Media Bypass vs Local Media Optimization: When Teams Skips the SBC

In Microsoft Teams Direct Routing, SIP signaling always routes through Microsoft’s cloud infrastructure (sip.pstnhub.microsoft.com). However, routing the actual voice audio—the Real-time Transport Protocol (RTP/SRTP) media stream—through the cloud is often inefficient, introduces latency, and consumes unnecessary internet bandwidth.

To eliminate audio trombone effects (where two employees in the same building have their audio routed through a distant cloud datacenter), Microsoft provides two media optimization architectures: Media Bypass and Local Media Optimization (LMO).

This technical guide details the packet paths, firewall port requirements, Session Border Controller (SBC) ICE Lite parameters, and PowerShell network topology scripts required to deploy both models in enterprise environments.

The 3 Media Routing Topologies Compared

Deep Dive 1: Standard Media Bypass

In standard Media Bypass, the Teams client negotiates media directly with the SBC’s public IP address using Interactive Connectivity Establishment (ICE Lite).

How the Media Bypass Handshake Works:

1. The Teams client initiates a call. SIP signaling goes over TLS to sip.pstnhub.microsoft.com.
2. Microsoft sends an INVITE with an SDP offer containing ICE candidates to the SBC.
3. The SBC (acting in ICE Lite mode) responds with its own media candidates (its public IP and port range).
4. The Teams client and SBC execute STUN binding checks directly over UDP.
5. Once verified, SRTP audio flows point-to-point between the client and SBC. Microsoft cloud media processors are completely removed from the audio path.

Deep Dive 2: Local Media Optimization (LMO)

While Media Bypass works well when the SBC has a direct public IP, it fails in distributed corporate branch offices where:

• Branch offices have local PSTN gateways or telco lines without public IP addresses.
• Corporate security policies prohibit internal client workstations from establishing direct peer-to-peer UDP connections to public internet endpoints.
• Organizations want local branch calls to remain on the private MPLS/SD-WAN network rather than consuming local internet breakout bandwidth.

The LMO Architecture: Central vs. Downstream SBC

LMO introduces two SBC functional roles:

• Central SBC: Has a public IP, valid public TLS certificate, and registered FQDN in Microsoft 365. It handles all mutual TLS (mTLS) SIP signaling with Microsoft Direct Routing.
• Downstream (Proxy) SBC: Located at a remote branch office behind internal firewalls. It connects to the Central SBC via an internal SIP trunk and interfaces with local branch PSTN lines. It does not require a public IP or a Microsoft-trusted public certificate.

How LMO Routes Media Dynamically:

Microsoft Teams evaluates the client’s current network location based on Network Sites, Subnets, and Trusted Public IPs defined in the Teams Admin Center:

• Internal Branch User: Teams detects that the client is on an internal corporate subnet assigned to the branch site. Audio media flows directly across the internal LAN to the local downstream SBC’s private IP (e.g., 10.50.1.10).
• External / Remote User: The same user works from home on external Wi-Fi. Teams detects that the user is not on a trusted corporate subnet. The signaling goes via the Central SBC, and media flows to the Central SBC’s public interface via standard Media Bypass or a cloud transport relay.

Firewall & Port Matrix: Bypass vs. LMO

Misconfigured firewalls are responsible for 90% of one-way audio and call drop issues during bypass deployments. Ensure your security team opens the following port paths:

Configuring Local Media Optimization in PowerShell

To configure LMO, you must define your corporate network topology in Microsoft Teams PowerShell so Teams knows when a user is sitting inside a physical branch office:

# 1. Connect to Microsoft Teams
Connect-MicrosoftTeams

# 2. Define Network Region
New-CsTenantNetworkRegion -NetworkRegionID "Region-US"

# 3. Define Trusted IP (Corporate Egress Public IP)
New-CsTenantTrustedIPAddress -IPAddress "198.51.100.50" -MaskBits 32 -Description "HQ-Egress"

# 4. Define Network Sites (Central & Branch)
New-CsTenantNetworkSite -NetworkSiteID "Site-HQ" -NetworkRegionID "Region-US"
New-CsTenantNetworkSite -NetworkSiteID "Site-BranchChicago" -NetworkRegionID "Region-US"

# 5. Map Internal Corporate Subnets to Sites
New-CsTenantNetworkSubnet -SubnetID "10.10.0.0" -MaskBits 16 -NetworkSiteID "Site-HQ"
New-CsTenantNetworkSubnet -SubnetID "10.50.0.0" -MaskBits 16 -NetworkSiteID "Site-BranchChicago"

# 6. Configure Gateway for Local Media Optimization
Set-CsOnlinePSTNGateway -Identity "sbc-central.contoso.com" `
  -MediaBypass $true `
  -AlwaysBypass $false `
  -NetworkSiteID "Site-HQ"

# 7. Register Branch Proxy SBC (Internal Gateway)
Set-CsOnlinePSTNGateway -Identity "sbc-branch.contoso.local" `
  -MediaBypass $true `
  -AlwaysBypass $false `
  -NetworkSiteID "Site-BranchChicago" `
  -ProxySbc "sbc-central.contoso.com"

Parameter Analysis:
Setting -AlwaysBypass $false tells Teams to execute network location checks dynamically. If a user is on an internal subnet mapped to Site-BranchChicago, media routes locally. If the user works remotely, media automatically falls back to the Central SBC’s public interface.

AudioCodes & Ribbon SBC Configuration Flags

AudioCodes Mediant Configuration:

• Navigate to Signaling & Media → Media → Media Realm. Select your Teams realm and set ICE Mode to Lite.
• In your SIP Interface, set Media IP Interface to your WAN interface for standard Media Bypass, or configure dual media realms (Internal vs. External) for LMO.
• Review our complete step-by-step setup guide on AudioCodes Mediant SBC Configuration for Teams Direct Routing.

Ribbon SBC Core / Edge (1000/2000/SWe):

• Navigate to Media → Media Profiles. Enable ICE Lite on the profile assigned to the Teams media list.
• Under SIP Profiles, ensure Support ICE is set to Enabled.
• In multi-site deployments, configure Signaling Groups with designated internal translation tables to route between central and remote branches.

Architecture Decision Matrix: Which Model Should You Use?

Frequently Asked Questions (FAQ)

Related Microsoft Teams Direct Routing & Architecture Guides

• AudioCodes Mediant SBC Configuration for Teams Direct Routing: Tenant to First Call
• Teams Direct Routing vs Operator Connect vs Teams Phone Mobile: 2026 Architecture Guide
• Teams Direct Routing SIP 503 Service Unavailable: Troubleshooting SBC & Trunk Outages
• Teams Direct Routing SIP 403 Forbidden: Packet Traces, FQDN Gotchas & Carrier Fixes
• Teams Direct Routing 488 Not Acceptable Here: SDP, Codecs, SRTP
• Teams Direct Routing Inactive After Certificate Renew (OPTIONS Fix)
• AudioCodes vs Ribbon vs anynode: Best SBC for Teams Direct Routing