How to Configure Teams SIP Gateway Device Policies in PowerShell Using CsTeamsSipDevicesConfiguration

As enterprises migrate legacy PBX systems to Microsoft Teams Phone, replacing thousands of existing physical desk phones represents a massive capital expenditure. To protect hardware investments, Microsoft provides the Teams SIP Gateway. SIP Gateway enables certified third-party Session Initiation Protocol (SIP) hardware—including Cisco IP phones, Polycom VVX models, Yealink T-series devices, and AudioCodes hardware—to connect directly to Microsoft Teams Phone without requiring on-premises third-party session border controllers (SBCs).

Governing how SIP devices authenticate, retrieve provisioning profiles, enforce corporate user policies, and handle emergency calling across enterprise branches requires dedicated administrative configuration. In the Microsoft Teams PowerShell module, administrators manage these parameters using the CsTeamsSipDevicesConfiguration cmdlet family. This guide explains how Teams SIP Gateway architecture operates and details how to query, configure, and enforce SIP device policies across your Microsoft 365 tenant using PowerShell.

Architecture of Microsoft Teams SIP Gateway

The Teams SIP Gateway acts as a cloud-hosted SIP proxy and registrar that bridges standard SIP RFC signalling with Microsoft Teams internal microservices and Azure Communication Services. Key components include:

• Device Provisioning Server (DPS): When a compatible SIP phone boots, it contacts Microsoft’s regional DPS server URL (e.g. http://emea.ippphone.teams.microsoft.com or http://noam.ipphone.teams.microsoft.com) via HTTP/HTTPS to fetch firmware configuration files and root TLS certificates.
• Mutual TLS (mTLS) Authentication: Physical SIP devices authenticate with the gateway using unique client certificates or device hardware credentials, encrypting all SIP signalling over TLS 1.2.
• SRTP Audio Encryption: Voice streams between the SIP phone and Teams media relays are encrypted using Secure Real-time Transport Protocol (SRTP).
• CsTeamsSipDevicesConfiguration: The administrative policy object that dictates tenant-wide parameters such as whether SIP devices can be registered, maximum device counts, sign-in capabilities, and regional gateway endpoints.

By defining policies via PowerShell, administrators ensure that only authorised hardware mac addresses and vetted user tiers can onboard third-party SIP hardware into the corporate phone directory.

Prerequisites and PowerShell Module Connection

Configuring SIP Gateway policies requires version 4.9.0 or later of the Microsoft Teams PowerShell module and an administrative account assigned the Teams Administrator or Global Administrator role in Microsoft Entra ID.

Open an elevated PowerShell session and verify your module installation:

Get-Module -ListAvailable -Name MicrosoftTeams

Connect to your Microsoft Teams tenant:

Connect-MicrosoftTeams

Once authenticated, confirm your tenant connection status:

Get-CsTenant | Select-Object DisplayName, TenantId

Inspecting Current SIP Devices Configuration

To inspect your tenant’s current SIP Gateway policy settings, run Get-CsTeamsSipDevicesConfiguration:

Get-CsTeamsSipDevicesConfiguration

PowerShell outputs the active tenant configuration:

Identity                 : Global
BulkSignOnEnabled        : False
AllowCommonAreaPhone     : True
EmergencyCallingEnabled  : True
ProvisioningServerUrl    : https://noam.ipphone.teams.microsoft.com
DeviceManagementEnabled  : True

Reviewing these attributes confirms critical governance baselines:

• BulkSignOnEnabled: Indicates whether administrators can onboard multiple SIP devices simultaneously using hardware MAC addresses without requiring physical user interaction at the phone keypad.
• AllowCommonAreaPhone: Dictates whether SIP devices can be provisioned with Shared Device / Common Area Phone licenses (e.g. for lobby, hallway, or factory floor phones).
• EmergencyCallingEnabled: Controls whether SIP Gateway endpoints can place outbound E911 / emergency services calls with location-based routing.

Configuring SIP Gateway Capabilities via PowerShell

To adjust how third-party hardware interacts with your Microsoft Teams tenant, use Set-CsTeamsSipDevicesConfiguration.

Enabling Bulk Sign-On for Mass Hardware Deployment

When migrating an office floor with hundreds of existing Cisco or Polycom phones, individually signing in on each physical keypad via web sign-in codes is inefficient. Enable Bulk Sign-On to authorize batch provisioning:

Set-CsTeamsSipDevicesConfiguration -Identity "Global" -BulkSignOnEnabled $true

Once enabled, administrators can upload a CSV file containing device MAC addresses and assigned user accounts directly through the Microsoft Teams admin center or PowerShell to provision hundreds of desk phones in a single batch.

Enforcing Common Area and Emergency Calling Configurations

To ensure shared hardware in public hallways, security gates, and conference rooms functions reliably with emergency dispatch integration:

Set-CsTeamsSipDevicesConfiguration -Identity "Global" `
    -AllowCommonAreaPhone $true `
    -EmergencyCallingEnabled $true

This ensures that shared physical endpoints retain emergency dispatch capabilities even when no individual employee is actively signed in to the device.

Verifying User Licensing and Device Prerequisites

Before an end-user or common area room can sign into a SIP Gateway device, the corresponding Entra ID account must have appropriate Microsoft 365 licensing assigned:

• Standard User: Requires a Microsoft 365 license (E3, E5, or Business Standard) plus a Teams Phone Standard add-on license.
• Shared Device: Requires a Microsoft Teams Shared Devices license.
• Direct Inward Dialling (DID): The account must have a telephone number assigned via Direct Routing, Operator Connect, or Microsoft Calling Plans.

To verify an account’s telephony status via PowerShell before registering a SIP device, run:

Get-CsOnlineUser -Identity "[email protected]" | Select-Object DisplayName, LineURI, EnterpriseVoiceEnabled, HostedVoiceMail | Format-List

The output must confirm that EnterpriseVoiceEnabled is set to True and that a valid LineURI (e.g. tel:+12065550144) is provisioned.

Managing Device Onboarding and SIP Provisioning URLs

To onboard a physical SIP device to the Teams SIP Gateway:

1. Reset the target SIP desk phone (Cisco, Poly, Yealink) to factory default settings.
2. Access the phone’s local web administration interface or DHCP Option 66 / 160 provisioning server settings.
3. Set the phone’s provisioning URL to match Microsoft’s regional DPS server:
   • Americas: http://noam.ipphone.teams.microsoft.com
   • Europe, Middle East, Africa: http://emea.ipphone.teams.microsoft.com
   • Asia Pacific: http://apac.ipphone.teams.microsoft.com
4. Reboot the phone. The phone downloads Microsoft’s root CA certificates and displays a pairing code on its screen.
5. Navigate to microsoft.com/devicelogin on a workstation, input the pairing code displayed on the SIP phone screen, and authenticate with the licensed user credentials.

Once authenticated, the SIP Gateway binds the device, and the user’s phone identity becomes active on the desk phone, providing bidirectional PSTN and Teams calling.