(Updated) 24-hour test that switches Microsoft Teams Direct Routing SIP endpoints to certificates issued by a new CA

Updated June 22, 2026: We have updated the timeline and content. Thank you for your patience. 

[What and Why:]

We will conduct a 24-hour validation test that transitions Microsoft Teams Direct Routing SIP endpoints to certificates issued by a new Certificate Authority (CA). This effort strengthens certificate lifecycle management and ensures continued secure connectivity. The test helps organizations validate their readiness for future certificate updates and reduces the risk of unexpected service disruption.

[Rollout Schedule:]

• Test start: June 30, 2026, at 9:00 AM UTC
• Duration: 72 hours

[Impact on Your Organization:]

Who is affected:

• Organizations using Microsoft Teams Direct Routing with Session Border Controllers (SBCs) configured for TLS connections to Teams SIP endpoints.

Platforms/Services:

• Microsoft Teams
• Teams Direct Routing
• Session Border Controllers (SBCs)

What will happen:

• During the test the new certificate rollout happens gradually and in a staged manner in different Geos over several days. The connections to and from the SBCs gradually move over to the new certificate with periods where some connections will still use the old certificate and some connections with the new one.
• If the test is not terminated prematurely, then it continues over 2-4 days with traffic gradually moving over to the new certificates.
• If the SBCs are not able to establish outbound TLS connections or start rejecting inbound connections during the timeframe of the test, then this is an indication of possible trust issues with the new certificate. Please follow your SBC vendor documentation to resolve such issues.
• Comms about further actions is planned after the test is completed. No individual per customer comms are planned.
• The change will be automatically applied; no configuration changes will be initiated by Microsoft on your SBCs.
• If your SBC does not trust the required Root CAs, TLS connections to Teams SIP endpoints may fail during the test window.
• TLS failures may interrupt PSTN calling functionality.
• After the test period, endpoints will revert to their standard certificate configuration.

[Action Required/Recommendations:]

Action is required to avoid potential service disruption.

• Verify that your SBC trusts the previously communicated Root CAs required for Teams Direct Routing.
• Update SBC certificate trust stores if required.
• Review documentation: What’s new for Direct Routing (check required Root CAs).
• Notify voice administrators and helpdesk teams about this planned test.
• Monitor SBC connectivity and TLS handshake status during the test window.

[Compliance considerations:]

• Encryption methods or key management: The test introduces certificates from a new Certificate Authority, affecting TLS trust relationships for Direct Routing connections.