Fixing Teams OnPremLineURI Sync Errors: Clearing msRTCSIP Attributes to Assign Cloud Numbers

During enterprise voice migrations from legacy on-premises Skype for Business Server or Lync Server to native Microsoft Teams Direct Routing, Operator Connect, or Microsoft Calling Plans, voice engineers frequently run into a brick wall when provisioning telephone numbers. In the Microsoft Teams Admin Center (TAC) or when executing modern MicrosoftTeams PowerShell cmdlets, number assignment fails with the following critical error:

Set-CsPhoneNumberAssignment : Cannot modify the parameter "LineURI" because the user is synchronized from your on-premises Active Directory. 
You must manage this attribute on-premises, or disable directory synchronization.
At line:1 char:1
+ Set-CsPhoneNumberAssignment -Identity user@domain.com -PhoneNumber +1 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (user@domain.com:String) [Set-CsPhoneNumberAssignment], Exception
    + FullyQualifiedErrorId : UserIsSynchronizedFromOnPremises,Microsoft.Teams.ConfigAPI.Cmdlets.SetCsPhoneNumberAssignment

When administrators inspect the user object via Get-CsOnlineUser, they discover that while LineURI is empty in the cloud, OnPremLineURI or OnPremLineURIManuallySet is populated with an obsolete tel-URI string from years ago. Because the user is synchronized through Microsoft Entra Connect (or Entra Cloud Sync), Microsoft Entra ID enforces the on-premises directory as the authoritative source of truth. The cloud platform refuses to allow cloud-native telephone number assignments until the legacy on-prem attributes are remediated.

Understanding the msRTCSIP Attribute Hierarchy

When Active Directory was extended with the Skype for Business Server schema, Microsoft added dozens of attributes prefixed with msRTCSIP- to user objects. When Active Directory synchronizes to Microsoft Entra ID, Entra Connect maps these attributes directly into the Teams directory:

On-Prem AD Attribute	Cloud Attribute (Teams)	Impact on Teams Phone Architecture
msRTCSIP-Line	OnPremLineURI	Locks the telephone number. If populated, blocks Set-CsPhoneNumberAssignment and prevents assigning Teams Shared Calling or Calling Plans.
msRTCSIP-DeploymentLocator	HostingProvider	Directs SIP routing. If set to an on-prem FQDN instead of SRV: or clear, Teams routes external calls to a non-existent on-prem server.
msRTCSIP-UserEnabled	EnterpriseVoiceEnabled (Legacy)	If set to TRUE on-premises without active licenses, creates hybrid policy collisions and hides client dial pads.
msRTCSIP-PrimaryUserAddress	SipProxyAddress	Forces the SIP URI format. If it does not match the Entra UPN, routing policies will fail mutual TLS authentication with Session Border Controllers.

Diagnostic Triage: Identifying Stale Hybrid State in Cloud & On-Premises

To confirm whether a user is trapped in a hybrid sync lock, run the following diagnostic commands across both your cloud tenant and on-premises domain controller:

Step 1: Check Cloud User Attributes via Teams PowerShell

# Connect to Microsoft Teams PowerShell Module
Connect-MicrosoftTeams

# Inspect the target user's hybrid line URI state
$User = Get-CsOnlineUser -Identity "user@yourdomain.com"
[PSCustomObject]@{
    UserPrincipalName         = $User.UserPrincipalName
    LineURI                   = $User.LineURI
    OnPremLineURI             = $User.OnPremLineURI
    OnPremLineURIManuallySet  = $User.OnPremLineURIManuallySet
    EnterpriseVoiceEnabled    = $User.EnterpriseVoiceEnabled
    HostingProvider           = $User.HostingProvider
    VoiceRoutingPolicy        = $User.OnlineVoiceRoutingPolicy
}

If OnPremLineURI contains a value (e.g., tel:+14155551212) or if OnPremLineURIManuallySet is True, you cannot manage their telephone number in the cloud. You must remediate the object on-premises.

Step 2: Check On-Premises Active Directory via ActiveDirectory Module

# Run on an on-premises domain controller or RSAT management workstation
Import-Module ActiveDirectory

# Retrieve all msRTCSIP attributes for the user
Get-ADUser -Identity "user" -Properties * | 
    Select-Object UserPrincipalName, `
                  msRTCSIP-Line, `
                  msRTCSIP-DeploymentLocator, `
                  msRTCSIP-UserEnabled, `
                  msRTCSIP-PrimaryUserAddress, `
                  msRTCSIP-OptionFlags

The 3 Proven Remediation Methods

Depending on whether your on-premises Skype for Business Server environment still exists or has been permanently decommissioned, choose the appropriate remediation procedure below:

Method 1: Safe Native Active Directory PowerShell Cleanup (Decommissioned Pool)

If your Skype for Business or Lync servers no longer exist, you do not need to reinstall them. You can safely clear the legacy attributes directly using the standard Active Directory PowerShell module:

# Clear the locked line URI and deployment locator on an individual user
Set-ADUser -Identity "user" -Clear "msRTCSIP-Line", "msRTCSIP-DeploymentLocator"

# Optional: If the user is fully pure cloud Teams, completely clear all Skype on-prem flags:
Set-ADUser -Identity "user" -Clear "msRTCSIP-Line", `
                                   "msRTCSIP-DeploymentLocator", `
                                   "msRTCSIP-UserEnabled", `
                                   "msRTCSIP-OptionFlags", `
                                   "msRTCSIP-PrimaryUserAddress"

Method 2: Bulk Remediation for Organizational Units (OU-Level)

When migrating an entire department or branch office to pure cloud Teams Direct Routing, execute this batch script to clear all legacy locks simultaneously:

# Retrieve all users in a specific target Organizational Unit
$TargetOU = "OU=Sales,OU=Users,DC=corp,DC=yourdomain,DC=com"
$Users = Get-ADUser -Filter * -SearchBase $TargetOU -Properties msRTCSIP-Line

foreach ($User in $Users) {
    if ($User."msRTCSIP-Line") {
        Write-Host "Clearing stale LineURI for: $($User.UserPrincipalName)" -ForegroundColor Cyan
        Set-ADUser -Identity $User.DistinguishedName -Clear "msRTCSIP-Line", "msRTCSIP-DeploymentLocator"
    }
}

Method 3: Triggering Immediate Entra Connect Delta Synchronization

Once you clear the attributes on-premises, Microsoft Entra Connect must push the update to Microsoft 365 before Teams will permit cloud number assignment. Do not wait for the default 30-minute sync cycle; force an immediate delta synchronization:

# Run on your Microsoft Entra Connect (Azure AD Connect) server:
Start-ADSyncSyncCycle -PolicyType Delta

Within 2 to 5 minutes, inspect the cloud user in Teams PowerShell. OnPremLineURI will return empty ($null), and OnPremLineURIManuallySet will flip to False.

Assigning the Cloud Phone Number in Teams

With the hybrid synchronization lock broken, you can now execute the cloud number assignment cleanly without receiving the “user is synchronized from on-premises” error:

# Assign Direct Routing telephone number
Set-CsPhoneNumberAssignment -Identity "user@yourdomain.com" `
                            -PhoneNumber "+14155551212" `
                            -PhoneNumberType DirectRouting

# Grant enterprise voice routing policy
Grant-CsOnlineVoiceRoutingPolicy -Identity "user@yourdomain.com" `
                                 -PolicyName "US-National-DirectRouting"

# Verify that LineURI and EnterpriseVoiceEnabled are now populated in the cloud
Get-CsOnlineUser -Identity "user@yourdomain.com" | 
    Select-Object UserPrincipalName, LineURI, EnterpriseVoiceEnabled, OnlineVoiceRoutingPolicy

Open-Source Remediation Tool: `Clear-HybridTeamsVoiceAttributes.ps1`

To eliminate manual attribute editing errors and provide safety rollback logging, we open-sourced an automated diagnostic utility in our TeamsVoice-PowerShell-Toolbox GitHub Repository.

The script audits target users, exports pre-change attribute backups to CSV, safely removes msRTCSIP-Line locks, and triggers the Entra Connect delta cycle automatically.

Frequently Asked Questions (FAQ)

---