How to Configure Teams Call Redirect Policies in PowerShell Using Set-CsTeamsCallingPolicy

In Microsoft Teams Phone deployments, managing incoming voice traffic requires balancing employee flexibility with corporate compliance, security, and toll-fraud prevention. While call forwarding and redirection enable mobile workforces to deflect incoming enterprise calls to mobile devices or delegate lines, unrestricted call redirection poses financial and security risks — such as routing corporate calls to international numbers or bypassing internal compliance recording systems.

Microsoft Teams administrators manage these inbound voice controls through Calling Policies. Using the Microsoft Teams PowerShell module and the Set-CsTeamsCallingPolicy cmdlet, administrators can granularly enable, restrict, or disable call redirect capabilities across entire tenants or specific user groups.

Understanding Call Redirection Controls in Teams Calling Policies

Within Microsoft Teams enterprise voice architecture, call redirection encompasses several routing behaviours:

• Call Deflection / Forwarding: Rerouting an incoming call immediately to another internal user, an external PSTN phone number, or an auto attendant.
• Simultaneous Ringing: Ringing both the user’s primary Teams client and an external secondary device (such as a mobile telephone) concurrently.
• Call Transfer / Deflect Routing: Forwarding an active or incoming call to an unassigned or external number.

The key policy parameter governing these actions is AllowCallRedirect. When set to $true, users assigned to the policy can configure call forwarding and simultaneous ringing to external PSTN numbers in their Teams client settings. When set to $false, the Teams client hides or disables external forwarding options, restricting incoming call destinations strictly to voicemail or internal tenant colleagues.

Connecting to Microsoft Teams PowerShell

To inspect and modify calling policies, open an elevated PowerShell window and sign in to the Microsoft Teams management module using administrator credentials:

# Install module if not previously installed
Install-Module -Name MicrosoftTeams -Force -AllowClobber

# Connect to the tenant
Connect-MicrosoftTeams

Verify your connection and review existing calling policies defined in the organization:

Get-CsTeamsCallingPolicy | Select-Object Identity, Description, AllowCallRedirect, AllowPrivateCalling, AllowVoicemail | Format-Table -AutoSize

Inspecting Active Call Redirect Settings

To inspect the Global (org-wide default) calling policy, execute the following command:

Get-CsTeamsCallingPolicy -Identity Global | Select-Object Identity, AllowCallRedirect, AllowCallForwardingToUser, AllowCallForwardingToPhone

A standard policy inspection returns key boolean attributes:

Identity                    : Global
AllowCallRedirect           : Enabled
AllowCallForwardingToUser   : True
AllowCallForwardingToPhone  : True

Note that in recent Microsoft Teams PowerShell module versions, AllowCallRedirect can take explicit string state values (Enabled or Disabled) or boolean flags depending on the tenant build version, alongside companion parameters AllowCallForwardingToPhone and AllowCallForwardingToUser.

Creating a Custom Calling Policy with Call Redirect Restrictions

Rather than modifying the Global policy for all corporate users, the recommended enterprise practice is to create custom calling policies for high-security environments, frontline workers, or compliant contact centre agents.

To create a new calling policy that blocks external call redirection while permitting basic internal calls, execute:

New-CsTeamsCallingPolicy -Identity "Restricted-CallRedirect-Policy" -Description "Blocks external call forwarding and deflection" -AllowCallRedirect "Disabled" -AllowCallForwardingToPhone $false -AllowCallForwardingToUser $true

If your tenant uses boolean values for AllowCallRedirect, pass $false:

Set-CsTeamsCallingPolicy -Identity "Restricted-CallRedirect-Policy" -AllowCallRedirect $false -AllowCallForwardingToPhone $false

Modifying Existing Calling Policies with Set-CsTeamsCallingPolicy

To update an existing custom calling policy or lock down the Global tenant policy, use Set-CsTeamsCallingPolicy.

To disable external call redirection globally across the entire tenant:

Set-CsTeamsCallingPolicy -Identity Global -AllowCallRedirect "Disabled" -AllowCallForwardingToPhone $false

Conversely, to re-enable call redirection for mobile sales teams or executive groups:

Set-CsTeamsCallingPolicy -Identity "Executive-Calling-Policy" -AllowCallRedirect "Enabled" -AllowCallForwardingToPhone $true -AllowCallForwardingToUser $true

Verify that your changes have been recorded in the Teams Admin Center repository:

Get-CsTeamsCallingPolicy -Identity "Restricted-CallRedirect-Policy" | Format-List Identity, AllowCallRedirect, AllowCallForwardingToPhone, AllowCallForwardingToUser

Assigning the Policy to Target Users and Security Groups

Once created, the policy must be assigned to users to take effect.

Assigning to an Individual User

Assign the restricted calling policy to a specific employee using Grant-CsTeamsCallingPolicy:

Grant-CsTeamsCallingPolicy -Identity "[email protected]" -PolicyName "Restricted-CallRedirect-Policy"

Verify user policy assignment:

Get-CsUserPolicyAssignment -Identity "[email protected]" -PolicyType TeamsCallingPolicy

Batch Assigning to a Department or Security Group

For large organizations, assign the policy to an entire Entra ID (Azure AD) security group using group policy assignment:

# Retrieve Entra ID Group ObjectId
$GroupId = (Get-AzureADGroup -SearchString "Frontline Support Agents").ObjectId

# Assign Teams Calling Policy with evaluation priority ranking
New-CsGroupPolicyAssignment -GroupId $GroupId -PolicyType TeamsCallingPolicy -PolicyName "Restricted-CallRedirect-Policy" -Rank 1

Validating Client Behaviour and PSTN Firewall Rules

After granting the policy, allow up to 4 to 8 hours for Microsoft 365 policy distribution caches to replicate to client endpoints. Validate policy enforcement by opening the Teams client on desktop or mobile for a test user:

1. In Teams, navigate to Settings > Calls.
2. Under the Call handling and forwarding section, verify that the option to forward calls to an external phone number or mobile line is greyed out or completely removed.
3. Confirm that calls can still be redirected to Voicemail or internal team members as designated by the policy flags.

To ensure total compliance, verify that Session Border Controllers (SBC) and Direct Routing translation rules reject unapproved 302 Deflect SIP responses originating from non-authorized endpoints.