Teams Shared Calling Outbound Calls Dropping: Fixing 403 Forbidden, PAYG Billing & Voice Routing Policies

Few VoIP rollouts promise greater cost savings than Microsoft Teams Shared Calling. By consolidating shift workers, retail staff, and back-office personnel onto shared resource accounts rather than provisioning costly individual DIDs and calling plans, enterprises frequently cut their monthly telecom expenditure by 60% or more. However, when voice administrators cut over users in production, one urgent symptom dominates community forums and internal helpdesk tickets: outbound calls drop immediately upon dialing.

Users report hearing a single brief click followed by silence, a fast busy tone, or the automated recording: “Your call cannot be completed as dialed. Please check the number and try again.” In the Microsoft Teams desktop and mobile clients, the call window abruptly flashes “Call ended” or “Network issue” within 500 milliseconds of pressing the dial button.

Decoding the Drop: SIP Codes in Teams Admin Center & CQD

Before modifying any user policies, inspect the failed session in the Microsoft Teams Admin Center (TAC) under Users → Manage Users → [Target User] → Meetings & Calls, or extract the session payload from the Call Quality Dashboard (CQD) and PSTN & SMS (preview) usage logs.

Diagnostic / SIP Code	Reported Reason	Actual Root Cause
SIP 403 Forbidden / DiagCode 5003	“User is not authorized for external dialing”	Resource Account has a Pay-As-You-Go Calling Plan license assigned, but zero Communication Credits or unlinked Azure Subscription.
SIP 404 Not Found / DiagCode 4041	“No voice route found for destination”	The user has an active Online Voice Routing Policy assigned with populated PSTN Usages, causing Microsoft to bypass Shared Calling and look for a non-existent Direct Routing SBC route.
SIP 488 Not Acceptable Here	“Media negotiation failed”	User object has Teams Phone license assigned, but EnterpriseVoiceEnabled is set to $false because no individual DID was ever assigned.
SIP 504 Server Time-out	“Gateway timeout”	Emergency Callback Number (ECBN) is missing or pointing to a Resource Account whose assigned telephone number is unassigned or suspended.

Root Cause 1: Unfunded Pay-As-You-Go Billing or Missing Azure Meter

When deploying Microsoft Calling Plans under Shared Calling, the underlying Resource Account (the account holding the shared phone number) requires a Microsoft Teams Phone Resource Account license plus either a Domestic Calling Plan or a Teams Phone with Calling Plan (Pay-As-You-Go).

If you choose Pay-As-You-Go (the most cost-effective option for low-volume outbound users), Microsoft requires an active billing meter for consumption. If this billing bridge is broken, the call is rejected at the PSTN gateway level with zero user-facing notification.

Verifying Communication Credits & Azure Subscriptions via PowerShell

# 1. Connect to Microsoft Graph and Teams PowerShell
Import-Module MicrosoftTeams
Connect-MicrosoftTeams

# 2. Check the Resource Account licensing and assigned phone number
$ResourceAccountUPN = "sharedcalling-ra@yourdomain.com"
Get-CsPhoneNumberAssignment -AssignedPstnTargetId (Get-CsOnlineUser -Identity $ResourceAccountUPN).ObjectId | 
    Select-Object TelephoneNumber, NumberType, AssignmentCategory, ActivationState

# 3. Verify that the assigned number is in "Activated" state
# If NumberType is CallingPlan, ensure tenant billing profile permits consumption dialing

To establish Azure subscription billing for Teams voice consumption:

1. Navigate to Microsoft 365 Admin Center → Billing → Purchase services.
2. Ensure Communication Credits is added with auto-recharge ($50 minimum threshold).
3. Alternatively, link your Azure Subscription under Billing → Payment methods → Billing accounts and associate the Teams Calling Pay-As-You-Go meter.

Root Cause 2: The “Blank PSTN Usages” Voice Routing Policy Requirement

The single most common architectural mistake in hybrid voice environments is assigning a regular Online Voice Routing Policy (OVRP) to a Shared Calling user.

In standard Microsoft Teams Direct Routing or Operator Connect configurations, users receive a Voice Routing Policy containing PSTN Usages (e.g., “US-Local”, “US-LongDistance”, or an on-premise SBC usage route). These usages direct Microsoft Teams to match dialed dial strings against Voice Routes and forward the call to your Session Border Controller (such as an AudioCodes Mediant SBC or Ribbon gateway).

Under Shared Calling, this logic breaks completely. If a user has a Voice Routing Policy containing active PSTN Usages, the Teams routing engine attempts to evaluate Direct Routing routes first. Because the shared user has no individual DID or SBC routing profile, Microsoft terminates the call with SIP 404 Not Found or SIP 403 Forbidden.

Creating and Assigning a Dedicated Shared Calling Voice Routing Policy

To ensure deterministic routing across large user groups, create an explicit policy with null PSTN usages:

# Step 1: Create a dedicated Online Voice Routing Policy with NO PSTN Usages
New-CsOnlineVoiceRoutingPolicy -Identity "SharedCalling-Users-VRP" -Description "Enforces PSTN delegation to Shared Calling Resource Account"

# Step 2: Ensure PSTN usages list is empty
Set-CsOnlineVoiceRoutingPolicy -Identity "SharedCalling-Users-VRP" -OnlinePstnUsages @()

# Step 3: Assign the policy to target shared users
Grant-CsOnlineVoiceRoutingPolicy -Identity "retail-user01@yourdomain.com" -PolicyName "SharedCalling-Users-VRP"

# Step 4: Verify that the policy reflects zero usages
Get-CsOnlineVoiceRoutingPolicy -Identity "SharedCalling-Users-VRP" | Select-Object Identity, OnlinePstnUsages

Root Cause 3: Missing `EnterpriseVoiceEnabled` Flag on User Objects

When an administrator assigns a traditional telephone number to a user via PowerShell:

Set-CsPhoneNumberAssignment -Identity user@domain.com -PhoneNumber "+12065551212" -PhoneNumberType CallingPlan

The backend cmdlet automatically stamps the attribute EnterpriseVoiceEnabled = $true onto the user account. This attribute instructs the Teams client to render the phone dial pad and enables the Teams SIP proxy to negotiate external media.

However, when onboarding users to Shared Calling, no individual phone number is assigned. In many tenants—particularly those relying on group-based licensing or hybrid AD sync—the EnterpriseVoiceEnabled attribute defaults to $false even though the user possesses a valid Teams Phone Standard license.

When an EnterpriseVoice-disabled user dials an external PSTN number, the call is rejected immediately with SIP 488 Not Acceptable Here or an instant silent drop.

PowerShell Remediation: Enabling Enterprise Voice Without a DID

# Check current EnterpriseVoice status
$User = Get-CsOnlineUser -Identity "user01@yourdomain.com"
[PSCustomObject]@{
    UserPrincipalName       = $User.UserPrincipalName
    EnterpriseVoiceEnabled  = $User.EnterpriseVoiceEnabled
    SharedCallingPolicy     = $User.TeamsSharedCallingPolicy
    VoiceRoutingPolicy      = $User.OnlineVoiceRoutingPolicy
    TeamsCallingPolicy      = $User.TeamsCallingPolicy
}

# If EnterpriseVoiceEnabled is False, force activation via Set-CsPhoneNumberAssignment
Set-CsPhoneNumberAssignment -Identity "user01@yourdomain.com" -EnterpriseVoiceEnabled $true

# Bulk enable EnterpriseVoice for all members of the Shared Calling security group
$GroupMembers = Get-MgGroupMember -GroupId "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d" -All
foreach ($Member in $GroupMembers) {
    Write-Host "Enabling Enterprise Voice for: $($Member.UserPrincipalName)" -ForegroundColor Cyan
    Set-CsPhoneNumberAssignment -Identity $Member.UserPrincipalName -EnterpriseVoiceEnabled $true
}

Root Cause 4: Emergency Callback Number (ECBN) & Ray Baum’s Act Rejections

Under United States federal telecommunications law (Kari’s Law and Ray Baum’s Act), every outbound PSTN call placed from an enterprise unified communications system must satisfy E911 compliance requirements. If a user dials an emergency service (911) or if a carrier performs dynamic location verification, an Emergency Callback Number (ECBN) must be routable back to the originating caller or emergency response team.

When you create a Teams Shared Calling Policy, Microsoft mandates specifying an emergency callback number:

New-CsTeamsSharedCallingPolicy -Identity "HQ-SharedCalling-Policy" `
    -ResourceAccount "sharedcalling-ra@yourdomain.com" `
    -EmergencyNumbers @("911", "933") `
    -EmergencyCallbackNumber "+12065551911"

Calls drop instantly if:

• The number specified in -EmergencyCallbackNumber is not assigned to an active Resource Account or user.
• The Resource Account holding the emergency number does not have a validated Civic Address / Emergency Location assigned in the Teams Admin Center.
• The emergency callback number does not belong to the same geographical country/region as the underlying Shared Calling resource account.

Production-Ready Diagnostic Script: Automated Health Check

To automate the identification of misconfigured Shared Calling users and resource accounts, the following PowerShell function audits every requirement in a single execution. This script is part of our enterprise administration suite available in the TeamsVoice-PowerShell-Toolbox GitHub Repository.

function Test-TeamsSharedCallingReadiness {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [string]$UserPrincipalName
    )

    Write-Host "`n=== Testing Shared Calling Readiness for: $UserPrincipalName ===" -ForegroundColor Cyan

    $User = Get-CsOnlineUser -Identity $UserPrincipalName -ErrorAction SilentlyContinue
    if (-not $User) {
        Write-Error "User $UserPrincipalName not found in tenant."
        return
    }

    # Test 1: Enterprise Voice Flag
    if ($User.EnterpriseVoiceEnabled) {
        Write-Host "  [PASS] Enterprise Voice is ENABLED." -ForegroundColor Green
    } else {
        Write-Host "  [FAIL] Enterprise Voice is DISABLED. Remediate with: Set-CsPhoneNumberAssignment -Identity '$UserPrincipalName' -EnterpriseVoiceEnabled `$true" -ForegroundColor Red
    }

    # Test 2: Shared Calling Policy Assignment
    $SCP = $User.TeamsSharedCallingPolicy
    if ($SCP) {
        Write-Host "  [PASS] Assigned Shared Calling Policy: $SCP" -ForegroundColor Green
        $PolicyObj = Get-CsTeamsSharedCallingPolicy -Identity $SCP -ErrorAction SilentlyContinue
        Write-Host "         Resource Account: $($PolicyObj.ResourceAccount)" -ForegroundColor Gray
        Write-Host "         Emergency Callback Number: $($PolicyObj.EmergencyCallbackNumber)" -ForegroundColor Gray
    } else {
        Write-Host "  [FAIL] No TeamsSharedCallingPolicy assigned to user!" -ForegroundColor Red
    }

    # Test 3: Voice Routing Policy Validation
    $VRP = $User.OnlineVoiceRoutingPolicy
    if (-not $VRP) {
        Write-Host "  [PASS] Voice Routing Policy: None (Default inheritance is safe)." -ForegroundColor Green
    } else {
        $VRPOptions = Get-CsOnlineVoiceRoutingPolicy -Identity $VRP -ErrorAction SilentlyContinue
        if ($VRPOptions.OnlinePstnUsages.Count -eq 0) {
            Write-Host "  [PASS] Voice Routing Policy '$VRP' has 0 PSTN Usages (Clean for Shared Calling)." -ForegroundColor Green
        } else {
            Write-Host "  [FAIL] Voice Routing Policy '$VRP' contains active PSTN Usages: $($VRPOptions.OnlinePstnUsages -join ', ')" -ForegroundColor Red
            Write-Host "         This will cause SIP 404 / 403 route interception! Reassign to null policy." -ForegroundColor Yellow
        }
    }

    # Test 4: Direct Inward Dialing Conflict
    if ($User.LineURI -or $User.PhoneNumber) {
        Write-Host "  [WARN] User has a direct phone number assigned ($($User.LineURI)). Shared Calling policy may be bypassed." -ForegroundColor Yellow
    } else {
        Write-Host "  [PASS] No direct DID conflict found (Standard Shared Calling profile)." -ForegroundColor Green
    }

    Write-Host "================================================================`n" -ForegroundColor Cyan
}

# Run execution test
Test-TeamsSharedCallingReadiness -UserPrincipalName "retail-user01@yourdomain.com"

Step-by-Step Resolution Runbook: Fixing the Drop in 5 Minutes

When an outage or rollout failure occurs in production, execute these remediation steps in exact order:

1. Check Resource Account Outbound Credit: Verify in the Microsoft 365 Admin Center under Billing → Your products that the Resource Account assigned to the Shared Calling Policy has an active Pay-As-You-Go Calling Plan or Domestic Calling Plan, and that the tenant Communication Credits balance is positive.
2. Purge PSTN Usages from User Voice Routing Policy: Run Grant-CsOnlineVoiceRoutingPolicy -Identity user@domain.com -PolicyName $null or assign a dedicated policy with @() PSTN usages.
3. Stamp Enterprise Voice: Force Set-CsPhoneNumberAssignment -Identity user@domain.com -EnterpriseVoiceEnabled $true.
4. Verify Dialing String & Normalization Rules: Confirm that the user dials using full E.164 format (e.g., +14155552671) or that a tenant Dial Plan normalizes local 7-digit and 10-digit dialing to E.164. Shared Calling resource accounts do not accept unnormalized local dial strings.
5. Allow Backend Sync (Up to 60 Minutes): Microsoft Teams voice policy updates can take between 15 to 60 minutes to propagate across all edge proxies. Force client cache clearance by signing out of the Teams desktop client and restarting.

Frequently Asked Questions (FAQ)

---