How to Configure Windows Server Direct Routing for Microsoft Teams

The PBX Integration Challenge

As enterprises migrate away from legacy desk phones (like Cisco CallManager or Avaya) and transition to Microsoft Teams for all internal communications, they face a massive hurdle: how do they make external phone calls to regular cell phones and landlines? Microsoft offers “Calling Plans” where Microsoft acts as your telephone provider, but these are often prohibitively expensive for global corporations, and they require abandoning existing, highly lucrative SIP trunk contracts with carriers like AT&T or Verizon.

The solution is Direct Routing. Direct Routing allows you to connect your existing, on-premise telecom infrastructure (specifically, a Session Border Controller or SBC) directly into the Microsoft 365 cloud. When an employee dials a phone number in the Teams app on their laptop, Microsoft routes the call down over the internet to your physical datacenter’s SBC, which then pushes the call out through your existing AT&T SIP trunk to the public telephone network (PSTN).

Configuring the Microsoft 365 tenant to recognize and trust your on-premise SBC requires the execution of highly specific PowerShell cmdlets against the Microsoft Teams cloud infrastructure.

Step 1: Preparing the Infrastructure

Before touching PowerShell, you must have the following prerequisites mathematically perfect:

1. An officially certified SBC (e.g., AudioCodes, Ribbon/Edgewater, Cisco CUBE) deployed in your datacenter with a public IP address.
2. A public DNS FQDN assigned to the SBC (e.g., sbc01.yourcorp.com).
3. A public SSL certificate from a trusted authority (like DigiCert) installed on the SBC. Microsoft Teams will violently reject self-signed certificates.

Step 2: Connecting to the Teams Cloud

You must open an elevated PowerShell session on your administrative workstation and authenticate into the Microsoft 365 Teams tenant.

# Install the Teams module if you haven't already
Install-Module -Name MicrosoftTeams -Force

# Authenticate using a Global Admin or Teams Admin account
Connect-MicrosoftTeams

Step 3: Registering the SBC in Microsoft 365

Now, you must formally introduce your physical SBC to the Microsoft cloud, telling it exactly how to route SIP traffic, which port to use (always 5061 for TLS), and enabling SIP OPTIONS ping (which allows Microsoft to verify the SBC is online before sending a call to it).

New-CsOnlinePSTNGateway -Fqdn "sbc01.yourcorp.com" -SipSignalingPort 5061 -MaxConcurrentSessions 100 -Enabled $true -ForwardCallHistory $true

(Note: The MaxConcurrentSessions should match the exact number of SIP channels you purchased from your telecom carrier).

Step 4: Defining Voice Routing Policies

The SBC is registered, but Microsoft Teams doesn’t know when to use it. You must create a routing policy. If a user dials a local US number, route it to SBC01. If they dial a European number, route it to SBC02 in London.

First, create a PSTN Usage (a logical grouping of routes):

Set-CsOnlinePstnUsage -Identity Global -Usage @{Add="US-Outbound"}

Next, create the actual Voice Route. This tells Teams: “If the user dials a number that matches this specific Regular Expression (Regex), send the call to SBC01.”

# This regex matches standard North American (+1) numbers
New-CsOnlineVoiceRoute -Identity "US-Route" -NumberPattern "^\+1[0-9]{10}$" -OnlinePstnGatewayList "sbc01.yourcorp.com" -Priority 1 -OnlinePstnUsages "US-Outbound"

Finally, create the Voice Routing Policy that bundles this usage, which you will assign to your users:

New-CsOnlineVoiceRoutingPolicy -Identity "US-Users-Policy" -OnlinePstnUsages "US-Outbound"

Step 5: Assigning the Policy to a User

The entire infrastructure is built. Now, you must take a specific employee (e.g., John Doe), activate their enterprise voice capabilities, assign them their direct inward dial (DID) phone number, and apply the routing policy so their outbound calls use the SBC.

# 1. Assign the phone number (This tells Teams to route inbound calls for this number to John)
Set-CsPhoneNumberAssignment -Identity "[email protected]" -PhoneNumber "+12125559999" -PhoneNumberType DirectRouting

# 2. Assign the routing policy (This tells Teams to route John's outbound calls through the SBC)
Grant-CsOnlineVoiceRoutingPolicy -Identity "[email protected]" -PolicyName "US-Users-Policy"

The SIP Handshake

The moment you execute the final command, the configuration is complete. When John Doe opens the Microsoft Teams app on his iPhone and dials a client, the Teams client sends an encrypted signaling packet to Microsoft’s cloud. Microsoft evaluates John’s US-Users-Policy, matches the dialed number against the US-Route regex, and fires the SIP INVITE packet directly to the public IP of sbc01.yourcorp.com in your datacenter, perfectly bridging the modern cloud with legacy telecom infrastructure.