A colleague reports: The outage is the first test. Where do you start?
The outage is the first test. Rehearse, then put the result in the runbook. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
11 · TLS, certificates, SIP
Failover you can rehearse
The outage should not be the first test of the second proxy or the second SBC.
Learn it in 5 minutes
In a window, break the primary path and place a call. You want to see the next proxy or the next gateway take it, and you want emergency calls to prefer the local SBC still. Write the timestamps.
Certificate expiry is a failover you can predict. Put the date on a calendar and renew before Saturday morning becomes the test.
Rehearse the second gateway, and renew the certificate before it expires.
Visual
Worked example
I rehearse failover and I know the certificate expiry date.
- Window Planned
- Break Primary only
- Call Including a test emergency path
- Restore Then write it down
If it fails: The second SBC has never received a call, and the certificate expires on a Saturday.
Quiz
Which description of Codec intersection empty is accurate?
If the SBC and Teams offer no codec in common, the call fails, often with 488. Adding AMR-WB on a bypass trunk does not fix a G.711 refusal. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
A colleague reports: The SBC allows only G.729 and the far end does not. Where do you start?
The SBC allows only G.729 and the far end does not. Offer G.711 at minimum unless you have a measured reason not to. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Ecosystem
Glossary
- SRTP The media encryption Direct Routing uses. Signaling is TLS. A successful INVITE with plaintext RTP is not the design. Config: Allow the UDP media range. Do not strip SRTP on the SBC. Fault: The SBC offers RTP/AVP only and the call fails or is unsupported.
- TLS 1.2 Direct Routing signaling expects modern TLS. TLS 1.0 is not a compatible offer. Config: Upgrade firmware and offer TLS 1.2 or newer toward the proxies. Fault: The handshake dies before OPTIONS.
- Certificate SAN The name on the SBC certificate must match the FQDN you paired. Wildcards are allowed when they follow RFC 2818. Config: Issue the certificate for the paired name. Include the chain. Fault: TLS fails with a name mismatch and someone restarts the SBC.
- Microsoft trusted root The SBC certificate must come from a CA in Microsoft’s trusted root program. A private lab CA is not enough for production pairing. Config: Use a public CA for the production FQDN. Fault: The trunk works in the lab and fails the morning you point it at sip.pstnhub.
Sister technologies
Around the call: compliance recording, workforce management, emergency location, analytics, CRM screen pop, and an agent with a human escape. Each one has its own failure.
Config and troubleshooting
The second SBC has never received a call, and the certificate expires on a Saturday.
Cross-platform bridges
CUCM
Cisco CUBE is one of the SBC families named in this lab’s certification lesson. A certified release can be the Direct Routing SBC between Unified CM and Teams.
The tenant still needs a verified domain on the SBC FQDN, and the user still needs Teams Phone. The studio translator does not open a live AXL session. Confirm the current certified release before you build.
Webex
Teams Phone and Webex Calling are separate clouds. This lab does not describe a feature that registers a Webex Calling user into a Teams tenant.
A number move is usually a carrier port, a certified SBC, or a meetings interop product. Confirm before relying.
UCCE
Unified CCE stays the ACD until you migrate it. Microsoft’s contact-center articles name Connect, Extend, and Unify. They do not name a UCCE connector in the notes this lab cites.
Voice into Teams is still Direct Routing or Operator Connect. The routing script stays on the contact-center product you bought. Confirm the vendor’s current model. Source: https://learn.microsoft.com/en-us/microsoftteams/teams-contact-center.
Future hooks
Copilot Studio, Azure Communication Services, and Graph are later tracks in this lab. Treat any uncited limit as confirm before relying.
Sources and go deeper
Opened 2026-10. A row marked confirm did not open. Wikipedia is background. The Teams blog row is the community index.
- Plan Direct Routing — Microsoft Learn — last checked 2026-10.
- RFC 3261 — RFC — last checked 2026-10.
- RFC 8446 — RFC — last checked 2026-10.
- RFC 4566 — RFC — last checked 2026-10.
- Transport Layer Security — Wikipedia — last checked 2026-10. Wikipedia fallback for background. Confirm the vendor page before you change a tenant
- Session Initiation Protocol — Wikipedia — last checked 2026-10. Wikipedia fallback for background. Confirm the vendor page before you change a tenant
- Microsoft Teams blog index — Community — last checked 2026-10. Community index for the Microsoft Teams blog. This is the index, not a claim that a post discusses this room