Start with the Microsoft 365 tenant, not the SBC
A China voice project is valid only after the tenant and user location are established. Microsoft operates a separate cloud in China through 21Vianet, with a different feature set from the global commercial Microsoft 365 service. Microsoft’s service table updated 27 October 2026 lists Teams Phone, the Direct Routing add-on and Teams Rooms as unavailable in Microsoft 365 operated by 21Vianet. Recheck the official table at project start because cloud services can change.
For users homed in a global commercial tenant, Direct Routing may be assessed against Microsoft’s current requirements and the organisation’s China carrier, network and compliance conditions. An AV integrator in China can coordinate room, network and handover requirements, but tenant eligibility and telephony service must still be confirmed with Microsoft, the selected carrier and the organisation’s advisers.

Understand the supported Direct Routing architecture
Direct Routing connects Teams Phone to third-party telephony through a session border controller. The supported chain is an eligible global Microsoft 365 tenant, Teams Phone-enabled user, Microsoft Phone System services, certified SBC, carrier SIP trunk and the public telephone network. The SBC may be customer-managed, integrator-managed or provided as a service, but ownership must be explicit.
Confirm certification, supported firmware, capacity, resilience, transcoding, encryption, media-bypass support, monitoring and escalation before selection. Microsoft’s support boundary requires a certified SBC on supported firmware and normally sends SBC-specific investigation to the vendor first. Placement in a China office, data centre, regional hub or service platform also changes latency, firewall rules and failure domains.

Confirm licences, user homing and identity prerequisites
A Direct Routing user normally needs an eligible Microsoft Teams licence and a Teams Phone licence. Other licences can be required for particular scenarios. Record the tenant, usage location, assigned licences, telephone number, voice-routing policy and emergency-calling policy for every pilot account. A verified custom domain is required; Microsoft does not accept the tenant’s default onmicrosoft.com domain as the SBC domain.
Stage identity and voice changes through a small pilot and allow for policy propagation. Test the device types that will be used in production because desktop clients, mobile clients, certified desk phones and meeting-room systems can expose different media-path and operational issues.

Qualify the carrier, numbering and regulatory scope
Direct Routing does not provide telephone numbers or PSTN service. Qualify a carrier service that is technically compatible with the SBC and suitable for the sites and call patterns. Obtain the SIP handoff specification, codecs, signalling transport, caller-ID rules, DTMF method, porting process, service demarcation and escalation contacts.
For mainland China, a global architecture diagram is not proof that a particular carrier, numbering plan or cross-border topology is available or permissible. Validate service, number ownership, call routing, recording, data handling and emergency-calling arrangements with the carrier and the organisation’s legal, security and compliance teams before procurement. Document confirmed, conditional and unresolved items with named owners.

Design SBC, DNS, certificates and firewall rules together
The SBC needs a public FQDN, public DNS resolution, a trusted public certificate and a reachable public IP address. The certificate name must match the SBC FQDN and its chain must be trusted by Microsoft. Record certificate ownership, renewal alerts and a tested renewal procedure.
Direct Routing uses secured SIP signalling to Microsoft connection points, commonly on TCP 5061, plus defined media ranges and service endpoints. Take exact ports, addresses and domains from current Microsoft and SBC-vendor documentation. Record source, destination, protocol, port, purpose and owner for every firewall rule. Draw signalling and media separately because they may follow different paths.
Engineer the media path before enabling media bypass
Assess the full voice path: latency, jitter, packet loss, congestion, Wi-Fi, WAN routing, internet egress and the route to the SBC or Microsoft media processors. The practical checks in this AV-over-IP network readiness guide also apply to voice, including ownership, VLAN design, QoS, monitoring and rollback.
Media bypass can let supported clients send media directly to the SBC, but the SBC and topology must support it and the relevant client subnets, public addresses and connectivity must be correct. Establish a working non-bypass baseline, enable bypass for a controlled pilot, compare quality and routing, then expand only after the results are understood.
Define resilience, emergency calling and support ownership
Resilience should cover Microsoft connectivity, internet egress, carrier trunks, SBC nodes, DNS, certificates, power, LAN and WAN. Decide which failures reroute automatically, which need manual action and which calls cannot continue. Confirm emergency numbers, caller location, carrier capability, remote-user treatment and design approval; use only an agreed procedure for emergency-call testing.
Create a responsibility matrix for tenant administration, SBC, carrier, office network, endpoints, security and user support. Include severity definitions, contacts, maintenance windows and escalation evidence. A technically correct system can still be difficult to operate when suppliers have overlapping boundaries.
Pilot, accept and hand over the service
Test inbound and outbound calls, caller ID, transfers, forwarding, hold, voicemail, simultaneous calls, DTMF, conference escalation, call queues where used, certified phones, desktop and mobile clients, and meeting rooms where applicable. Also test carrier loss, SBC node failure, path changes, certificate alerts, policy mistakes and restoration. Agree acceptance thresholds before testing.
The handover pack should include as-built signalling and media diagrams, policy exports, number inventory, SBC backup and versions, certificate records, firewall matrix, carrier demarcation, monitoring, test results, rollback steps and support contacts. The AV commissioning checklist for China offices provides a useful structure for evidence, ownership and final acceptance.
Use a decision sequence that prevents premature procurement
Identify the tenant; confirm that Teams Phone functions are available to those users; validate licences and identity; qualify the carrier and numbering model; confirm regulatory and security requirements; select a certified SBC and supported firmware; design signalling, media, DNS, certificates and firewall rules; pilot without optional optimisation; introduce media bypass only if justified; then complete acceptance and handover.
The core lesson is simple: Direct Routing is an end-to-end service, not an SBC purchase. A defensible China design connects Microsoft eligibility, carrier reality, network engineering and day-two operations in one controlled set of documents.