You have a Microsoft Teams Phone deployment. You are deploying Direct Routing. All users have a SIP URI in the format of [email protected]. The Session Border Controller (SBC) is named…

Question

Options

• AThe tenant is missing a vanity domain of voice.contoso.com.
• BThe firewall blocks outbound traffic on port 443 to Microsoft Teams.
• CThe certificate does not match the FQDN of the SBC.
• DMedia bypass is disabled on the SBC.

• A
  4% (1)
• B
  13% (3)
• C
  79% (19)
• D
  4% (1)

Explanation

Option C is correct because Direct Routing requires the SBC to present a valid TLS certificate whose Subject Name (or Subject Alternative Name) exactly matches the SBC's registered FQDN - in this case, sbc.voice.contoso.com. A mismatch between the certificate name and the FQDN causes TLS handshake failures, which surface as certificate warnings on the SBC during troubleshooting.

Why the others are wrong:

• A is a plausible distractor because voice.contoso.com does need to be a verified domain in the M365 tenant for the SBC FQDN to be registered - but a missing domain produces a Teams Admin Center registration error, not a certificate warning on the SBC itself.
• B is wrong because Direct Routing signaling uses port 5061 (SIP over TLS), not 443; a firewall blocking 5061 would drop the connection entirely, not generate a certificate warning.
• D is wrong because media bypass controls the media path, not signaling or TLS authentication - disabling it has no effect on certificate validation.

Memory tip: Whenever you see a Direct Routing SBC warning involving TLS, think "Name on the cert must match the name in Teams" - the certificate CN/SAN must be an exact FQDN match, or Microsoft's infrastructure will reject the handshake.

No community discussion yet for this question.