Teams SIP Gateway

What is the Microsoft Teams SIP Gateway?

SIP Gateway is a feature that allows you to use any SIP device, see the phone compatibility list here, with Microsoft Teams. The SIP Gateway will allow you to keep your SIP phones that came with your old Cisco or 3CX phone system. You will be able to log into Teams with your corporate credentials and make and receive calls with a compatible SIP device.

What are the benefits and features of the SIP Gateway?

• Making and receiving calls
• Simultaneous calls
• Do not disturb
• Holding and silencing
• Voicemail
• Message waiting indicator
• Connecting and disconnecting
• Join a Teams meeting
• Call forwarding

As you can see, the features are quite limited. In addition, it is currently not possible to push particular configurations to this type of phone via an FTP server, since Microsoft becomes your provisioning server. The only option for you to push configurations to your phones will be to use either AudioCodes OVOC or Poly Lens.

The icing on the cake, with the basic configuration, you will not be able to call internal extensions! Don’t worry, I have a solution for you about this if you use Poly phones, like the VVX range.

Prerequisites to be able to connect via the SIP gateway

1. The user must have an activated phone number
2. User must have a License that includes Teams
3. The user must have an Enterprise Voice License (Call Plan or Direct Routing)

Please note that the SIP Gateway is not yet available for government environments (GCC, GCC High and DoD)

For more information, see –» HERE

Now that you know what the SIP gateway is, let’s see how to configure it with the different steps below:

1. Set up your Microsoft 365 tenant
   In your Teams administrative portal, please access the menu  Voice > Calling Policies, open the Global rule or the ones used by your employees.
   

   Then, at the second last option, check “SIP devices can be used for calls”.
   
   Please note that the activation of the SIP gateway function can take up to 24 hours before it is actually activated on your Microsoft 365 tenant.

2. Configure your company’s firewall
   In order to allow users to connect with a SIP phone inside your company’s local network, there are certain permissions that need to be set up in your firewall. For a better understanding I have made a small Visio diagram below:
   
   I also recommend that you allow Teams traffic to Microsoft 365 URLs and IP addresses.
3. Configure your DHCP server options
   Now that your firewall and Microsoft 365 tenant is enabled, you need to program your phones to connect to the SIP Gateway Service provisioning server. To do this you have 2 choices manually on each phone or use the DHCP options of your VoIP subnet. Attention! If you are migrating your phone system to Microsoft Teams, set up a second subnet/VLAN so that the DHCP options do not conflict with your current system. Note that if your employee buys a SIP phone for home, your IT team will still have to enter the provisioning address manually on their phone. Here are the provisioning addresses for the Microsoft Teams SIP Gateway Service:
   Europe:http://emea.ipp.sdg.teams.microsoft.com
   America:http://noam.ipp.sdg.teams.microsoft.com
   Asia: http://apac.ipp.sdg.teams.microsoft.com

   In addition to the usual options such as, router [#003], time server [#004], DNS servers [#006] and Domain names [#015], here are the other options to configure on your DHCP server for the Microsoft Teams SIP gateway:
   The option [#002], to specify your time zone. This value must be entered in hexadecimal. To help you, here is a correspondence of the time zones and their values in hexadecimal.

   GMT offset (hour)	GMT offset (second)	Hexadecimal
   0	0	0x00000000
   +1	3600	0x00000E10
   +2	7200	0x00001C20
   +3	10800	0x00002A30
   +4	14400	0x00003840
   +5	18000	0x00004650
   +6	21600	0x00005460
   +7	25200	0x00006270
   +8	28800	0x00007080
   +9	32400	0x00007E90
   +10	36000	0x00008CA0
   +11	39600	0x00009AB0
   +12	43200	0x0000A8CD
   -1	N/A	0xFFFFF1F0
   -2	N/A	0xFFFFE3E0
   -3	N/A	0xFFFFD5D0
   -4	N/A	0xFFFFC7CD
   -5	N/A	0xFFFFB9B0
   -6	N/A	0xFFFFABA0
   -7	N/A	0xFFFF9D90
   -8	N/A	0xFFFF8F80
   -9	N/A	0xFFFF8170
   -10	N/A	0xFFFF7360
   -11	N/A	0xFFFF6550

   The option [#042], to specify your NTP time server
   

   The [#160] option, to specify the address of the Microsoft provisioning server.
   

   The option [#066], to specify the address of the Microsoft
   

   If your DHCP options are configured properly, once your phone is plugged into your VoIP subnet/VLAN, it should reboot several times (at least 2x) in order to install the latest firmware “compatible” with the Microsoft Teams SIP Gateway. To be sure, Microsoft in their default options will deploy the Microsoft Teams logo. You can see an example below of a Poly VVX 500.
   

   If you ever migrate from an old phone system, I also advise you before connecting your phones to your Teams subnet/VLAN to reset it to factory settings.

4. Configure conditional access in Azure (optional)
   Conditional access is an Azure Active Directory (Azure AD) feature that ensures that devices accessing your Microsoft 365 resources are properly managed and secured. If your company ever uses conditional access to restrict device access to specific locations, you will probably need to exclude the following IP addresses that Microsoft uses to authenticate users on SIP phones.
   North America: 52.170.38.140 and 40.112.144.212
5. Provisioning of one or more SIP phones
   Finally, once your network is configured, your DHCP options are working, and your phones have the latest “compatible” firmware with the Microsoft Teams SIP Gateway, you will need to register your phones with the Microsoft Teams administrative portal. To do this, go to: https: //admin.teams.microsoft.com/devices/ipphones to enter the MAC address of your phone manually or import a CSV file containing a batch of SIP phones to register in your Microsoft 365 portal.
   

   Click on Provision devices, then Add MAC address manually and enter the MAC address of one of your SIP phones ready to connect as below:
   

   Once your SIP phone is registered with the Teams administrative portal, you will need to generate a verification code for your phone registration. Enter the enrollment code *55* (used by the SIP Gateway for validation of the unique enrollment verification code), followed by the verification code generated in Teams Admin Center for this device. For example, if the verification code is 254153, dial *55*254153 to register the device.
   
   

   Finally, once the SIP phone is registered, you will be able to authenticate on the phone or remotely using a pairing code. To get the code you can do it directly on the phone or on the administrative portal of Teams in the tab ” waiting for signin”.
   

   To pair your phone with your user in Microsoft 365, go to the portal
   https://microsoft.com/devicelogin
   Enter your pairing code and the Microsoft portal will ask you for your authentication information in order to connect to the SIP phone.
   

Change the end of the DigitMap by changing the 2 to a 0. You can do this in the Settings menu > SIP > Local Settings. This will allow you to dial 4-digit extensions. The calls will be routed to your SBC, in direct routing mode, you will then just have to route back the 4 digits extensions to the desired translation to MS Teams.

+xxxxxxxxxxxx|011xxx.T|[0-1][2-9]xxxxxxxxx|[2-9]xxxxxxxxx|[0-9]xxxT|911

Some interesting links:

• Enable core Microsoft Teams calling functionality on compatible legacy SIP phones with SIP Gateway – Microsoft Community Hub
• SIP Gateway Plan – Microsoft Teams
• Configure SIP Gateway – Microsoft Teams
• Using compatible Poly IP phones to sign into Microsoft Teams SIP Gateway
• AudioCodes SIP Gateway firmware

John D.