Teams Direct Routing from start to finish

What it is for

This chapter leads through the whole setup of Microsoft Teams Direct Routing with EasyUC’s integrated SBC in a fixed order. At the end a Teams user calls a number and lands in an EasyUC script. Each stage refers to the chapter with the details.

For understanding: the Teams tenant sends calls to certain numbers over an encrypted SIP trunk to the SBC on the EasyUC server. The SBC hands them to the script that belongs to the number. There, announcements, menus, queues, agents or the attendant console take over. In the opposite direction EasyUC delivers calls to Teams users over the same trunk, for example to attendants with a Teams device.

From Teams the SBC accepts only calls to script numbers. The order is therefore: network, SBC, tenant, certificate, sign-in, script with number, trunk and voice routes, policy for the users, test call.

Prerequisites

• EasyUC is installed, the licence module teams is present and switched on in the EasyUC Manager.
• An EasyUC user with the role EasyUC Teams (ROLE_APP_TEAMS_WORKSPACE) and the sub-permissions SBC bearbeiten, TENANTS bearbeiten and SCRIPTS bearbeiten.
• A fixed public IPv4 address and access to firewall and NAT.
• Access to the public DNS zone of the customer domain.
• An administrator of the Microsoft 365 tenant: for the domain, for an app registration with admin consent and with the Teams Administrator role.
• Teams users with a Teams Phone licence and Enterprise Voice for the test.

Step by step, stage 1: Prepare network and DNS

1. Choose the hostname, for example sbc.kunde.de, and create a DNS A record pointing to the public IP.
2. Check that the domain of the hostname is verified in the Microsoft 365 tenant.
3. Allow inbound TCP 5061 and UDP 20000 to 20999 from the networks 52.112.0.0/14 and 52.120.0.0/14, and outbound TCP 5061 to Microsoft.
4. Details: chapter “DNS, public IP and firewall for the SBC”.

Step by step, stage 2: Enable the SBC

1. Open EasyUC Teams → Teams → SBC Setup and click Enable integrated SBC.
2. Enter Public IP, Media IP and Contact e-mail. Leave Environment on production and Validation on DNS-01.
3. Click Enable integrated SBC and check that SBC service appears with last seen.
4. Details: chapter “Enable the Teams SBC and set the network details”.

Step by step, stage 3: Create the tenant and get the certificate

1. Open Teams Tenants and click Add tenant.
2. Enter Customer name, SBC hostname for this tenant and Directory (tenant) ID and click Create.
3. Open the tenant and, in the box Certificate for this hostname, click Request certificate.
4. Create the displayed TXT record in DNS and click Check and issue now until issued, valid until appears.
5. Details: chapters “Create and manage a Teams tenant” and “SBC certificate per tenant”.

Step by step, stage 4: Store the Microsoft access

1. In the customer’s tenant, register an application with the Graph permissions User.Read.All, Presence.Read.All, TeamworkDevice.Read.All and Organization.Read.All, grant admin consent and assign it the Teams Administrator directory role.
2. On the tenant page, under Microsoft Graph, enter the Application (client) ID and the Client secret and click Save.
3. Click Test credentials until Checked appears.
4. In the box Set up the trunk in Teams, check that PowerShell service reachable and Signs in automatically are shown. Without an app registration, click Sign in with a Teams admin.
5. Details: chapter “Graph access and Teams admin sign-in”.

Step by step, stage 5: Create a script with a Teams number

1. Open the script list and click Create IVR.
2. Assign a Name, tick Reachable via MS Teams, select the Teams tenant and the Direct Routing card.
3. Enter the Number dialled in Teams, for example +49 40 1234567, and click Save.
4. Details: chapter “Make a script reachable via Microsoft Teams”.

Step by step, stage 6: Set up the trunk and voice routes in Teams

1. Open the tenant page and check the status Reachable under Scripts over this trunk.
2. Click Show what would happen and read the preview.
3. Click Set up the trunk now and confirm the prompt.
4. Check Set up in Microsoft: yes. After a few minutes Reached from Microsoft shows “Microsoft answers our OPTIONS”.
5. In the Teams admin center, assign the voice routing policy named EasyUC-… to the users who are to call the script number. Alternatively tick Enable for all users (global policy) before the setup.
6. Details: chapter “Set up the trunk and voice routes in Teams”.

Step by step, stage 7: Assign numbers and make the test call

1. If users are to get their own phone numbers, assign them in the Number plan section through Actions → Assign … (chapter “Teams number plan and number assignment”).
2. Wait a few minutes until Teams has applied route and policy.
3. Select Show calls in the tenant bar.
4. Call the script number from the Teams client of a user with the EasyUC policy.
5. The call appears in Show calls, and you hear the script’s greeting.
6. Then open Call history, click the call and check the SIP ladder diagram.
7. In case of errors: chapter “Teams calls, SIP flow and captures”.

Fields and options

Check the result and narrow down errors

• Success: certificate valid, trunk active, Last OPTIONS current, script Reachable, Routes in Teams Up to date, and the test call reaches the greeting.
• The SBC service does not report in: check stage 2 and the service in the EasyUC Manager.
• The certificate stays on DNS entry required: the TXT record is not yet publicly visible or has an old value.
• „Microsoft kennt die Domain dieses SBC-Namens in diesem Tenant nicht.“ Verify the domain in the Microsoft 365 tenant (stage 1).
• The trunk stays down: check the firewall for the inbound TLS port and outbound TCP 5061, environment production instead of staging, hostname exactly as in the certificate.
• Teams reports an error immediately when dialling and the call is missing from the call history: the user lacks the EasyUC policy, or Teams has not applied it yet.
• The call is in the history but is rejected: the number does not belong to any active script of this tenant. Check Scripts over this trunk on the tenant page.
• The call is answered but there is no audio: check public IP, media IP and the UDP rule.
• For numbers from Operator Connect a separate path applies: chapter “Operator Connect through Teams forwarding”.