MS Teams General Admin - SIP Gateway (3PIP Devices)
What is the SIP Gateway:
SIP Gateway lets your organization use any compatible SIP device with Microsoft Teams to preserve your investments in SIP/3PIP devices. Now you can sign-in to Teams with your corporate credentials and make and receive calls with a compatible SIP device. Compatible devices can be Skype for Business IP (3PIP) phones with standard SIP firmware, Cisco IP phones with multiplatform SIP firmware, or SIP devices from vendors such as Poly, Yealink, and AudioCodes.
Important Note: CallTower provides this documentation as a secondary option, for customers that would like to utilize the Microsoft SIP Gateway. However, CallTowers recommmended solution for SIP Devices is to migrate them to our CT Cloud Voice Platform where they will recieve full support and more functionality. Support for SIP Gateway is not provided by CallTower and any troubleshooting will be best effort with referal to Microsoft Support.
Benefits of SIP Gateway
SIP Gateway connects compatible SIP devices to Teams to help your users migrate seamlessly to Teams telephony. Using SIP Gateway, your users can do all of the following:
- Make calls: SIP device users can make calls to the Public Switched Telephone Network (PSTN), to other SIP devices, and to Teams and Skype for Business users. SIP device users can only call users who have phone numbers.
- Receive calls: SIP device users can receive a call from the PSTN, from Teams or Skype for Business users who have SIP devices, and from Teams and Skype for Business client applications. The SIP device acts as a Teams endpoint. Inbound calls will also be forked to the user's SIP device.
- Multiple simultaneous calls: A SIP device user in a call can put the call on hold to make or receive other calls. A SIP device user can also conference two calls.
- Do not disturb: A SIP device user can set do not disturb on the device so that the device will not ring for incoming calls. This has no impact on the user's status on all other Teams endpoints.
- Hold/Resume and Mute/Unmute: A SIP device user can hold and resume or mute and unmute a call by using the features for those actions on the device.
- Voicemail: SIP device users can listen to electronically stored voice messages that callers leave for them.
- Message waiting indicator: SIP device users can receive notifications that alert them when they have new voicemail messages.
- Sign-in and sign-out: SIP devices users can sign in and sign out of Teams on the device.
- Dual-tone multi-frequency: SIP device users can press number keys to provide input during interactive voice response calls.
- Teams meetings: A SIP device user can join a Teams meeting by dialing the meeting access number. Meeting participants can add a SIP device user to the meeting by dialing out to user's phone number or simply adding a participant by clicking on 'Request to Join' will also alert the user's SIP device. Guest users from another organization can be added to a Teams meeting by a participant who dials out to a guest user's number to include that guest.
- Call transfers: SIP device users can transfer calls. SIP Gateway supports both blind and consultative transfers.
- Local call forwarding: A SIP device user can set forwarding rules (always, on timeout, and busy) for the device. If the device is connected to the SIP Gateway, then the call will be redirected to the target address based on the rule that the device user set. To make local call forwarding work, the admin must set the
- Offboard stale devices: SIP Gateway supports auto offboarding of stale devices provisioned for a tenant. Paired (signed-in) devices will be offboarded if not connected for 30 days, and unpaired (signed-out) devices after 14 days. An offboarded device can be re-onboarded after a factory reset.
Requirements, Hardware, software, and licenses
Teams users must have a phone number with PSTN calling enabled to use SIP Gateway.
If you have a 3PIP or SIP device, you must have:
- A license for Phone System (via E5 or a standalone license)
- PSTN enablement (i.e., a phone number) via a Microsoft Teams Direct Routing, or Operator Connect
- A Common Area Phone license for any common area devices
Please Refer to Microsoft Docs for the Most Current List of Compatible Devices
Compatible Devices: https://docs.microsoft.com/en-us/microsoftteams/sip-gateway-plan#compatible-devices
Configure SIP Gateway
Before you can configure SIP Gateway, do the following:
- Reset SIP devices to factory default settings. You or your organization's users must reset each SIP device used with SIP Gateway to its factory default settings. To find out how to do that, see the manufacturer’s instructions.
- Open your firewall to Microsoft 365 and Teams. Open your network's firewall to Microsoft 365 and Teams traffic as described in Office 365 URLs and IP address ranges. Firewall rules are needed for outbound traffic only.
- Make sure the SIP devices are not behind a proxy. Ensure that http/s traffic bypasses any corporate http/s proxy.
- Open the UDP port. Open UDP port in the range 49152 to 53247 for IP ranges 188.8.131.52/14 and 184.108.40.206/14.
- Open the TCP port. Open TCP port 5061 for IP ranges 220.127.116.11/14 and 18.104.22.168/14.
- Open the following https endpoints (IP addresses and URLs):
Verify that SIP Gateway is available for your organization
Sign in to the Teams admin center.
At the left, select Teams devices and see if the SIP devices tab is visible. If it is, the SIP Gateway service is enabled for your organization.
Enable SIP Gateway for the users in your organization
You can enable SIP Gateway for your organization in either of two ways:
by using the Teams admin center,
or by using a PowerShell cmdlet.
By using Teams admin center
To enable SIP Gateway in the Teams admin center, follow these steps:
- Go to the Teams admin center
- At the left, under Voice, select Calling policies.
- At the right under Manage policies, select the appropriate calling policy assigned to users or, if necessary, create a new calling policy and assign it to the required users.
- Select Manage policies, select a policy, and then select Edit.
- Turn on the setting for SIP devices can be used for calls, and then select Save.
By using PowerShell
You can also enable SIP Gateway by using the PowerShell Set-CsTeamsCallingPolicy cmdlet. To enable users for SIP devices, select a policy, and set the
-AllowSIPDevicesCalling attribute to
True. The default value is
False, so users will not be able to use their SIP devices unless you enable them.
Set the SIP Gateway provisioning server URL
You can set the SIP Gateway provisioning server's URL in your Dynamic Host Configuration Protocol (DHCP) server. Users who work remotely must configure it manually.
For each SIP device, set one of the following SIP Gateway provisioning server URLs:
Add SIP devices to your Teams organization by configuring the above SIP Gateway provisioning server URL in your DHCP server. Using Option 66 for Yealink and/or Option 160 for Poly. Also, you can use DHCP option 42 to specify the Network Time Protocol (NTP) server, and DHCP option 2 to specify the offset from Coordinated Universal Time (UTC) in seconds. The devices in your organization will be routed to the SIP Gateway provisioning server. Successfully provisioned SIP phones will display the Teams logo and a soft button for sign-in.
Ensure SIP devices are on the minimum supported firmware version for onboarding. During onboarding, SIP Gateway will push the default configuration and authentication user interface to the device. To find out the required firmware version for SIP devices, see Plan for SIP Gateway.
DHCP Options: DHCP Configuration for Skype for Business Phones (3PIP/SIPGateway) - CallTower Solutions Center (uc.solutions)
Users who work remotely must manually configure the provisioning server URL into their SIP device by using the following steps:
- Open Settings on the device and get the device's IP address.
- Open a browser window, enter the device’s IP address, log in (if necessary) and configure the provisioning server’s URL in the device's web utility.
- Under Settings or Advanced settings on the web utility, enter the provisioning server URL shown above.
Important Note: If you don't know the current admin password to the device please factory reset it as per the pre-requisit instructions.
Tip for Poly Devices: Use Poly Lens (lens.poly.com)
- Onboard (redirect) your Poly VVX and or Trio devices to Poly Lens from RPRM/PDMS-E or through DHCP server reconfiguration
- Setup Lens Account if you don’t have one already (lens.poly.com)
- Upgrade the phone firmware version to the approved firmware for SIP Gateway
- Remotely reset the devices from Lens
- Create Phone Policy with SIP Gateway Provisioning enabled and select the SIP Gateway region you want to provision your devices to
Configure conditional access
Conditional Access is an Azure Active Directory (Azure AD) feature that helps ensure that devices that access your Microsoft 365 resources are properly managed and secure. SIP Gateway authenticates SIP devices with Azure AD, so if your organization uses Conditional Access for devices in the corporate network, it should exclude the following IP addresses:
- North America:
- East US: 22.214.171.124
- West US: 126.96.36.199
- EMEA region:
- North EU: 188.8.131.52
- West EU: 184.108.40.206
- APAC region:
- Australia East: 220.127.116.11
- Australia Southeast: 18.104.22.168
Provisioning and Sign-In/Out
For Detailed Instructions on Signing in and Out of Devices Please see the Microsoft Documentation Here:
Common Area Devices: https://docs.microsoft.com/en-us/microsoftteams/sip-gateway-configure#provision-and-enroll-sip-devices-as-common-area-phones
End Users: https://docs.microsoft.com/en-us/microsoftteams/sip-gateway-configure#how-to-sign-in-and-sign-out