How to Configure AudioCodes SBC for Microsoft Teams Direct Routing – Step-by-Step Guide

Deploying Microsoft Teams Direct Routing on an AudioCodes Mediant SBC (whether a physical Mediant 500/800/1000/2600/4000 or a virtualized Mediant VE in Azure/AWS) bridges your enterprise PSTN trunks with Microsoft’s cloud phone system. While Microsoft documentation outlines high-level topology, it omits the exact AudioCodes Web GUI parameters, certificate chains, and manipulation rules required to establish end-to-end call routing.

This deployment guide walks through the complete, battle-tested configuration sequence: network interfaces, public TLS certificate generation, SIP definitions, Microsoft 365 tenant provisioning in PowerShell, and first-call validation.

Direct Routing Architecture Overview

Direct Routing requires a clean separation of network boundaries. In standard enterprise topologies, the Mediant SBC acts as a back-to-back user agent (B2BUA) with dual interfaces: WAN (facing Microsoft and optionally the SIP carrier) and LAN (facing internal PBXs or local management).

Phase 1: Tenant & DNS Prerequisites

Before touching the AudioCodes Web GUI, two non-negotiable Microsoft 365 requirements must be completed:

1. Base Domain Registration in Microsoft 365

Microsoft Direct Routing validates the SBC FQDN against verified domains in your tenant. If your SBC hostname is sbc01.voice.contoso.com, the base domain contoso.com (or subdomain voice.contoso.com) must be added and verified in the M365 Admin Center under Settings → Domains.

• Activation Requirement: A verified domain remains dormant in Azure AD until at least one licensed user account is assigned a UPN with that domain suffix (e.g., dummyuser@voice.contoso.com with a basic license). If this is omitted, Microsoft will reject all inbound SBC traffic with a SIP 403 Forbidden (Tenant Not Found) error.

2. Public DNS A-Record

Create an external DNS A Record pointing your SBC FQDN (e.g., sbc01.contoso.com) to the SBC’s static public WAN IP address. Direct Routing does not support dynamic IPs or CNAMEs for gateway discovery.

Phase 2: TLS Context & Certificate Installation

Mutual TLS (mTLS) over port 5061 is mandatory. Microsoft will immediately terminate any connection that presents an untrusted, mismatched, or expired certificate.

1. Generate the Certificate Signing Request (CSR)

In the AudioCodes Web GUI:

1. Navigate to Setup → IP Network → Security → TLS Contexts.
2. Select TLS Context 0 (or click +New to create a dedicated Teams TLS context).
3. Scroll down to the Certificate Information pane and click Change Random Number.
4. Fill in your CSR details:
   • Common Name (CN): sbc01.contoso.com
   • Subject Alternative Name (SAN): DNS:sbc01.contoso.com (Mandatory: Microsoft strictly checks the SAN extension).
   • Key Size: 2048 bit (RSA).
5. Click Generate Private Key, then click Generate CSR. Copy the Base64 output.

2. Submit to a Microsoft-Approved Public CA

Direct Routing does not support self-signed certificates or private corporate PKIs. Submit your CSR to an approved public CA: DigiCert, Sectigo, GlobalSign, Entrust, or GoDaddy.

3. Install Root CAs and Device Certificate

Once issued, upload the files to AudioCodes:

1. Under the same TLS Context, click Trusted Root Certificate File and upload the combined Root and Intermediate bundle (including the Microsoft Baltimore CyberTrust Root / DigiCert Global Root G2 chains).
2. Under Device Certificate, click Send File and upload your public .cer or .pem certificate.
3. Click Save & Reset if prompted.
4. Troubleshooting Reference: If the SBC displays inactive after renewal, review our guide on Teams SBC Inactive After Certificate Renewal (OPTIONS Fix).

Phase 3: AudioCodes Core SIP Configuration

1. SIP Interface Definition

Navigate to Signaling & Media → SIP Definitions → SIP Interfaces. Click +New to create the Teams interface:

2. Proxy Set Configuration (Microsoft Regional Clusters)

Navigate to Signaling & Media → SIP Definitions → Proxy Sets. Click +New:

• Proxy Set ID: 1 (Name: ProxySet_Teams)
• SBC Contact Header: Select Use FQDN. (Crucial: If left on “Use IP Address”, Microsoft rejects all calls with 403 Forbidden).
• Keep-Alive Method: OPTIONS
• Keep-Alive Time: 60 seconds

Click on the newly created Proxy Set row, click Proxy Address at the top, and add the three Microsoft regional endpoints:

sip.pstnhub.microsoft.com:5061;transport=tls
sip2.pstnhub.microsoft.com:5061;transport=tls
sip3.pstnhub.microsoft.com:5061;transport=tls

3. Media Realm & Security (SRTP)

Navigate to Signaling & Media → Media → Media Realms. Click +New:

• Name: MR_Teams
• IPv4 Interface Name: WAN
• Port Range: 6000 – 6999 (or your assigned AudioCodes RTP pool)

Navigate to Signaling & Media → Media → Media Security:

• Set Media Security to Enable.
• Set Security Mode to SRTP.
• Ensure cipher suite AES_CM_128_HMAC_SHA1_80 is active.

4. IP Groups

Navigate to Signaling & Media → Server Groups → IP Groups. You need two distinct groups:

1. Teams IP Group:
   • Type: Server
   • Proxy Set: ProxySet_Teams
   • SIP Interface: SIP_Teams
   • Media Realm: MR_Teams
   • Class: SBC
2. Carrier IP Group:
   • Configured pointing to your PSTN carrier’s Proxy Set / SIP trunk.

5. IP-to-IP Routing (Inbound & Outbound)

Navigate to Signaling & Media → SBC → Routing → IP-to-IP Routing. Add the two core call legs:

Phase 4: Microsoft Teams Tenant Provisioning

Connect to Microsoft Teams using the official PowerShell module:

# 1. Authenticate to your Microsoft 365 Tenant
Connect-MicrosoftTeams

# 2. Register the AudioCodes Mediant SBC Gateway
New-CsOnlinePSTNGateway `
  -Identity "sbc01.contoso.com" `
  -SipSignalingPort 5061 `
  -SendSipOptions $true `
  -MaxConcurrentSessions 100 `
  -Enabled $true

# 3. Create a PSTN Usage record
Set-CsOnlinePstnUsage -Identity Global -Usage @{Add="US-National"}

# 4. Create an Online Voice Route pointing to the AudioCodes SBC
New-CsOnlineVoiceRoute `
  -Identity "VR-All-National" `
  -NumberPattern "^\+1(\d{10})$" `
  -OnlinePstnGatewayList "sbc01.contoso.com" `
  -Priority 1 `
  -OnlinePstnUsages "US-National"

# 5. Create and assign the Voice Routing Policy
New-CsOnlineVoiceRoutingPolicy -Identity "VRP-DirectRouting" -OnlinePstnUsages "US-National"
Grant-CsOnlineVoiceRoutingPolicy -Identity "engineer@contoso.com" -PolicyName "VRP-DirectRouting"

# 6. Assign Phone Number & Enable Enterprise Voice for User
Set-CsPhoneNumberAssignment `
  -Identity "engineer@contoso.com" `
  -PhoneNumber "+14155550199" `
  -PhoneNumberType DirectRouting

Set-CsPhoneNumberAssignment `
  -Identity "engineer@contoso.com" `
  -EnterpriseVoiceEnabled $true

Phase 5: Validating Gateway Health & Placing the First Call

1. Verify SIP OPTIONS Heartbeat

Wait 5–10 minutes after running New-CsOnlinePSTNGateway, then check the gateway health in PowerShell:

Get-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" | Select-Object Identity, InService, Enabled

If InService returns True, Microsoft has completed a mutual TLS handshake with your Mediant SBC and validated the OPTIONS exchange. If it returns False, inspect our Teams Direct Routing SIP 503 Troubleshooting Guide.

2. The First Test Call: Syslog Capture

Open the AudioCodes Syslog Viewer (or Embedded Syslog under Status & Diagnostics → Message Log) and filter for SIP and GW.

Place an outbound test call from your Teams client to a mobile number:

1. Leg 1 (Teams → SBC): Look for an incoming INVITE from sip.pstnhub.microsoft.com:5061. The SBC should return 100 Trying.
2. Leg 2 (SBC → Carrier): The SBC looks up the IP-to-IP Routing table, translates the number according to your outbound manipulation rules, and forwards the INVITE to the carrier.
3. Ringing & 200 OK: The carrier returns 180 Ringing followed by 200 OK. The SBC establishes the SRTP crypto stream with Teams, and audio flows.

The 4 Most Common First-Call Failures

Frequently Asked Questions (FAQ)

Related Microsoft Teams Direct Routing & SBC Guides

• AudioCodes vs Ribbon vs anynode: Best SBC for Teams Direct Routing
• Teams Direct Routing SIP 503 Service Unavailable: Troubleshooting SBC & Trunk Outages
• Teams Direct Routing SIP 403 Forbidden: Packet Traces, FQDN Gotchas & Carrier Fixes
• Teams Direct Routing 488 Not Acceptable Here: SDP, Codecs, SRTP
• Teams Direct Routing Inactive After Certificate Renew (OPTIONS Fix)
• Media Bypass vs Local Media Optimization: When Teams Skips the SBC