How to Configure Teams Direct Routing SBC Gateways in PowerShell Using CsOnlinePSTNGateway

In Microsoft Teams Phone System architectures utilising Direct Routing, on-premises or cloud-hosted Session Border Controllers (SBCs) act as the physical or virtual bridge between Microsoft’s cloud infrastructure and telecommunications carrier networks. To establish SIP signaling trunks, enforce TLS certificate verification, regulate media paths, and manage concurrent call session capacities, tenant administrators configure SBC gateways within Microsoft 365. In the Microsoft Teams PowerShell administration module, SBC gateways are configured and maintained using the *-CsOnlinePSTNGateway cmdlets.

Understanding Direct Routing SBC Gateway Parameters

When connecting a certified Session Border Controller (such as AudioCodes, Ribbon, Oracle, or Cisco) to Microsoft Teams Direct Routing, the cloud proxy validates several mandatory technical properties:

• FQDN (Fully Qualified Domain Name): The SBC must possess a public FQDN matching a domain validated within your Microsoft 365 tenant (e.g., sbc01.contoso.com).
• SIP Signaling Port: The listening TLS port configured on the SBC for SIP traffic (typically TCP/TLS port 5061, or non-standard ports when sharing IP interfaces).
• Media Bypass: Controls whether voice Real-Time Transport Protocol (RTP) packets flow directly between Teams desktop/mobile clients and the SBC, bypassing Microsoft cloud media processors to minimize latency.
• SIP OPTIONS Ping: Periodic SIP OPTIONS keepalive messages exchanged between Microsoft Teams infrastructure and the SBC to continuously assess gateway reachability and operational health.
• P-Asserted-Identity (PAI) and PIDLO: Governs whether caller identity headers and location information are forwarded downstream to emergency responders and carrier endpoints.
• Concurrent Session Throttling: Enforces upper limits on simultaneous voice channels to prevent gateway saturation.

Connecting to Microsoft Teams PowerShell

To configure Direct Routing gateways, administrators require Teams Administrator or Global Administrator privileges. Connect using the Microsoft Teams PowerShell module:

# Install Microsoft Teams module if required
Install-Module -Name MicrosoftTeams -Force -AllowClobber

# Connect to tenant
Connect-MicrosoftTeams

Inspecting Established SBC Gateways

To retrieve all SBC gateways registered in your tenant:

Get-CsOnlinePSTNGateway

To inspect comprehensive configuration parameters for a specific gateway:

Get-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" | Format-List Identity, SipSignalingPort, Enabled, MediaBypass, SipOptionsEnabled, MaxConcurrentSessions, ForwardPai

A typical active configuration output displays:

Identity               : sbc01.contoso.com
SipSignalingPort       : 5061
Enabled                : True
MediaBypass            : True
SipOptionsEnabled      : True
MaxConcurrentSessions  : 150
ForwardPai             : True
FailoverResponseCodes  : {408, 503, 504}

Registering a New SBC Gateway with New-CsOnlinePSTNGateway

To register a new Session Border Controller in your Microsoft 365 tenant, use the New-CsOnlinePSTNGateway cmdlet.

Example 1: Registering a Standard Direct Routing Gateway

The following command registers a new gateway with Media Bypass enabled, SIP OPTIONS monitoring active, and a maximum threshold of 100 concurrent voice sessions:

New-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" `
  -SipSignalingPort 5061 `
  -Enabled $true `
  -MediaBypass $true `
  -SipOptionsEnabled $true `
  -MaxConcurrentSessions 100 `
  -ForwardPai $true

Example 2: Registering a Secondary Gateway on an Alternative Port

When multiple SBC logical interfaces share a single public IP address or utilize distinct certificate bindings, specify custom signaling ports:

New-CsOnlinePSTNGateway -Identity "sbc02.contoso.com" `
  -SipSignalingPort 5062 `
  -Enabled $true `
  -MediaBypass $false `
  -SipOptionsEnabled $true `
  -MaxConcurrentSessions 50

Modifying SBC Gateway Properties with Set-CsOnlinePSTNGateway

Administrators frequently need to update gateway properties to optimize performance, adjust session limits, or modify SIP header forwarding rules.

Enabling or Disabling Media Bypass

Media Bypass optimizes call quality by eliminating the Microsoft media relay hop for internal network clients. However, it requires that internal clients can reach the SBC’s media IP addresses directly:

# Enable Media Bypass
Set-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" -MediaBypass $true

# Disable Media Bypass (force routing through Microsoft Cloud Media Relays)
Set-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" -MediaBypass $false

Adjusting Failover Response Codes and Session Caps

If an SBC experiences traffic congestion or returns specific SIP failure codes, Teams can immediately fail over calls to secondary SBCs defined in voice routes:

Set-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" `
  -MaxConcurrentSessions 250 `
  -FailoverResponseCodes @{Add="500"} `
  -FailoverTimeSeconds 10

Placing an SBC into Maintenance Mode

During SBC firmware updates, certificate renewals, or hardware maintenance, administrators can gracefully stop Microsoft Teams from sending new outbound calls to the SBC without deleting the gateway configuration:

# Disable gateway to prevent new call signaling
Set-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" -Enabled $false

# Re-enable gateway after maintenance concludes
Set-CsOnlinePSTNGateway -Identity "sbc01.contoso.com" -Enabled $true

Removing an Obsolete SBC Gateway

Before decommissioning a gateway, ensure that it is no longer referenced in any active online voice routes (Get-CsOnlineVoiceRoute). Once cleared, remove the gateway using Remove-CsOnlinePSTNGateway:

Remove-CsOnlinePSTNGateway -Identity "sbc02.contoso.com" -Confirm:$false

By leveraging PowerShell’s CsOnlinePSTNGateway cmdlets, voice engineers maintain resilient, highly available Direct Routing interconnects, fine-tuning SIP signaling, media paths, and failover mechanics across enterprise telephony environments.