Be Careful with Teams Voice Routing Policies if you are using Direct Routing with Calling Plans or Operator Connect

Introduction 

There are some use cases where a Teams deployment will have some combination of Teams Direct Routing with Calling Plans or Operator Connect Teams voice users. For these environments, you must be careful with how you assign the Online Voice Routing Policies in your tenant. You could end up with some unexpected routing of calls made by Calling Plan and Operator Connect users! 

Teams Dial Out and Online Voice Routing Policies (OVRPs) 

Teams Dial Out policies are used to apply outbound calling restrictions to Teams voice users. These apply to Calling Plan, Operator Connect and Direct Routing users. It’s important to note that Calling Plan and Operator Connect users must have the proper licensing to be able to make domestic or international calls. The Dial Out policies are used to assign outbound calling restrictions to Teams voice users. The policy controls the type of outbound peer-to-peer telephone calls a Teams user can make: 

• Local Calls Only 
• Domestic Calls Only 
• Domestic Calls and Calls to “Zone A” Countries 
• Domestic Calls and Calls to all Countries 

The Dial Out policy also applies outbound calling restrictions during Teams meetings to the meeting’s organizer. This is a separate restriction from the control of the user’s ability to make peer to peer telephone calls. 

Let’s say John Doe scheduled a meeting for this afternoon. He invited several of his colleagues as well as some domestic and international users who will use their phones to dial into the meeting. At 2:00 PM the meeting starts. A few minutes into the meeting, Mr. Doe realizes he forgot to invite a few more dial in users to the meeting. The Dial Out policy applies calling restrictions to Mr. Doe’s ability to add these users to his running meeting. If the policy allows him to add users with international numbers, he will be able to invite the United Kingdom based missing users. 

Teams Online Voice Routing policies are the descendants of the Voice Routing policies used in Microsoft Office Communications Server (OCS), Lync and on premises Skype for Business. These policies had two (2) purposes: 

• Outbound Calling Restrictions 
• Routing the calls to the PSTN via Media Gateways, SIP PBX’s, Session Border Controllers (SBCs), SIP Trunks, etc. 

In Teams the purpose of these policies is for routing Direct Routing calls to the Teams Direct Routing SBCs. They can also be used to provide finer outbound calling restrictions to peer-to-peer calls beyond what the Dial Out policy can limit. In a Teams tenant you could have an Online Voice Routing policy that permits calls to all countries and a second policy that allows calls to all countries except for those in the Caribbean. However, they cannot restrict the ability of a meeting organizer to add dial in users once a meeting has started. For tenants with more than one (1) SBC, the policies can be used to provide resilient and/or location-based routing (LBR) as needed. 

Online Voice Routing Policies and Teams Voice Users 

• Teams Online Voice Routing policies are required for deployments with Teams Direct Routing users.  
• Teams Online Voice Routing policies can be assigned to Calling Plan and Operator Connect users.  
• In most cases, Online Voice Routing policies should not be assigned to Calling Plan and Operator Connect users.  
• Outbound calls from Calling Plan or Operator Connect users who have been assigned an Online Voice Routing policy will be routed through the Teams Direct Routing SBCs and not through the Microsoft 365 and Operator Connect voice infrastructures as they should. 
• While it is easy to avoid explicitly assigning Online Voice Routing policies to Calling Plan and Operator Connect users, they can be assigned to them unintentionally or by “accident”. 

How Policies are assigned in Microsoft Teams 

• One of the implied best practices in many technical products and systems is to automatically assign policies as much as possible to users. 
• The corollary to this best practice is to directly assign policies to users where there are exceptions to the default policy. 
• In Microsoft Teams there is a Global (org-wide default) policy available for most of the policies that are assigned to Teams users.  
• These Global (org-wide default) policies are available by default in all Teams tenants. Most cannot be deleted from a tenant. Configuring the Global (org-wide default) policies is optional. 
• Most of the Global policies can be modified to meet the needs of the customer.  
• The Teams Emergency Calling, Emergency Call Routing, Network Roaming and Online Voice Routing policies can be automatically assigned to users based on their current location  
• Teams Tenant Network Sites are used to provide the assignment of features and policies based on the Teams user’s current location. They are configured when deploying Teams Dynamic 911, Location Based Routing or Teams Local Media Optimization. They are also needed when assigning Network Roaming policies by location.  
• Most of the Teams policies allow administrators to add their own user level versions of these policies. 
• A policy that has been granted (assigned) to a user supersedes the automatically assigned Global (org-wide default) and location based dynamically assigned policies. Assigned user policies are always the effective policy for the user 

Online Voice Routing Policy Assignment 

• Most Teams Direct Routing deployments include only a single SBC and do not need to use the ONLINE VOICE ROUTING POLICY for outbound calling restrictions. These customers will only configure the Global (org-wide default) Online Voice Routing policy and let the policy be automatically assigned to all Teams users. 
• There is a built in Global (org-wide default) Online Voice Routing policy that can be configured to route Direct Routing calls to the Direct Routing SBCs. 
• When Direct Routing came out a few years ago, there was some guidance from Microsoft that Direct Routing users could not use automatically assigned Online Voice Routing policies. They had to have user level Online Voice Routing policies assigned to them. 
• The guidance has changed, and Direct Routing users can get their Online Voice Routing policies through automatic provisioning 
• Administrators can create additional Online Voice Routing policies as needed. 
• A client plans on enabling 1,000 Teams Direct Routing users. 
• The client has two (2) Direct Routing SBCs.  
• The client has decided that the second SBC should only be used by their thirty-eight (38) Direct Routing enabled salespeople 
• The client does not have a need to assign these policies dynamically to users based on their current on premises physical location 
• Solution: 
• They configured the Global (org-wide default) Online Voice Routing policy to route Direct Routing calls through the first SBC. 
• They created a user level Online Voice Routing policy, named “SecondSBC”, that routes calls out the second SBC. 
• They manually granted (assigned) the “SecondSBC” Online Voice Routing policy to the salespeople. Every time they add a new salesperson, they will grant the user this policy 
• The rest of the users will “inherit” the Global (org-wide default) Online Voice Routing policy, and all their calls will be routed through the first Direct Routing SBC 

And Now the Problem and the Solution 

Problem 

• Teams Direct Routing is added to a deployment that already has Calling Plans or Operator Connect.  
• Calling Plans or Operator Connect are added to a deployment that already has Teams Direct Routing 
• Unintentional routing of calls for Calling Plan or Operator Connect users will occur when the Global (org-wide default) Online Voice Routing policy is configured to route calls to Teams Direct Routing SBCs. The policy is automatically assigned to all Teams users, including Direct Routing, Calling Plan and Operator Connect users 

Solution 

• For both cases, create a user level Online Voice Routing policy. You can name it “DirectRoutingDefault” for example 
• Copy the configuration of the Global (org-wide default) Online Voice Routing policy into the “DirectRoutingDefault” Online Voice Routing policy 
• Create a second user level Online Voice Routing policy for testing. Name in “NonDRUsers”. 
• This new policy should not include any PSTN Usages. 
• Assign the “DirectRoutingDefault” Online Voice Routing policy to all Teams Direct Routing users. 
• Create a list of all Teams Direct Routing users 
• Create a list of pilot Teams Direct Routing users for testing 
• Create a list of pilot Calling Plan or Operator Connect users for testing 
• Assign the “DirectRoutingDefault” policy in the Teams Admin Center to the pilot group of Direct Routing users or 
• Use Teams PowerShell and the Grant-CsOnlineVoiceRoutingPolicy to assign the policy. 
• Assing the “NonDRUsers” policy to the Calling Plan\Operator Connect pilot group. 
• Test outbound calling with both pilot groups including calls to the emergency services test number and 911. Calls from the Calling Plan\Operator Connect users should not be routing through the Direct Routing SBC 
• Assign the “DirectRoutingDefault” policy to the rest of the Direct Routing users 
• Remove the PSTN usages in the Global (org-wide default) Online Voice Routing policy 
• Unassign the “NonDRUsers” policy from the Calling Plan\Operator Connect Pilot users 

Final Note 

• Do not assign Online Voice Routing policies to Tenant Network Sites if you have Direct Routing and Calling Plan or Operator Connect users in the same tenant. Even if the Global (org-wide default) Online Voice Routing policy is empty, location level Online Voice Routing policies would still be assigned to non-Direct Routing Teams voice users 

Summary 

• In Tenants that have Teams Direct Routing users and Calling Plan or Operator Connect voice users: 
• The Global (org-wide default) Teams Online Voice Routing Policy should not have any PSTN usages defined 
• A user level policy for the Direct Routing users should be created and assigned to them 
• Calling Plan and Operator Connect users should almost never have an Online Voice Routing policy assigned to them 
• Do not associate any OVRPS to a Tenant Network Site 
• Enabling Technologies is available and ready to answer any Microsoft Teams questions that you might have. Please contact us at contact@enablingtechcorp.com 

Join me May 9th at 2pm to discuss Teams Phone System Lessons and work with our team of Cloud Computing Consultants who have done this so many times they know all of the “minefields” to prevent missteps.