What is an SBC?
An SBC (session border controller) is the border control for phone calls over the internet. We explain what it does, why Teams needs one and when you can do without.
In short
- An SBC (Session Border Controller) sits where your network meets the operator and Microsoft.
- It only lets in calls that should get in, translates between systems and encrypts the calls.
- Teams Phone with Direct Routing requires an SBC certified by Microsoft.
- It connects the operator’s SIP trunk (phone lines and numbers over the internet), your PBX, analogue devices and Teams.
- With Operator Connect or Calling Plan, you do not need your own SBC.
Border control for calls
Think of an SBC as border control for phone calls over the internet. It sits where your organisation’s network meets the outside world, only lets in calls that should get in, translates between systems that speak different dialects and makes sure calls are encrypted.
The SBC is the gateway between your own systems and the public phone network, via the operator. The public phone network is the ordinary network of landline and mobile numbers that lets anyone call anyone.
SIP and SIP trunks in two minutes
SIP is the standard protocol used to set up calls over IP networks. Teams, operators and modern PBXs all use it.
A SIP trunk is the operator’s delivery of phone lines and numbers over an IP connection, instead of analogue lines or ISDN. With Direct Routing, the trunk connects to the SBC.
Why is it needed between Teams, the PBX and the operator?
- Microsoft only supports Direct Routing with certified SBCs and may reject support cases otherwise. The SBC also needs a public address, a name in your verified domain and a trusted certificate.
- Teams requires encrypted signalling and encrypted media. Many PBXs and operators use unencrypted SIP and other audio formats, so the SBC translates.
- The SBC becomes the hub that connects the operator’s trunk, the existing PBX, analogue devices and Teams.
- It can also keep the audio inside your own network, so the media path is shorter.
Security
The SBC protects against denial-of-service attacks, unauthorised use and toll fraud, such as hijacked lines making expensive international calls. It hides the layout of your internal network and encrypts signalling and media.
Because it sits at the edge of the network, it needs to be managed like a firewall, with updates, certificates and monitoring.
Physical, virtual or in the cloud
SBCs come as physical appliances, as software in a virtual environment and as a cloud service. At AudioCodes, which we partner with, the smaller models in the Mediant SBC range suit branch offices, especially where analogue devices remain, while the larger and virtual models suit data centres and Azure.
Sizing depends on the number of simultaneous calls at peak, not on the number of users. Transcoding between audio formats takes extra capacity.
When do you not need your own SBC?
With Calling Plan, Operator Connect and Teams Phone Mobile, Microsoft or the operator manages the connection to the phone network. If Teams also needs to connect to an existing PBX or to analogue devices, you still need an SBC for that part.
Glossary
| Term | Meaning |
|---|---|
| SBC | Border control for calls over IP: security, translation and routing |
| SIP | The protocol that sets up calls over IP |
| SIP trunk | The operator’s lines and numbers delivered over IP |
| Direct Routing | Teams connects to any operator through your certified SBC |
| Operator Connect | A certified operator connects Teams to the phone network, with no SBC of your own |
| Transcoding | Conversion between different audio formats (codecs) |
| Media bypass | Audio goes directly between Teams and the SBC instead of through Microsoft |
| Survivable mode (SBA, Survivable Branch Appliance) | The mode in which a local SBC keeps a branch office’s telephony running during an outage |
Last updated 14 October 2026.
Common questions
More questions
Can the SBC run in Azure?
Yes. Virtual SBCs such as AudioCodes Mediant VE are available in Azure, AWS and Google Cloud, and for your own virtual environments such as VMware and Hyper-V.
Is an SBC the same as a firewall?
No, but they sit at the same border. The firewall protects the network as a whole, while the SBC understands the calls themselves and can route, translate and protect them.
How often does the SBC need maintenance?
The software must stay within the versions Microsoft has certified, and certificates need renewing more and more often. Expect maintenance a few times a year.
Do we need two SBCs?
Where telephony is mission-critical, the SBC should be redundant, for example two units where one takes over if the other fails.
Further reading
Product
AudioCodes SBC
The Mediant family for Teams Direct Routing, SIP trunks and secure telephony integration.
Guide
Direct Routing or Operator Connect?
Four ways to connect Teams to the phone network, and which one suits you.
Guide
Teams and your existing PBX: coexistence and gradual migration
How to let Teams and your PBX work together while you move at your own pace.
Solution
Teams Phone
Make and receive calls directly in Microsoft Teams, with Direct Routing via AudioCodes and a connection to your PBX.
Let’s talk about your communications
Tell us where you stand today with your PBX, Teams or contact centre, and we will come back to you with a proposal. It costs nothing to ask.