In short
Teams Direct Routing requirements are a Microsoft-certified Session Border Controller with carrier trunks, a name for it in a verified Microsoft 365 domain, a public trusted certificate, firewall rules for Microsoft's signalling and media ports, and Microsoft Teams and Teams Phone licences for each user. Forever Systems can quote Direct Routing as a service, with the SBC, trunks and certificate handled for you.
Want help with Microsoft Teams Direct Routing?
We can plan it with you or do it for you. Tell us where you are up to.
Direct Routing requirements at a glance
Microsoft's planning guide (opens in a new tab) lists the infrastructure Direct Routing needs:
| Requirement | What Microsoft asks for |
|---|---|
| Session Border Controller (SBC) | A Microsoft-certified SBC |
| Telephony trunks | One or more trunks from the SBC to a carrier |
| Microsoft 365 organisation | The tenant that hosts the Teams users, with users homed online |
| Domain | One or more verified Microsoft 365 domains. The onmicrosoft.com domain cannot be used |
| SBC name and DNS | A fully qualified domain name registered in the tenant, with a public DNS entry |
| Public IP address | An address that Microsoft Teams can reach |
| Public certificate | A trusted certificate for secure TLS communication |
| Firewall | The Microsoft Teams signalling and media ports |
Want Direct Routing run for you? Ask us
Tell us your users and numbers and we will set out how our service would work for your organisation, with a quote.
Licence requirements
Microsoft states that Direct Routing users require two licences: Microsoft Teams and Teams Phone. No Microsoft Calling Plan is involved, because the calls are carried by your own carrier. Microsoft Teams Phone Standard covers the licence.
Three related points from Microsoft's guidance:
- Auto attendants and call queues. Each needs a resource account with a Teams Phone Resource Account licence. With Direct Routing numbers, a resource account that makes outbound calls also needs an online voice routing policy
- Audio Conferencing. Dial-in numbers for scheduled meetings come from Microsoft Audio Conferencing. If a user has no Audio Conferencing licence, outbound conference calls route through Direct Routing
- Teams mode. Direct Routing is not supported in Islands mode
Certificate requirements
The SBC proves its identity with a certificate. Microsoft recommends generating the certificate signing request on the SBC itself, and says the certificate should:
- Carry the SBC's fully qualified domain name as its common name or subject alternative name
- Be signed by a certificate authority in the Microsoft Trusted Root Program
- Include the Server Authentication extended key usage
Wildcard certificates are supported where they meet the standard Microsoft cites. The domain in the name must already be verified in Microsoft 365: a new subdomain has to be registered there before the SBC can be paired.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Signalling: connection points and firewall ports
The SBC connects to three Microsoft connection points, used in priority order:
| Priority | Connection point | Purpose |
|---|---|---|
| Primary | sip.pstnhub.microsoft.com | Global connection point |
| Secondary | sip2.pstnhub.microsoft.com | Regional failover |
| Tertiary | sip3.pstnhub.microsoft.com | Regional failover |
Signalling is SIP over TLS. From the SBC to Microsoft the destination port is 5061; in the other direction it is the port configured on the SBC. Microsoft lists the IP ranges 52.112.0.0/14 and 52.120.0.0/14 for these connection points, and tells administrators to allow signalling to and from all of its Teams IP ranges, not only the addresses a DNS query returns. If the primary region is unavailable, Microsoft redirects traffic to the secondary and then the tertiary region without administrator action.
Media: ports, codecs and media bypass
Call audio uses these settings between Microsoft's media processors and the SBC:
| Item | Microsoft's requirement |
|---|---|
| Transport | UDP with SRTP encryption |
| Ports | 3478 to 3481 and 49152 to 53247, in both directions |
| Port allocation | At least two media ports for each concurrent call on the SBC, as Microsoft recommends |
| Codecs | SILK, G.711, G.722 and G.729, plus AMR-WB when media bypass is not used |
Media bypass keeps the audio between the user's Teams client and the SBC. Microsoft recommends it where users are in the same building or network as the SBC. It needs the Teams client to reach the SBC's public IP address, and signalling still flows through the Microsoft cloud. Microsoft keeps its port and address lists current on Microsoft Learn, so check them before changing a firewall.
The Direct Routing call flow
Microsoft's own planning sequence is: review the infrastructure, networking and licensing requirements; select a certified SBC; configure DNS, certificates, firewall rules and connectivity; connect the SBC to Teams; configure voice routing; assign licences and voice routing policies; then validate calling before wider rollout.
What a Direct Routing service takes on
| Requirement | Your own deployment | Direct Routing as a service |
|---|---|---|
| Certified SBC and firmware | You or your integrator | The provider |
| Carrier trunks and numbers | You contract with a carrier | Supplied with the service, with numbers ported |
| Certificate, DNS and firewall | You or your integrator | The provider |
| Teams and Teams Phone licences | Held in your tenant | Held in your tenant; we can supply Teams Phone |
| Users, auto attendants and call queues | Set up in your tenant | Set up in your tenant, by us if you wish |
Our Teams calling service is Direct Routing delivered this way. Contact us to talk through your requirements.
Sources (checked 11 November 2026): Microsoft Learn, "Plan Direct Routing", "Plan for media bypass with Direct Routing" and "Reference - Voice applications prerequisites and licensing".
How Forever Systems helps with Teams Phone
Forever Systems can quote and set up Microsoft Teams Phone for your organisation and connect it to the phone network.
- Licence and calling check: we look at the Microsoft 365 plan you hold and recommend the Teams Phone licences and calling option that fit
- Numbers kept: we plan and manage the porting of your existing numbers
- Call flows set up: auto attendants, call queues and opening hours built and tested with you
- Works with what you use: the Teams apps on desktop and mobile
- Licensing in one place: licences can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, licences and calling, so ask us for a quote.
Frequently asked questions
What are the licence requirements for Teams Direct Routing?
Microsoft requires each Direct Routing user to hold Microsoft Teams and Teams Phone licences. A Microsoft Calling Plan is not required.
What certificate does Direct Routing need?
The SBC needs a public trusted certificate that carries its fully qualified domain name, is signed by a certificate authority in the Microsoft Trusted Root Program and includes the Server Authentication extended key usage.
Which firewall ports does Teams Direct Routing use?
Signalling uses SIP over TLS on port 5061 from the SBC to Microsoft. Media uses UDP ports 3478 to 3481 and 49152 to 53247 between Microsoft's media processors and the SBC. Microsoft publishes the current ports and IP ranges on Microsoft Learn.
What is media bypass in Teams Direct Routing?
Media bypass keeps call audio directly between the Teams client and the SBC, shortening the path. Signalling still passes through the Microsoft cloud, and the client must be able to reach the SBC's public IP address.
Do auto attendants and call queues work with Direct Routing?
Yes. Each needs a resource account with a Teams Phone Resource Account licence. With Direct Routing numbers, a resource account that makes outbound calls also needs an online voice routing policy.
Still have a question about Microsoft Teams Direct Routing?
Ask us and a member of our team will get back to you.