Microsoft Teams Direct Routing remains the most flexible way to add external calling to Teams.
Adding Public Switched Telephone Network (PSTN) connectivity to Microsoft Teams comes down to three options: Microsoft Teams Direct Routing, Microsoft Calling Plans, and Operator Connect. Each one gets you to the same result (making and receiving external calls in Teams), but the levels of control, cost, and complexity differ significantly.
- Direct Routing connects Teams to your existing telephony environment through a Session Border Controller (SBC).
- Calling Plans let Microsoft act as your carrier. Operator
- Connect sits in the middle, pairing you with a vetted telecom provider through the Teams Admin Center.
Learn how Direct Routing works, what you need to deploy it, how it compares to the alternatives, and what’s changed in 2026. If you’re evaluating Teams Phone for the first time or pressure-testing your current setup, start here.
What is Microsoft Teams Direct Routing
Microsoft Teams Direct Routing is a method for connecting Teams to the PSTN through a third-party carrier and a certified Session Border Controller (SBC).
The SBC acts as a bridge between your telephony environment and Microsoft 365. It handles signaling and media between your carrier’s SIP trunks and the Teams client. Inbound calls flow from the PSTN through the SBC to the assigned Teams user. Outbound calls take the reverse path.
Organizations can connect their own SIP trunks, keep existing phone numbers, and maintain full control over carriers, call routing, and rates. Administrators configure voice routing policies in Microsoft 365 to determine how calls move between the SBC and Teams users.
Direct Routing is especially relevant for organizations that operate in regions where Calling Plans aren’t available, need to connect legacy PBX systems or analog devices, or have complex call flows that require granular routing control. It’s also the only PSTN connectivity option that lets you choose your own carrier outright, which is why it remains the preferred option for enterprises with global or multi-site operations.
For the full technical planning requirements, see Microsoft’s Direct Routing planning documentation.
Top benefits of Direct Routing
There’s a lot to like about Direct Routing. But one of the biggest advantages is the level of control and customizability it enables.
Other notable benefits include:
Cost Savings: By leveraging existing PSTN connectivity and phone numbers, Direct Routing reduces the need for additional licenses and infrastructure, leading to significant cost savings.
Flexibility: Organizations have the freedom to choose any third-party provider for PSTN connectivity, giving them greater control over their telephony services.
Scalability: Direct Routing allows for easy addition or removal of users and phone numbers, making it an ideal solution for growing businesses.
Reliability: With a secure and dependable connection to the PSTN, Direct Routing ensures uninterrupted phone calls, enhancing overall communication reliability.
Direct Routing vs. Calling Plans vs. Operator Connect
| Direct Routing | Calling Plans | Operator Connect | |
| Who manages it | Your team or a managed services provider | Microsoft | A Microsoft-approved telecom operator |
| Carrier flexibility | Any carrier with SIP trunking | Microsoft is the carrier | Choose from a list of approved operators |
| SBC required | Yes (certified, self-hosted or provider-managed) | No | No (operator manages the connection) |
| Pricing model | Per user, per session, or usage-based (varies by provider) | Per user per month (Microsoft sets rates) | Per user (operator sets rates) |
| Global availability | Available wherever your carrier operates | Limited to ~30+ countries | Limited to participating operators in your region |
| Best for | Enterprises with existing carriers, complex call flows, or global operations | Small to mid-size organizations that want simplicity | Organizations that want a managed experience with a preferred operator |
| Complexity | Highest (SBC deployment, voice routing configuration) | Lowest (fully managed by Microsoft) | Moderate (operator handles most of the backend) |
Key benefits of Direct Routing
The biggest advantage of Direct Routing is control. You choose the carrier, set the rates, and define how calls route through your environment. Everything else follows from that.
Beyond carrier flexibility, Direct Routing delivers several operational advantages that make it the preferred PSTN connectivity option for mid-market and enterprise organizations:
- Cost control: Use your existing PSTN contracts and negotiate rates directly with carriers instead of paying Microsoft’s per-user Calling Plan pricing. For organizations with high call volumes or international traffic, the savings add up fast.
- Number portability: Port existing phone numbers to your chosen carrier and assign them to Teams users. No need to acquire new numbers or disrupt established contact points.
- Scalability: Add or remove users and phone numbers without changing your underlying infrastructure. Direct Routing scales with your workforce, whether you’re adding 10 users or 10,000.
- Global coverage: Deploy PSTN connectivity in any region where your carrier operates, including countries where Microsoft Calling Plans aren’t available.
- Legacy and hybrid support: Connect analog devices, fax machines, contact centers, and existing PBX systems alongside Teams. Direct Routing is the only option that supports this level of interoperability.
Licensing and requirements
Before deploying Direct Routing, every user who needs external calling must have the right licenses and infrastructure in place.
Licenses
Each user requires two things from Microsoft: a Microsoft Teams license (included with most Microsoft 365 plans), though new Enterprise customers may need to purchase Teams separately.
Teams Phone is included with Microsoft 365 E5. For E1 or E3 plans, it’s available as an add-on. This license enables PBX functionality within Teams, including call transfer, hold, voicemail, and auto attendants.
For full licensing details, see Microsoft’s Teams Phone licensing documentation.
Infrastructure
On top of licensing, you’ll need the following in place before deployment:
- A certified Session Border Controller (SBC): Self-hosted on-premises, deployed in a data center, or managed by a service provider. Microsoft only supports Direct Routing with certified SBCs.
- PSTN connectivity from a third-party carrier: Your carrier provides the SIP trunks and phone numbers. This can be an existing contract or a new arrangement.
- A public IP address, FQDN, and TLS certificate for the SBC: Required for the SBC to communicate with Microsoft 365 over mutual TLS (mTLS). The certificate must be signed by a Certificate Authority in the Microsoft Trusted Root Certificate Program.
- Firewall and network configuration: Ports and IP ranges must be opened to allow SIP signaling and media traffic between the SBC and Microsoft’s PSTN hub endpoints.
One important note: Direct Routing is not supported in Islands coexistence mode. Organizations migrating from Skype for Business must be in Teams Only mode or have a supported coexistence configuration.
Direct Routing architecture
A Direct Routing deployment connects four components that work together to move calls between the PSTN and Teams users.
- Microsoft Teams client: The interface where end users make and receive calls. Works on desktop, mobile, and browser.
- Microsoft Teams Phone: The cloud-based PBX built into Microsoft 365. It handles call control, voicemail, auto attendants, and call queues.
- Session Border Controller (SBC): The bridge between Teams and your telephony environment. The SBC translates SIP signaling between Microsoft 365 and your carrier, enforces security policies, and routes calls based on your configuration.
- PSTN carrier: Your third-party telephony provider, delivering SIP trunks and phone numbers for inbound and outbound calling.
The call flow is straightforward. When a Teams user dials an external number, the call passes from the Teams client through Microsoft 365 to the SBC, then out to the PSTN via your carrier’s SIP trunks. Inbound calls follow the reverse path: PSTN to carrier to SBC to the assigned Teams user.
For organizations that want to reduce latency and bandwidth consumption, Direct Routing also supports media bypass, which allows media (the actual voice audio) to flow directly between the SBC and the Teams client without passing through Microsoft’s cloud media processors. More on that in the media bypass section below.
How to deploy Direct Routing
Deploying Direct Routing involves configuring both the Microsoft 365 tenant and your SBC to establish a trusted connection between them.
The process varies depending on whether you self-manage the SBC or work with a managed services provider, but the high-level steps are consistent.
Step 1: Confirm licensing and tenant setup
Verify that all users who need PSTN calling have Teams Phone licenses assigned. Confirm your Microsoft 365 tenant is configured for Teams Only mode (or a supported coexistence mode if migrating from Skype for Business).
Step 2: Choose your SBC strategy
Decide whether to deploy your own certified SBC on-premises, host one in a data center or cloud environment, or purchase a managed Direct Routing service from a provider. Self-managed deployments offer more control but require in-house expertise for ongoing maintenance. Provider-managed deployments shift that burden to the vendor.
Step 3: Prepare the network
Ensure your SBC has a public IP address, a registered FQDN, and a valid TLS certificate from an approved Certificate Authority. Open the required firewall ports for SIP signaling (port 5061) and media traffic to Microsoft’s PSTN hub endpoints.
Step 4: Deploy and configure the SBC
Install the SBC (physical or virtual), connect it to your carrier’s SIP trunks, and configure SIP signaling to communicate with Microsoft 365. Follow your SBC vendor’s documentation for the specific configuration steps. Microsoft maintains a configuration guide that walks through each step.
Step 5: Register the SBC with Teams
Use PowerShell or the Teams Admin Center to register the SBC’s FQDN with your Microsoft 365 tenant. Configure voice routing policies, PSTN usage records, and voice routes to control how calls are directed between your carrier and Teams users.
Step 6: Port numbers and assign to users
Work with your carrier to port existing phone numbers. Once ported, assign numbers to individual Teams users through the Teams Admin Center or PowerShell.
Step 7: Test and validate
Run test calls (inbound and outbound) to confirm call quality, routing accuracy, and failover behavior. Check SIP OPTIONS health between the SBC and Microsoft’s endpoints to verify the connection is stable. Resolve any issues before rolling out to the full user base.
Most mid-market and enterprise organizations work with a managed services provider to handle steps 2 through 7. A provider like Momentum brings deployment experience, certified SBC infrastructure, and ongoing support so your internal IT team doesn’t have to manage the SBC or carrier relationship directly.
Use this helpful IT readiness checklist for Teams Phone as a starting point for scoping the project internally.
Certified SBCs for Direct Routing
Microsoft only supports Direct Routing when used with a certified SBC. This isn’t a suggestion. If you connect an uncertified device and something breaks, Microsoft may reject the support case entirely.
The certification process is rigorous. Microsoft works directly with SBC vendors to validate SIP interoperability, runs daily tests against certified devices in production and preproduction environments, and establishes joint support processes with each vendor. The major certified SBC vendors include AudioCodes, Ribbon Communications, Oracle, Cisco, Metaswitch (via Alianza), and TE-SYSTEMS, among others.
Certification is granted to specific firmware versions. Higher firmware versions within the same major.minor release are supported, but organizations should confirm version compatibility with their vendor before upgrading.
One thing to note: Microsoft is not currently accepting new SBC certification nominations. The existing certified list is the working set for the foreseeable future.
If an issue arises, the SBC vendor is your first point of contact. The vendor investigates, and if the issue requires Microsoft’s involvement, they escalate through internal channels. Microsoft requires the vendor’s investigation report (with a ticket reference number) before engaging.
For the full list of certified devices, firmware versions, and emergency services providers, see Microsoft’s certified SBC directory.
Media bypass and Local Media Optimization
In a standard Direct Routing call, media (the actual voice audio) travels from the Teams client to a Microsoft cloud media processor, then to the SBC, and out to the PSTN. That extra hop through Microsoft’s cloud adds latency and consumes bandwidth.
Media bypass eliminates that hop. When enabled, media flows directly between the Teams client and the SBC while signaling still passes through Microsoft 365. The result is lower latency, reduced bandwidth usage, and better call quality for users who are on the same network as the SBC.
Media bypass works best when users and the SBC share a local network or are connected through a well-performing WAN. It’s not ideal for remote users on unpredictable internet connections, where routing media through Microsoft’s optimized cloud path may actually deliver better quality.
Not all SBCs support media bypass. Check your vendor’s documentation before enabling it.
Local Media Optimization
For organizations with multiple branch offices and a centralized SBC deployment, Local Media Optimization takes media bypass a step further. It ensures that media stays local to the branch site rather than routing back to a central SBC location, even when the SBC infrastructure is centralized. This reduces unnecessary media hops across WAN links and keeps voice traffic efficient across distributed environments.
Local Media Optimization is supported by a subset of certified SBC vendors. Microsoft publishes a compatibility list as part of the Direct Routing documentation.
Survivable Branch Appliance
Internet outages happen. For organizations with branch locations, the question is whether users at those sites can still make and receive PSTN calls when connectivity to Microsoft 365 goes down.
That’s what a Survivable Branch Appliance (SBA) solves. An SBA is a lightweight component deployed alongside the SBC at a branch site. When the connection to Microsoft 365 drops, the SBA takes over and allows users at that site to continue making and receiving calls through the local SBC and carrier connection.
Once internet connectivity is restored, calls automatically route back through Microsoft 365 as normal.
One critical update: Microsoft released a mandatory SBA version (v.2025.2.5.1) in early 2025 that introduced security changes incompatible with older installations. SBA versions released before this update stopped functioning after December 2025. If your organization uses SBAs, confirm with your SBC vendor that you’re running the latest version.
Network requirements and call quality
Direct Routing depends on a stable, well-configured network. Microsoft publishes specific performance thresholds for Teams calling, and falling outside them leads to noticeable quality issues: choppy audio, dropped calls, and one-way audio.
The key benchmarks to meet are:
- Latency: Under 100ms round-trip (one-way latency under 50ms)
- Jitter: Under 30ms
- Packet loss: Under 1%
Meeting these thresholds consistently requires a few things. Quality of Service (QoS) tagging should be configured to prioritize voice traffic over general internet traffic. Bandwidth planning should account for concurrent call capacity, especially at larger sites. And the network path between the SBC and Microsoft’s PSTN hub endpoints needs to be clean and direct.
For organizations with distributed locations, SD-WAN can help by routing voice traffic over the most reliable available path. Azure ExpressRoute is another option, providing a private connection to Microsoft 365 that bypasses the public internet entirely. And Momentum’s global internet connectivity portfolio is built to support exactly this kind of performance-sensitive traffic.
Emergency calling with Direct Routing
Organizations using Direct Routing are responsible for configuring emergency calling (E911 in the United States, equivalent services in other countries). This is not handled automatically by Microsoft, the way it is with Calling Plans.
There are two main components to get right. First, every user with a phone number needs an emergency address assigned in the Teams Admin Center. This is the address that gets transmitted to emergency services when a user dials 911 (or the local equivalent). Second, organizations should configure dynamic emergency calling where possible, so the emergency address updates automatically based on the user’s network location. This matters for hybrid workers who move between offices, home, and other locations.
Microsoft certifies specific emergency services providers for use with Direct Routing. Using a non-certified provider may result in rejected support cases if something goes wrong. The certified provider list is published alongside the certified SBC directory.
For organizations operating in regulated industries (healthcare, education, government), getting emergency calling right isn’t optional. It’s a compliance requirement, and it needs to be part of the deployment plan from the start.
2026 certificate authority changes: what you need to know
Microsoft made significant changes to the TLS certificate infrastructure for Direct Routing in early 2026. If your organization runs Direct Routing, this directly affects your SBC configuration.
The short version: Microsoft updated the root Certificate Authorities (CAs) used for SIP signaling between its infrastructure and customer SBCs. The change was driven by broader industry shifts. Google’s Chrome Root Program Policy (v1.6), updated in February 2025, deprecated the use of the Client Authentication Extended Key Usage (EKU) in TLS server certificates. Starting June 2026, certificates must use the Server Authentication EKU exclusively to remain trusted by major browsers.
To stay aligned with these requirements, Microsoft moved the Teams SIP interface to a new certificate chain anchored in DigiCert and Microsoft 2017 root CAs. Seven root CAs must now be present and trusted in your SBC’s TLS configuration:
- DigiCert Global Root CA
- DigiCert Global Root G2
- DigiCert Global Root G3
- DigiCert TLS ECC P384 Root G5
- DigiCert TLS RSA 4096 Root G5
- Microsoft ECC Root Certificate Authority 2017
- Microsoft RSA Root Certificate Authority 2017
The operational deadline for SBC-side trust store updates was the end of March 2026. Microsoft began implementing server-side certificate changes in April. SBCs that haven’t been updated will fail the TLS handshake, and calls will stop connecting. The failure is a hard stop, not a gradual degradation.
Microsoft also provided a dedicated test endpoint (sip.g1.pstnhub.microsoft.com on port 5061) for validating TLS connectivity against the new CA chain before the cutover. This endpoint accepts SIP OPTIONS only and should not carry voice traffic.
Other recent updates
Two additional changes arrived alongside the certificate update:
- IPv6 support for non-media-bypass calls: SBCs can now use IPv6 for both SIP signaling and media on calls that don’t use media bypass. A new IPAddressVersion parameter in the New-CsOnlinePSTNGateway cmdlet controls this setting. Mixed-mode (IPv4/IPv6) is not supported.
- AMR-WB codec: Now enabled for Direct Routing trunks on non-bypass calls. Outbound calls from Teams to the SBC include AMR-WB in the codec offer. Inbound calls that include AMR-WB in the offer will have it prioritized and selected.
For the full changelog, see Microsoft’s What’s New for Direct Routing.
GCC High and government environments
Direct Routing is available in Microsoft’s GCC, GCC High, and DoD cloud environments. For government contractors and agencies handling Controlled Unclassified Information (CUI) under DFARS, ITAR, or NIST 800-171, GCC High is typically the required tenant type.
The deployment model is the same as commercial Direct Routing, but the supported root CAs differ, and there are additional restrictions on Audio Conferencing licensing that need to be addressed before enabling voice. Microsoft recommends disabling the Audio Conferencing component included with G5 licenses until Direct Routing is fully configured and Audio Conferencing numbers are added to the tenant.
Momentum’s Direct Routing solution supports GCC High environments, including compliant SBC infrastructure, carrier connectivity, and ongoing managed support for organizations with government security requirements.
Self-managed vs. provider-managed Direct Routing
There are two ways to deliver Direct Routing: manage the SBC infrastructure yourself or purchase a managed service from a provider.
Self-managed SBCs
You deploy and maintain your own certified SBCs on-premises or in a data center. You manage carrier trunks, SBC firmware, call routing, security, and monitoring.
This option makes sense when your organization has existing SBC infrastructure still under contract, in-house staff with SBC and voice networking expertise, and call volumes large enough to benefit from oversubscribing voice traffic across shared facilities.
The tradeoff is operational overhead. You’re responsible for firmware updates, certificate management (including the 2026 CA changes outlined above), fraud monitoring, carrier management, and troubleshooting call quality issues.
Provider-managed Direct Routing
A managed services provider owns the SBC infrastructure, carrier relationships, and ongoing operations. You get a fully configured Teams Phone solution for a monthly recurring fee.
This option eliminates capital expenditure on SBC hardware, removes the need for in-house SBC expertise, and offloads carrier management, network monitoring, and fraud protection to the provider. Your team focuses on user management and business outcomes rather than infrastructure.
The tradeoff is less direct control over the SBCs and carrier facilities. For most mid-market and enterprise organizations, that tradeoff is worthwhile. The majority of Momentum’s Direct Routing customers choose the managed model for exactly this reason.
Direct Routing pricing
There’s no standard price for Direct Routing. Costs vary by provider, deployment model, and call volume. But most pricing falls into one of two structures:
- Per user: You pay a flat monthly fee per user that typically includes a phone number (DID) and unlimited domestic calling within the US and Canada. This is the most common model for managed Direct Routing services and the easiest to budget.
- Per session and DID: You purchase simultaneous call sessions based on your peak capacity requirements and pay separately for each DID. This model can be more cost-effective for organizations with high user counts but lower concurrent call volumes.
Both models are generally more affordable than Microsoft Calling Plans, especially at scale.
When evaluating the total cost of ownership, factor in the following beyond the provider’s recurring fee:
- Teams Phone licenses: Required per user, regardless of which PSTN option you choose. Included with E5 or available as an add-on for E1/E3 plans.
- SBC costs: Only applies to self-managed deployments. Includes hardware or virtual SBC licensing, maintenance contracts, and staff time.
- Professional services: One-time deployment fees for SBC configuration, voice routing setup, number porting, and user migration.
- International calling: Most per-user plans cover domestic calling only. International minutes are typically billed per minute or available as an add-on bundle.
A managed provider like Momentum typically bundles the SBC infrastructure, carrier connectivity, number management, and support into a single per-user fee, which simplifies procurement and makes costs predictable.
How to choose the right Direct Routing provider
The provider you choose determines the quality of your deployment, the reliability of your calling, and how much operational work falls back on your internal team. Not all Direct Routing providers are equal.
When evaluating providers, look for these core capabilities:
| Capability | Why it matters |
| Extensive Direct Routing, SIP trunking, and hosted PBX experience | Proves they’ve handled deployments like yours before |
| Microsoft-certified SBC infrastructure | Required for Microsoft support eligibility |
| Geo-redundant architecture with built-in failover | Protects against single points of failure |
| Responsive technical support team | You need help fast when call quality drops |
| Seamless number porting | Avoids disruption to existing phone numbers and business contacts |
| Proven track record across large, mid-size, and small deployments | Shows they can scale to your environment |
Beyond the evaluation criteria, these are the 10 most important questions to ask before signing with a provider:
- Are you a Microsoft-certified Direct Routing partner with certified SBC infrastructure?
- Where will the SBC be hosted, and do you offer a fully managed SBC service?
- Which regions and countries do you cover, and how do you handle local regulations?
- What is your process for number porting, and how long does it typically take?
- What SLAs do you provide for uptime and call quality?
- How do you handle failover and redundancy if an SBC or network link goes down?
- How do you handle emergency calling (E911 or equivalent)?
- How is pricing structured, and are there any fees beyond the recurring per-user cost?
- Can you integrate with our existing PBX or contact center, or provide a hybrid approach if needed?
- What does your recommended migration path look like, and how long does a typical deployment take?
Migration and coexistence
Most organizations moving to Direct Routing aren’t starting from a blank slate. They’re coming from a legacy PBX, an existing Calling Plan setup, or a Skype for Business deployment. The migration path matters.
From a legacy PBX
Direct Routing supports phased migration. You can run your existing PBX alongside Teams during the transition, with the SBC routing calls to both systems based on which users have been migrated. This lets you move users in waves rather than cutting over the entire organization at once. Analog devices like fax machines and elevator phones can remain connected through the SBC even after the PBX is decommissioned.
From Microsoft Calling Plans
Switching from Calling Plans to Direct Routing requires porting your numbers from Microsoft to your new carrier, deploying an SBC (or engaging a managed provider), and reconfiguring voice routing policies. The migration process from Calling Plans is well-documented and Momentum supports it end to end.
From Skype for Business
With Skype for Business fully retired, organizations still running on-premises Skype infrastructure need to migrate to Teams Only mode before deploying Direct Routing. This is a prerequisite. Microsoft does not support Direct Routing in Islands coexistence mode. For organizations that haven’t yet completed this move, our Skype for Business end-of-life guide covers what you need to know.
Get full control over your Teams phone system with Direct Routing
Direct Routing puts your organization in control of carriers, call routing, costs, and compliance. But the deployment, SBC management, and ongoing operations don’t have to fall on your internal team.
Momentum delivers managed Direct Routing backed by certified SBC infrastructure, geo-redundant architecture, and a support team that handles everything from number porting to call quality monitoring. One provider, one bill, one team accountable for the entire solution.
Talk to a Momentum Direct Routing specialist about designing a deployment that fits your organization.
FAQs
What is Microsoft Teams Direct Routing?
Direct Routing is a way to add PSTN calling to Microsoft Teams by connecting a certified Session Border Controller to your carrier’s SIP trunks. It lets Teams users make and receive external phone calls using your existing telephony provider instead of Microsoft’s Calling Plans.
How much does Direct Routing cost?
Pricing depends on your provider and deployment model. Most managed providers charge a per-user monthly fee that includes a phone number and domestic calling. You’ll also need Teams Phone licenses from Microsoft. Total cost is typically lower than Calling Plans, especially for larger organizations.
Do I need my own SBC for Direct Routing?
You need a certified SBC, but you don’t have to own or manage it yourself. Many organizations purchase managed Direct Routing from a provider that owns and operates the SBC infrastructure on their behalf.
Can I keep my existing phone numbers with Direct Routing?
Yes. Direct Routing supports full number portability. You can port your existing phone numbers from your current carrier or provider and assign them to Teams users.
What is the difference between Direct Routing and Operator Connect?
Direct Routing gives you full control over carriers, SBC configuration, and call routing. Operator Connect simplifies the process by letting you choose from a list of Microsoft-approved operators, with most of the backend managed for you. Direct Routing offers more flexibility. Operator Connect offers less complexity.
Does Direct Routing work with GCC High?
Yes. Direct Routing is supported in GCC, GCC High, and DoD environments. There are additional certificates and licensing requirements specific to government tenants.
What happens if my internet goes down with Direct Routing?
If you’ve deployed a Survivable Branch Appliance at the affected site, users can continue making and receiving PSTN calls through the local SBC. Without an SBA, Teams calling depends on internet connectivity to Microsoft 365.
What are the 2026 certificate changes for Direct Routing?
Microsoft updated the root Certificate Authorities used for SIP signaling between Teams and customer SBCs. Seven new root CAs (DigiCert and Microsoft 2017 roots) must be trusted in your SBC’s TLS configuration. SBCs that haven’t been updated will fail to connect.
