Table of Contents
Summary
- Microsoft is updating the root Certificate Authority (CA) for the SIP interface used in Teams Direct Routing.
- A SIP test endpoint will be provided to verify that your Session Border Controller (SBC) trusts the new CA.
- Organizations using Direct Routing with TLS mutual authentication will need to validate their SBC configuration.
- A successful TLS connection will ensure no service interruption for Direct Routing traffic and maintain user experience.
- This change has implications for both administrators and users.
Admin Impact: High
User Impact: Low
Release Start: 01 Apr 2026
Release End: 01 Apr 2026
Services: Teams
Category: Stay informed
Tags: Feature Update, User Adoption, Admin Action
History
2/21/2026 Item Added to Message Center
Microsoft Message
Introduction
Microsoft will update the root Certificate Authority (CA) used by the Microsoft Session Initiation Protocol (SIP) interface for Microsoft Teams Direct Routing. SIP is the protocol your Session Border Controller (SBC) uses for signaling. To help organizations validate their SBC Transport Layer Security (TLS) configuration before this change, we will provide a SIP test endpoint. TLS encrypts and authenticates SIP traffic and validating the TLS handshake will confirm that your SBC trusts the new root CA.
When this will happen
- Organizations will need to complete SBC-related CA validation by end of March 2026.
- Microsoft will begin applying server-side certificate changes starting in April 2026.
How this affects your organization
Who will be affected
- Organizations using Microsoft Teams Direct Routing with Session Border Controllers configured for TLS mutual authentication.
What will happen
- A SIP test endpoint will be provided to help you verify that your SBC trusts certificates issued by the new root CA.
- The endpoint will accept SIP OPTIONS messages only and must not be used for voice traffic.
- A successful TLS connection will indicate:
- Your SBC trusts the new CA.
- The TLS handshake is expected to succeed after the CA update.
- No service interruption is expected for Direct Routing traffic.
- This update will not change user-facing Teams experiences.
Test endpoint details:
- FQDN: sip.g1.pstnhub.microsoft.com
- Port: 5061
Learn more: Plan Direct Routing | Microsoft Teams | Microsoft Learn
What you can do to prepare
If your organization uses Direct Routing:
- Work with your SBC vendor to configure SIP OPTIONS tests to the new test endpoint.
- Validate that your SBC can establish a TLS connection to the endpoint before the end-of-March deadline.
- Update your internal operational documentation if it includes certificate validation, SBC configuration, or Direct Routing setup.
- Review your SBC vendor’s documentation for CA requirements and TLS configuration guidance.
- Communicate this change to your network or voice engineering teams as appropriate.
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.