/en-us/powershell/module/teams/set-csteamssipdevicesconfiguration), Set-CsTeamsSipDevicesConfiguration > Description; Parameters > -BulkSignIn. Checked 2026-10-02.
[^12]: Starting 1 January 2026, the same tenants must also exclude additional SIP Gateway service IPs in the 70.152.0.0 space (for North America 70.152.106.56, 70.152.136.2, 70.152.120.55 and 70.152.38.25, with separate EMEA and APAC lists). Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Configure conditional access > 'Starting 1st January 2026' list. Checked 2026-10-02.
[^13]: If the tenant uses Conditional Access, Microsoft says to exclude the site public IP addresses and the SIP Gateway API app (app ID 0ab9de21-b802-4d77-b279-1ad41ca233b4), because SIP devices are not Intune-managed and get stricter checks. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Configure conditional access. Checked 2026-10-02.
[^14]: An Entra authentication flows policy that blocks device code flow for all resources is likely to block SIP Gateway pairing unless the SIP Gateway apps or site are excluded, because SIP Gateway pairing follows the device authorization grant pattern; Microsoft's SIP Gateway pages do not state this directly (inferred). Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Authentication flows as a condition in Conditional Access policy > Device code flow; Troubleshooting unexpected blocks. Checked 2026-10-02.
[^15]: Tenants using bulk sign-in, or whose SIP devices were signed in before July 2023, need location-based Conditional Access exclusions for the SIP Gateway service IPs (North America 52.170.38.140 and 40.112.144.212; EMEA 40.112.71.149 and 40.113.112.67; APAC 20.92.120.71 and 13.73.115.90). Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Configure conditional access > Note. Checked 2026-10-02.
[^16]: The SIP Gateway resources cannot be directly excluded from Conditional Access policies; Microsoft documents a dynamic app filter using a custom security attribute instead, and notes the SIP Gateway apps own no scopes and depend on the Teams app. Source: [Set up dynamic filters for SIP Gateway - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-dynamic-filters), Set up dynamic filters for SIP Gateway > introduction (second paragraph). Checked 2026-10-02.
[^17]: For failures to make or receive calls on a SIP Gateway device, Microsoft says to check the device is registered, restart it, and test the same call to or from the same remote address in the Teams app. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > I can't make calls; I can't receive calls. Checked 2026-10-02.
[^18]: SIP phones on SIP Gateway depend on Call Redirect, so the admin must set AllowCallRedirect to Enabled in the user's Teams calling policy; local call forwarding on the device also needs it. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Sync policy changes to SIP devices to enforce policies. Checked 2026-10-02.
[^19]: For Cisco 6821-6871, 7811-7861 and 8811-8865 phones, SIP Gateway's minimum firmware is 11.1.1MPP and the approved version is 12-0-7MPP; the Cisco 8832 minimum is 11.3.5MPP. Source: [Plan SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-plan), Plan SIP Gateway > Compatible devices table > Cisco rows. Checked 2026-10-02.
[^20]: Compatible Cisco SIP IP phones support dynamic emergency location discovery with SIP Gateway over LLDP only; devices that share no location attributes fall back to registered addresses. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Emergency calling (paragraph and Note). Checked 2026-10-02.
[^21]: Cisco IP phones must be converted to multiplatform (MPP) firmware before they can be onboarded to SIP Gateway; phones on enterprise firmware cannot onboard as-is. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note. Checked 2026-10-02.
[^22]: For Cisco devices, /$PSN.xml must be appended to the SIP Gateway provisioning server URL. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note. Checked 2026-10-02.
[^23]: Microsoft Entra Conditional Access can target device code flow as an authentication flow condition, and Microsoft recommends blocking device code flow wherever possible and allowing it only where necessary. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Authentication flows as a condition in Conditional Access policy > Device code flow. Checked 2026-10-02.
[^24]: In-scope SIP phones are not OAuth-capable, so SIP Gateway authenticates the user through a web authentication app and pairs the device with the user's credentials, and Microsoft points to the OAuth 2.0 device authorization grant flow for background. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > How to sign in and sign out > User pairing and sign-in > first Note. Checked 2026-10-02.
[^25]: For Cisco, Poly and AudioCodes phones, the SIP Gateway provisioning URL is delivered with DHCP option 160. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note. Checked 2026-10-02.
[^26]: Microsoft notes DHCP option 42 can specify the NTP server and DHCP option 2 the UTC offset in seconds for SIP Gateway devices, and the troubleshooting article points to DHCP settings when a device displays the wrong time. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP. Checked 2026-10-02.
[^27]: For Yealink and Alcatel-Lucent Enterprise phones, the SIP Gateway provisioning URL is delivered with DHCP option 66. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Manually > Note. Checked 2026-10-02.
[^28]: In the Microsoft identity platform's generic device code flow, the user has 15 minutes from the device authorization request to sign in, the default expires_in value; this is not documented as SIP Gateway's pairing code lifetime. Source: [OAuth 2.0 device authorization grant - Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code), OAuth 2.0 device authorization grant > Device authorization request. Checked 2026-10-02.
[^29]: Microsoft requires each SIP device used with Teams SIP Gateway to be reset to factory default settings before SIP Gateway is configured. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Before you can configure SIP Gateway, do the following > Reset SIP devices to factory default settings. Checked 2026-10-02.
[^30]: Microsoft's workaround for the unavailable one-time-code enrolment in GCC is Zero Touch Common Area Phone sign-in, which uses the SIP remote login portal with the CAP account, a region (NOAM, EMEA or APAC) and the device MAC in XX-XX-XX-XX-XX-XX format. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > I can't enroll my device by using a one-time verification code (workaround). Checked 2026-10-02.
[^31]: SIP Gateway supports only IPv4, even though the Teams service and client support both IPv4 and IPv6. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Microsoft Teams and IPv6. Checked 2026-10-02.
[^32]: Microsoft 365 endpoint set ID 11 (Teams, Optimize Required) lists UDP 3478-3481 to 52.112.0.0/14, 52.122.0.0/15 and 2603:1063::/38; this is a different port list from the UDP 49152-53247 range the SIP Gateway configure article specifies. Source: [Microsoft 365 URLs and IP address ranges](https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges), Microsoft 365 URLs and IP address ranges > Microsoft Teams table > ID 11. Checked 2026-10-02.
[^33]: SIP devices must be on the minimum supported firmware version listed in the Plan for SIP Gateway article to onboard; during onboarding SIP Gateway pushes default configuration and the authentication UI to the device. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP (final paragraph). Checked 2026-10-02.
[^34]: Microsoft's SIP Gateway troubleshooting article has no section on one-way or no audio; its call sections cover only failures to make or receive calls. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > full list of H2 sections. Checked 2026-10-02.
[^35]: SIP Gateway is not yet available for the US Government DoD cloud. Source: [Plan SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-plan), Plan SIP Gateway > Requirements to use SIP Gateway > Note. Checked 2026-10-02.
[^36]: After factory-resetting an offboarded phone, Microsoft says to re-enter the regional Teams SIP provisioning URL under Auto Provisioning in the phone's admin menu or web interface, save, and restart the phone. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > Teams SIP phone is offboarded. Checked 2026-10-02.
[^37]: One-way or no audio on SIP Gateway calls where signalling works is most plausibly caused by blocked outbound UDP 49152-53247 to 52.112.0.0/14 and 52.122.0.0/15, since TCP 5061 can succeed independently; Microsoft does not document this diagnosis (inferred). Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Before you can configure SIP Gateway > Open the UDP port; Open the TCP port. Checked 2026-10-02.
[^38]: If a device does not update after a successful sign-in, one cause Microsoft lists is a user from a different tenant who signed in and did not sign out gracefully; that user should sign in and sign out again. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > My device doesn't update after I sign in successfully > step 3. Checked 2026-10-02.
[^39]: For common area phone enrolment, the admin generates a one-time verification code per MAC address in Teams admin center and the code is dialled on the device after feature code *55* (for example *55*123456); the device must already be onboarded to SIP Gateway. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Provision and enroll SIP devices as common area phones > Note and step 4. Checked 2026-10-02.
[^40]: Enrolling SIP devices by dialling *55* plus a one-time verification code is not available in the GCC environment. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > I can't enroll my device by using a one-time verification code. Checked 2026-10-02.
[^41]: The pairing code shown after pressing Sign-in on a SIP phone is time-sensitive; if it expires the user must press Back on the phone and start sign-in again. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > How to sign in and sign out > User pairing and sign-in > step 1. Checked 2026-10-02.
[^42]: Only local sign-in (on the device) is supported for users' personal SIP devices; remote sign-in methods apply to common area phones. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > How to sign in and sign out (first sentence); Zero Touch Common Area Phone sign in. Checked 2026-10-02.
[^43]: After enabling SIP devices in a calling policy, policy propagation may take up to 24 hours. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Enable SIP Gateway for the users in your organization > By using PowerShell > Note. Checked 2026-10-02.
[^44]: User details and policies are fetched to the SIP device at sign-in, and later policy changes for signed-in users sync to the device within one hour. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Sync policy changes to SIP devices to enforce policies. Checked 2026-10-02.
[^45]: Poly VVX models are listed for SIP Gateway with minimum firmware 5.9.5, with approved versions of 5.9.7.3480 (VVX x00/x10 models) or 6.4.x (VVX 150, x01, x11 and x50 models). Source: [Plan SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-plan), Plan SIP Gateway > Compatible devices table > Poly VVX rows. Checked 2026-10-02.
[^46]: A SIP phone that has been successfully provisioned to SIP Gateway displays the Teams logo and a soft button for sign-in. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP. Checked 2026-10-02.
[^47]: The SIP Gateway provisioning server URLs are http://emea.ipp.sdg.teams.microsoft.com for EMEA, http://noam.ipp.sdg.teams.microsoft.com for the Americas and http://apac.ipp.sdg.teams.microsoft.com for APAC. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Set the SIP Gateway provisioning server URL > Using DHCP. Checked 2026-10-02.
[^48]: SIP devices used with SIP Gateway must not sit behind a corporate HTTP/HTTPS proxy; their http/s traffic must bypass any proxy. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Before you can configure SIP Gateway > Make sure the SIP devices are not behind a proxy. Checked 2026-10-02.
[^49]: Teams users must have a phone number with PSTN calling enabled to use SIP Gateway; Microsoft lists a missing number as a cause when a device does not update after successful sign-in. Source: [Plan SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-plan), Plan SIP Gateway > Requirements to use SIP Gateway. Checked 2026-10-02.
[^50]: When a device cannot register to Teams, Microsoft says to check firewall and proxy blocking of the required endpoints and ports, check whether other SIP devices have the same issue (which may mean the service is unavailable), and restart the device. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > I can't register my device to Teams. Checked 2026-10-02.
[^51]: If remote sign-in to a device fails, Microsoft says to verify the device was enrolled correctly and to try local sign-in. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > I can't sign in to my device remotely. Checked 2026-10-02.
[^52]: When a device signs itself out, Microsoft says to check that SIP Gateway is still enabled for the user and whether settings changed, for example the user's phone number being removed. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > My device signs itself out. Checked 2026-10-02.
[^53]: To see whether device code flow is used, Microsoft suggests running the Conditional Access policy in report-only mode or filtering Entra sign-in logs with the Authentication protocol filter; the Conditional Access tab of a blocked sign-in shows whether an authentication flows policy matched. Source: [Authentication flows as a condition in Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows), Authentication flows as a condition in Conditional Access policy > Sign-in logs; Troubleshooting unexpected blocks. Checked 2026-10-02.
[^54]: The dynamic filter procedure tags the SIP Gateway API (0ab9de21-b802-4d77-b279-1ad41ca233b4) and SIP Gateway UserApp (582b2e88-6cca-4418-83d2-2451801e1d26) service principals, plus Teams SIP Gateway (61c8fd69-c13e-4ee6-aaa6-24ff71c09bca) when bulk sign-in is used, creating the service principals first if they are absent. Source: [Set up dynamic filters for SIP Gateway - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-dynamic-filters), Set up dynamic filters for SIP Gateway > Step 3: Add SIP Gateway Service Principals to your tenant; Step 4. Checked 2026-10-02.
[^55]: SIP Gateway automatically offboards stale devices: paired (signed-in) devices after 30 days without connecting and unpaired (signed-out) devices after 14 days; an offboarded device can be onboarded again after a factory reset. Source: [Plan SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-plan), Plan SIP Gateway > Benefits of SIP Gateway > Off board stale devices. Checked 2026-10-02.
[^56]: A SIP device appears in Teams admin center under Teams devices > SIP devices only after a user has signed in to it at least once, and a signed-out device shows as offline. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > My device isn't listed in the Teams admin center; My device is listed in the Teams admin center, but shows wrong state. Checked 2026-10-02.
[^57]: SIP Gateway requires TCP port 5061 to be open towards the IP ranges 52.112.0.0/14 and 52.122.0.0/15, and the firewall rules are needed for outbound traffic only. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Before you can configure SIP Gateway > Open the TCP port; Open your firewall to Microsoft 365 and Teams. Checked 2026-10-02.
[^58]: SIP Gateway requires UDP ports 49152 to 53247 to be open towards the IP ranges 52.112.0.0/14 and 52.122.0.0/15. Source: [Configure SIP Gateway](https://learn.microsoft.com/en-us/microsoftteams/devices/sip-gateway-configure), Configure SIP Gateway > Before you can configure SIP Gateway > Open the UDP port. Checked 2026-10-02.
[^59]: When a device cannot onboard, Microsoft says to verify the provisioning server URL begins with HTTP and not HTTPS. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > I can't onboard my device > step 3. Checked 2026-10-02.
[^60]: When web app authentication fails during SIP Gateway sign-in, Microsoft says to confirm the credentials by signing in to the Teams app with them and, if Conditional Access is used, to make sure the SIP Gateway IP addresses are excluded. Source: [Common Issues When Using SIP Devices With Teams](https://learn.microsoft.com/en-us/troubleshoot/microsoftteams/phone-system/sip-gateway-issues), Common Issues When Using SIP Devices With Teams > Web app authentication fails when I try to sign in. Checked 2026-10-02.