📞 Microsoft Teams Direct Routing: SIP Trunk Setup – Complete Guide
Summary: Microsoft Teams Direct Routing connects your existing SIP trunk infrastructure to Teams Phone System, enabling PSTN calling without Microsoft calling plans. This guide provides a step-by-step walkthrough—from prerequisites and SBC configuration to domain verification, voice routing policies, and PowerShell commands. Whether you're an IT administrator or a telecom manager, this comprehensive guide ensures a successful Direct Routing deployment.
📖 Table of Contents
- 1. What is Direct Routing?
- 2. Prerequisites & Requirements
- 3. Step 1: Domain Setup & Verification
- 4. Step 2: Connect Your SBC
- 5. Step 3: Configure Voice Routing
- 6. Step 4: Enable Users & Assign Policies
- 7. Certificate Requirements
- 8. Direct Routing vs Calling Plans
- 9. Best Practices
- 10. Frequently Asked Questions
- 11. Related Resources
🔍 What is Microsoft Teams Direct Routing?
Microsoft Teams Direct Routing is a feature that allows you to connect your existing telephony infrastructure to Microsoft Teams Phone System. It enables Teams users to make and receive Public Switched Telephone Network (PSTN) calls using your own carrier's SIP trunks while leveraging Teams as their primary communication client [citation:3][citation:6].
Unlike Microsoft Calling Plans (which provide PSTN connectivity directly from Microsoft), Direct Routing gives you full control over your telephony carrier, number management, and call routing. It's the preferred choice for organizations that:
✅ Why Choose Direct Routing
- Maintain existing carrier relationships and contracts
- Keep current phone numbers with no porting required
- Leverage competitive international calling rates from your carrier
- Have complex call routing requirements [citation:4]
- Need to connect multiple on-premises PBXs to Teams [citation:6]
⚠️ Key Considerations
- Requires a certified Session Border Controller (SBC) [citation:6]
- Requires Teams Phone System licensing (E5 or add-on) [citation:3][citation:8]
- Requires in-house or partner expertise for SBC management
- Not available for users in the "Islands" mode [citation:8]
💡 Key Insight: Direct Routing is designed for organizations that already have voice infrastructure and want to integrate it with Teams. If you're starting fresh without an SBC or carrier contracts, Microsoft Calling Plans or Operator Connect may be simpler options [citation:3].
📋 Prerequisites & Requirements
Before you begin, ensure you have the following prerequisites in place [citation:3][citation:8]:
| Requirement | Details |
|---|---|
| Microsoft 365 Tenant | An active Microsoft 365 or Office 365 tenant |
| Certified SBC | A Session Border Controller from Microsoft's certified partners list [citation:6] |
| Public Trusted Certificate | Certificate signed by a CA in the Microsoft Trusted Root Program; must include Server Authentication (EKU) [citation:3][citation:5] |
| Domain Registration | A domain registered in your tenant (e.g., contoso.com) – *.onmicrosoft.com is not supported [citation:2][citation:8] |
| Public DNS Record | An A record mapping the SBC FQDN to its public IP address [citation:3] |
| Licenses | Teams Phone license (E5 or Phone System add-on) + Microsoft Teams license [citation:3][citation:8] |
| Firewall Access | Open ports for SIP signaling (5061) and media to Microsoft FQDNs [citation:3] |
⚠️ Important: The SBC FQDN domain name must match a domain registered in your tenant. The domain portion cannot be *.onmicrosoft.com. For example, if you have contoso.com registered, use sbc.contoso.com [citation:2][citation:9].
🌐 Step 1: Domain Setup & Verification
Before connecting your SBC, you must set up and verify the domain that will be used for the SBC FQDN [citation:1].
- 1 Add the domain in Microsoft 365: Go to Settings → Domains, click Add domain, and enter your domain (e.g., contoso.com) [citation:1].
- 2 Verify the domain: Select Use this domain, then Add a TXT record and save the provided TXT value (e.g., MS=ms83401203) [citation:1].
- 3 Complete verification: Add the TXT record to your public DNS, then return to Microsoft 365 and select Verify. Choose More Options → Skip and do this later [citation:1].
- 4 Create a user with the domain: Go to Users → Active users, click Add a user, and enter a username with your verified domain (e.g., test@contoso.com). Assign a Microsoft 365 license with Phone System [citation:1].
💡 Note: It may take up to 24 hours for the domain to be fully provisioned in your tenant after verification [citation:1].
🔧 Step 2: Connect Your SBC to Direct Routing
You can connect your SBC using the Microsoft Teams Admin Center or PowerShell [citation:2][citation:9].
Method A: Microsoft Teams Admin Center
- 1 Sign in to the Microsoft Teams Admin Center [citation:1].
- 2 Go to Voice → Direct Routing, then select the SBCs tab [citation:2].
- 3 Click Add [citation:2].
- 4 Enter the SBC FQDN (e.g., sbc.contoso.com) – the domain must match a registered tenant domain [citation:2].
- 5 Configure settings: SIP signaling port (5061), enable Send SIP options for health monitoring, and set MaxConcurrentSessions [citation:1].
- 6 Click Save [citation:2].
Method B: PowerShell
Connect to Teams PowerShell and use the New-CsOnlinePSTNGateway cmdlet [citation:2][citation:9]:
⚠️ Important: The SBC FQDN domain must match a verified domain in your tenant. The Get-Command *onlinePSTNGateway* command confirms the required cmdlets are available [citation:2][citation:9].
🚀 Need Expert Help with Direct Routing? NetviaVoice Can Assist
Our certified Teams consultants can handle your entire Direct Routing deployment—from SBC selection and configuration to voice routing policies and user enablement.
Visit NetviaVoice📤 Step 3: Configure Voice Routing
Voice routing policies define how calls are routed from Teams users to the PSTN via your SBC [citation:4][citation:7].
Create PSTN Usage Records
- 1 In the Teams Admin Center, go to Voice → Direct Routing [citation:4].
- 2 Select Manage PSTN usage records [citation:4].
- 3 Click Add and create usage records (e.g., "US and Canada", "International") [citation:4].
Create Voice Routes
Voice routes map dialed number patterns to SBCs and PSTN usages [citation:4][citation:7]:
| Route Name | Number Pattern | Priority | SBC(s) | PSTN Usage |
|---|---|---|---|---|
| Redmond 1 | ^\+1(425|206)(\d{7})$ | 1 | sbc1.contoso.com, sbc2.contoso.com | US and Canada |
| Redmond 2 | ^\+1(425|206)(\d{7})$ | 2 | sbc3.contoso.com, sbc4.contoso.com | US and Canada |
| Other +1 | ^\+1(\d{10})$ | 3 | sbc5.contoso.com, sbc6.contoso.com | US and Canada |
💡 Pro Tip: Routes are tried in priority order. If the highest-priority SBC is unavailable, the system automatically falls back to the next SBC in the route [citation:4][citation:7].
Create and Assign Voice Routing Policies
A voice routing policy is a container for PSTN usage records. You can use the global policy or create custom policies [citation:4][citation:10].
👤 Step 4: Enable Users & Assign Policies
Once your SBC and voice routes are configured, enable users for Direct Routing [citation:1][citation:5]:
- 1 Enable Enterprise Voice: Set
EnterpriseVoiceEnabled $truefor the user [citation:5]. - 2 Assign Voice Routing Policy: Grant the voice routing policy to the user [citation:4][citation:5].
- 3 Set On-Premise Line URI: Specify the user's phone number in E.164 format (e.g.,
tel:+10001001008) [citation:5]. - 4 Assign Calling Policy: Grant a calling policy that allows PSTN calls [citation:5].
- 5 Assign Teams Upgrade Policy: Set the user to Teams mode [citation:5].
🔐 Certificate Requirements
Your SBC certificate must meet specific requirements for Direct Routing [citation:3][citation:5]:
| Requirement | Details |
|---|---|
| Certificate Authority | Must be from a CA in the Microsoft Trusted Root Program [citation:3][citation:5] |
| Extended Key Usage (EKU) | Must include Server Authentication [citation:3] |
| TLS Version | Must support TLS 1.2 [citation:9] |
| Cipher Suites | Must support TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and others [citation:9] |
| Wildcard Support | Wildcard certificates are supported [citation:5] |
⚠️ Important: The certificate must be installed in the SBC's trusted root store. Microsoft service certificates use root CAs listed in the Azure Certificate Authority details page [citation:3].
📊 Direct Routing vs Microsoft Calling Plans
Understanding the differences helps you choose the right PSTN connectivity option:
| Feature | Direct Routing | Microsoft Calling Plans |
|---|---|---|
| Carrier | Your own carrier or partner | Microsoft's carrier |
| Number Porting | Keep existing numbers | Port numbers to Microsoft |
| International Rates | Your carrier's rates | Microsoft's rates |
| Infrastructure | Requires SBC | No SBC required |
| Routing Control | Full control | Limited to Microsoft's routing |
| Complexity | Higher | Lower |
🏆 Direct Routing Best Practices
✅ SBC Configuration
- Set a maximum call limit on the SBC matching the MaxConcurrentSessions value [citation:9]
- Configure SIP OPTIONS for health monitoring
- Use multiple FQDNs (sip.pstnhub.microsoft.com, sip2, sip3) for failover [citation:3]
- Open firewall ports for all Microsoft IP subnets [citation:3]
✅ Voice Routing
- Create multiple routes with different priorities for failover [citation:4]
- Use specific number patterns rather than broad matches
- Document all PSTN usage records and policies
- Test routes with test users before full deployment
✅ Security
- Ensure TLS 1.2 is enabled on the SBC [citation:9]
- Use certificates from trusted CAs [citation:3]
- Implement strong encryption ciphers [citation:9]
- Monitor for fraud and unauthorized usage
✅ Management
- Use PowerShell scripts for bulk user enablement [citation:4]
- Regularly review voice routing policies [citation:10]
- Test failover scenarios periodically
- Maintain up-to-date documentation of the configuration
❓ Frequently Asked Questions
Direct Routing is a feature that allows you to connect your existing telephony infrastructure (SIP trunks and Session Border Controllers) to Microsoft Teams Phone System. It enables Teams users to make and receive PSTN calls using your own carrier while leveraging Teams as their primary communication client [citation:3][citation:6].
Key prerequisites include: a certified SBC, a Microsoft Teams Phone System license (E5 or Phone System add-on), a public trusted certificate for the SBC, a public DNS record mapping the SBC FQDN to its IP address, and a domain registered in your Microsoft 365 tenant [citation:3][citation:8].
You can connect your SBC using the Microsoft Teams Admin Center or PowerShell. In the Admin Center, go to Voice > Direct Routing > SBCs tab and click Add. In PowerShell, use the New-CsOnlinePSTNGateway cmdlet to pair the SBC. The SBC FQDN domain must match a registered domain in your tenant, excluding *.onmicrosoft.com [citation:2][citation:9].
Direct Routing uses three FQDNs: sip.pstnhub.microsoft.com (primary), sip2.pstnhub.microsoft.com (secondary), and sip3.pstnhub.microsoft.com (tertiary). These provide geographic redundancy and failover capability. The SBC should be configured to try these in order [citation:3][citation:8].
Users require a Teams Phone license (included in E5 or available as an add-on for E3) and Microsoft Teams. Users with a Microsoft Calling Plan license can also use Direct Routing, with the calling plan serving as the default route when no voice routing policy matches [citation:3][citation:8].
📢 Ready to set up Direct Routing for Microsoft Teams? Let NetviaVoice guide your deployment.