How to Configure Teams Survivable Branch Appliance Policies Using PowerShell CsTeamsSurvivableBranchAppliancePolicy

Enterprise deployments of Microsoft Teams Phone relying on Direct Routing often encounter voice availability risks at remote branch offices. If a remote facility suffers a wide-area network (WAN) outage or severed internet uplink to the Microsoft 365 cloud, cloud-hosted call control, signalling relays, and media processing become unreachable. Under default cloud routing, branch workers would be unable to place outbound calls, receive incoming calls, or reach local emergency services. A Survivable Branch Appliance (SBA)—running on certified Session Border Controller (SBC) hardware on-premises—provides local call survivability during cloud disconnections. Through the CsTeamsSurvivableBranchAppliancePolicy cmdlets in PowerShell, administrators can provision, assign, and govern offline voice resilience tenant-wide.

Understanding Microsoft Teams Survivable Branch Appliance Architecture

An SBA is an on-premises software blade embedded inside a certified Session Border Controller (from vendors such as AudioCodes, Ribbon, or Oracle):

• Normal Cloud Operation: During regular operations, Teams clients authenticate and process SIP signalling through Microsoft Phone System cloud relays. The on-premises SBC routes PSTN calls through local carrier trunks.
• Offline Survivability Mode: When WAN connectivity to Microsoft 365 drops, the local Teams desktop and mobile clients detect the disconnection and automatically fail over to the local SBA service running on the SBC.
• Supported Offline Capabilities: While in SBA survival mode, users can make outbound PSTN calls, receive incoming PSTN calls, dial internal extensions to other branch colleagues, and crucially, place emergency 911/999/112 calls through local PSTN/ISDN/SIP trunks.
• Policy Association: CsTeamsSurvivableBranchAppliancePolicy links target branch users to the fully qualified domain name (FQDN) of their local on-premises SBA appliance.

Connecting to Microsoft Teams PowerShell

Managing SBA policies requires the Microsoft Teams PowerShell module (version 4.0.0 or higher) with Teams Administrator or Global Administrator credentials:

# Import the module and connect to the Microsoft Teams tenant
Import-Module MicrosoftTeams
Connect-MicrosoftTeams

Confirm the availability of cmdlets dedicated to SBA policy management:

# Query SBA policy cmdlets
Get-Command *CsTeamsSurvivableBranchAppliancePolicy*

Inspecting Existing Survivable Branch Appliances and Policies

Before creating a policy, query your tenant to verify that the target on-premises SBA hardware is registered and active:

# List registered Survivable Branch Appliances
Get-CsTeamsSurvivableBranchAppliance

# Inspect existing SBA policies
Get-CsTeamsSurvivableBranchAppliancePolicy

Notice the BranchApplianceFqdn property, which specifies the local DNS hostname or IP address of the on-premises appliance.

Creating a New Survivable Branch Appliance Policy

To assign an SBA to a specific regional office—for example, a branch facility in Manchester—create a dedicated policy profile using New-CsTeamsSurvivableBranchAppliancePolicy:

# Create an SBA policy bound to the Manchester branch SBC
New-CsTeamsSurvivableBranchAppliancePolicy -Identity "SBA-Manchester-Branch" `
    -BranchApplianceFqdn "sba-manchester.corp.company.com"

For organizations deploying redundant high-availability SBC pairs at critical sites, create distinct policies for each physical appliance:

# Create a policy for Aberdeen operations center
New-CsTeamsSurvivableBranchAppliancePolicy -Identity "SBA-Aberdeen-Ops" `
    -BranchApplianceFqdn "sba-aberdeen.corp.company.com"

Modifying Existing SBA Policies

If an on-premises SBC hardware refresh alters the appliance’s FQDN or certificates, update the policy mapping using Set-CsTeamsSurvivableBranchAppliancePolicy:

# Update the target appliance FQDN for an existing policy
Set-CsTeamsSurvivableBranchAppliancePolicy -Identity "SBA-Manchester-Branch" `
    -BranchApplianceFqdn "sbc01-manchester.corp.company.com"

# Validate updated parameters
Get-CsTeamsSurvivableBranchAppliancePolicy -Identity "SBA-Manchester-Branch" | Format-List Identity, BranchApplianceFqdn

Assigning SBA Policies to Users and Security Groups

Assign SBA policies to employees who physically work at the target facility. This ensures their Teams clients register with the local appliance during WAN failovers:

1. Assigning Policy to an Individual User

# Grant SBA policy to a branch employee
Grant-CsTeamsSurvivableBranchAppliancePolicy -Identity "[email protected]" `
    -PolicyName "SBA-Manchester-Branch"

# Confirm policy assignment on the user object
Get-CsUserPolicyAssignment -Identity "[email protected]" | `
    Where-Object { $_.PolicyType -eq "TeamsSurvivableBranchAppliancePolicy" }

2. Assigning Policy to an Entire Branch Security Group

# Assign SBA policy across an Entra ID security group representing the Manchester office
Grant-CsTeamsSurvivableBranchAppliancePolicy -Group "8d9e0f12-4b5c-6d7e-8f9a-0b1c2d3e4f5a" `
    -PolicyType TeamsSurvivableBranchAppliancePolicy `
    -PolicyName "SBA-Manchester-Branch" `
    -Rank 1

Validating Client Failover and SBA Diagnostics

To verify that client failover functions correctly before an actual network emergency occurs, administrators can perform a simulated WAN disconnect test:

1. On a test workstation inside the branch office, temporarily sever external WAN routing while maintaining local LAN connectivity to the SBC/SBA.
2. In the Microsoft Teams desktop client, observe the client notification banner: “We are unable to connect to the network. You can still make calls using your backup calling connection.”
3. Dial a test outbound PSTN phone number. The call connects cleanly through the local SBA appliance.
4. Inspect the SBA diagnostic logs on the SBC web console to confirm active SIP session processing and codec negotiation.

Revoking and Deleting SBA Policies

When decommissioning a branch office or migrating a site to native Operator Connect, revoke the policy from users before removing the profile:

# Disassociate policy from the user
Grant-CsTeamsSurvivableBranchAppliancePolicy -Identity "[email protected]" -PolicyName $null

# Delete the SBA policy profile
Remove-CsTeamsSurvivableBranchAppliancePolicy -Identity "SBA-Manchester-Branch" -Confirm:$false

Configuring Teams Survivable Branch Appliance Policies via PowerShell guarantees voice continuity, maintaining vital communications and life-safety emergency dialing even during catastrophic WAN outages.