Microsoft eCDN Deep Dive

Microsoft Teams Town Hall events can support up to 20,000 participants with Teams Premium, and probably more than this in the future. If the majority of those participants are at sites within your organization, you could easily see how individual unicast streams of 1.5Mbps per participant will generate a very large amount of traffic. This could create a perfect storm for a denial of service on your organization's Internet connection...

This is where eCDN (Enterprise Content Delivery Network) solutions come in. If you are unfamiliar with eCDN, you might envision deploying on-premises servers to manage traffic distribution to on-site participants. However, eCDN offers an innovative approach by utilizing peer-to-peer networking among clients, eliminating the need for local infrastructure. This is achieved through a sophisticated software layer that orchestrates streaming from the cloud to a select number of participants. These participant machines then act as hubs, efficiently streaming content to nearby clients via peer-to-peer streaming of media.

Several eCDN providers are available in the market, including Hive, Kollective, and Ramp. Following Microsoft’s acquisition of Peer5 in 2021, the company now offers its own in-house eCDN service, known as Microsoft eCDN. This service currently supports the following streaming video platforms:

• Teams Town Hall
• Viva Engage
• Teams Live Events (now deprecated)

 

What Does eCDN do?

eCDN optimizes the number of streams required from the cloud to individual participants in large meetings. It achieves this by initially sending the stream from the cloud to a subset of participants. Other participants on the same network segment as those already receiving the stream can then access it directly through peer-to-peer connectivity.

The diagram below illustrates a traditional unicast model in the “Before” image and an eCDN solution that reduces the three streams from the cloud to a single stream in the “After” image:

In practice, the Microsoft eCDN solution can support one cloud streaming peer servicing up to 30 other peer-to-peer participants. This configuration can potentially achieve a 30:1 reduction in bandwidth usage. However, this optimal scenario may not always be realized due to participants being distributed across various internal networks and physical locations. The comparison between the bandwidth used in a unicast model and that used with the eCDN model is referred to as the peer-to-peer efficiency of the solution. Below is an example illustrating how to calculate the efficiency for a specific case:

An example from Microsoft:

A 2 Mbps stream with 1,000 concurrent viewers would effectively require a 2 Gbps connection to accommodate that stream. If Microsoft eCDN provided, for example, a 90% P2P efficiency, only 10% of the internal bandwidth, that is, 200 Mbps, would be required.

 

How Does eCDN do it?

The Teams application and web app incorporate an additional software layer atop the media stack. This client software layer collaborates with Microsoft’s eCDN cloud services to orchestrate media flows, thereby minimizing the number of clients that need to retrieve the stream from the Internet. Within the Microsoft cloud, the server-side components of the eCDN service include the following elements:

• Peering discovery service: Responsible for peer discovery.
• Switchboard: Responsible for creating the initial P2P connections between viewers.
• Data pipeline: Consumes all service telemetry and stores it in a data warehouse for analytics consumption.

  

Within the Teams application there are the following components that talk to the eCDN services and relay media to local peers:

• Player Plugin: Responsible for intercepting and forwarding video-related requests to the Client SDK.
• Client SDK: Responsible for intelligently requesting video resources from HTTP / P2P and stitching the data buffers in real-time.
• The Client SDK connects with the backend (Peering discovery service, Switchboard, Data pipeline).
• The discovery service sends the Client SDK a set of peers that it believes will benefit this particular viewer. Peers are selected based on network proximity, cache allocation, stream relevance, among other parameters.
• The Client SDK establishes WebRTC data channel connections with the specified set of peers with the help of the Switchboard.
• HTTP requests that are generated by the video player are intercepted by the Player Plugin and forwarded to the Microsoft eCDN Client SDK, which decides, based on real-time measurements, whether to fetch the desired resource from the P2P network or from HTTP or from both concurrently in order to provide that resource back to the player in the most efficient and timely manner.
• The manifest requests, DRM license and encryption are always retrieved from the HTTP edge server in order to get the most current copy and to adhere to authorization mechanisms.
• Independently, the Client SDK requests authorization to create peer connections from the Microsoft eCDN backend. Once authorized, the Client SDK begins to download resources from HTTP and P2P.

 

A high-level diagram of these services look like this:

What are the Management Capabilities of Microsoft eCDN?

In addition to the bandwidth advantages offered by the Microsoft eCDN service, an analytics portal is also provided. The analytics portal gives you access to deep insights into each of the Townhall meetings that take place on your network.  

The most critical metric within the portal is the Peer-to-Peer (P2P) efficiency of the network. A higher P2P efficiency percentage indicates that more participants are receiving their media via local Peer-to-Peer connections rather than directly from the Internet.

Note: I have added the Microsoft eCDN portal to the latest version of Portals for Office 365 software for your administrating pleasure (available shortly). Portals for O365

In addition to the high-level aggregated view, detailed drilldowns are available for each meeting, providing information on a per-user basis: 

 

Below is an example of four separate Teams clients operating with the Portals for Office 365 application (Portals for O365). A notable feature of the eCDN plugin integrated into Teams is the ability to access a debug screen, which provides detailed information about the ongoing processes. By opening the debug screen (Alt+Shift+P) on each of these windows, the Teams client in the bottom right corner is the only one receiving its stream directly from the Internet (indicated by the blue graph). The other three clients are receiving their streams from the bottom right client (indicated by the orange graphs).

Zooming in on the stats, you can see the extensive information that's available to you to troubleshoot what is going on with any specific client:

The statistics in the client you can see that the following information is provided:

FPS (Actual/Video): Frames per second of the received video content.

Frames (Drop/Total): Frames that have been dropped and total frames received.

HTTP Speed: Indicating the data speed coming from the cloud to the client.

Peer to Peer mode: Indicating that eCDN is enabled for peering mode.

Peer to Peer Speed: The amount of data per second being downloaded from a local peer.

Peers: The number of peers that are peering off a local client.

Total HTTP Downloaded: The amount of data that this client downloaded from the cloud (this may occur for a while at the start of a call while the peering information is being learned and negotiated.)

Total P2P Downloaded: The amount of data that this client downloaded from a local peer

Total P2P: Percentage between media streamed from the cloud verses from a local peer.

Peer to Peer Speed: The current streaming speed per second that’s coming from a local peer to this client.

Local IP: This allows you to see that the client was able to see the local machines IP to determine which location it’s in. If the client is having issues with WebRTC Browser Disable mDNS, this value will show up as N/A. This is a good troubleshooting indicator. See the WebRTC Browser Disable mDNS section for more details.

Group ID: The group that the client was associated with based on Subnet details.

 

What Are The Prerequisites to Use Microsoft eCDN?

To utilize Microsoft eCDN, appropriate licensing is required. The eCDN license can be purchased separately as an add-on. According to Microsoft, a license is necessary for each benefiting user, defined as a user who participates in an eCDN-enabled event at least once per year.

Note: Above pricing is USD.

The eCDN license is also included as part of the Microsoft Teams Premium license. The licensing mechanism operates slightly differently than one might expect. Instead of assigning licenses to specific users, the number of Teams Premium licenses within the tenancy offsets the number of eCDN licenses required for a meeting. For instance, if you have 2,000 users needing eCDN functionality and already possess 500 Teams Premium licenses, you would need to purchase an additional 1,500 supplemental Microsoft eCDN licenses. (Reference: https://learn.microsoft.com/en-us/ecdn/how-to/purchasing#what-if-i-have-teams-premium-licenses)

Here’s a useful table provided by Microsoft to describe other scenarios for licensing eCDN (Reference: https://learn.microsoft.com/en-us/ecdn/how-to/purchasing#example-license-scenarios):

Scenario	Calculation	Number of licenses
A Technology company with 10,000 users with 10% of those users working from home permanently	9,000 licenses for 9,000 benefiting users	9,000
A grocery store chain with 200,000 users, 120,000 of which work in stores and never watch live events	80,000 licenses for the 80,000 corporate users/benefiting users	80,000
A telecommunication company with 50,000 users that plans to buy 30,000 Teams Premium seats	30,000 Teams Premium licenses plus 20,000 standalone Microsoft eCDN licenses	50,000
A pharmaceutical company with 70,000 users spread across three regions including North America (50,000), EMEA (10,000), APAC (10,000). IT wants to enable Microsoft eCDN in North America	50,000 licenses for the 50,000 benefiting users in North America.   Note: Microsoft eCDN needs to be disabled for EMEA & APAC via subnet mapping.	50,000

 

What Do You Need To Configure For eCDN?

To turn on eCDN you simply need to go to the Teams Admin Centre > Meetings > Live Event Settings > Video Distribution Provider > ON, and select Microsoft eCDN as the provider. In order to be able to select Microsoft you will need to have some Premium licences in your tenancy (Message: “You need Teams Premium or a Microsoft eCDN license to use some settings. Upgrade to a supporting license in the Microsoft 365 admin center. Learn more about Teams Premium”).

Once you have turned on the Microsoft eCDN you will then have access to the eCDN Portal:

https://admin.ecdn.teams.microsoft.com/

Subnet mapping

In the eCDN Portal, the primary configuration task is to set up your subnets, enabling the software to accurately determine the clients’ locations within your network environment.

This configuration allows you to specify how clients in particular subnets should behave and be grouped. Grouping subnets enables media peering between them. Whether a subnet permits media peering depends on the P2P (Peer-to-Peer) setting assigned to it. Additionally, mapping subnets facilitates per-site analytics within the eCDN portal.

The P2P setting can be ON, OFF, or LEECH. The ON and OFF settings are straightforward, indicating whether peers in these subnets will allow or disallow peering. The LEECH setting means that the subnet can only receive data from another subnet within its group that has peering enabled.

Another more complex setting is WAN. This setting allows clients to use the STUN protocol to discover their public addresses, which are then published to the eCDN as potential peers. This is an optional setting, applicable to specific use cases.

Please note that it is suboptimal for VPN users to participate in peering. It is recommended to disable peering for VPN users.

Below is a table provided by Microsoft for these settings:

Column name	Data type	Description	Guidance
Group Id	String	Your site name is displayed in the analytics. Only peers with the same Group ID can peer with each other.	Required
Subnets	CIDR	Space or comma (,) delimited network specifiers in the CIDR format (e.g. 10.0.0.0/24).	Required
P2P	Enum	Configure how users who fall under this group behave. Possible values: ·        On - Peering is enabled. ·        Off - Peering is disabled. ·        Leech - Peering is enabled in consume-only mode. Note: When formatting the CSV this entry can be in the format “p2p-on” or it can just be “on”. When you export the CSV from the system it will use the “p2p-on” formatting of this config item.	Required
WAN	Enum	Enabling WAN toggles on the STUN protocol, which allows us to create peering connections between internet users. For example, in regions with poor internet connectivity but good local bandwidth it may be better to peer between sites over the internet than sourcing directly from the cloud. Possible values: ·        On - Peering via public IP is enabled. ·        (default) Off - Peering via public IP is disabled. Note: When formatting the CSV this entry can be in the format “wan-on” or it can just be “on”. When you export the CSV from the system it will use the “wan-on” formatting of this config item.	Optional
Label	String	Labels help you identify sites more precisely. For example, you have a Group ID called "Melbourne" and within that group there's a subnet that's a WiFi network, so you could label it "WiFi-Only."	Recommended
Country	String	Manually override the country/region as determined based on the viewer's public IP address. This option is useful for viewers whose internet breakout point doesn't represent their true location.	Optional
City	String	Same behaviour and guidance as Country column.	Optional

 

Default Group Mappings:

Criteria matrix	Subnet mapping present		No subnet mapping
	Group name	p2p config	Group name	p2p config
No IP / Failed IP	Ungrouped	off	Ungrouped	off
IP supplied (no match)	Default Group	off	all	on

 

One of two significant groups could apply to your viewers even when a subnet mapping is present.

·        Ungrouped - Viewers are assigned to this P2P-off group when their eCDN client does not receive a valid IP address from the operating system. This typically occurs due to mDNS issues with the browser. For more details, please refer to the mDNS section of this post.

·        Default Group - This P2P-off group is applied to viewers who were not accounted for in the subnet mapping at the time of the event.

·        all - This group is applied when subnet mapping is not present. It includes all viewers whose eCDN client received a valid IP address from the operating system. These viewers are set to P2P-on.

 

Below is an example of the CSV file format for importing Subnet information:

GroupId,Subnets,P2P,WAN,Label,Country,City

Site A,10.0.0.0/24,p2p-on,wan-on,Melb Office,AU,Melbourne

Site B,10.1.0.0/24,p2p-on,wan-on,Syd Office,AU,Sydney

Note: You can have a maximum of 50,000 subnet entries.

 

WebRTC Browser Disable mDNS

The Microsoft documentation outlines the requirement to disable mDNS in browsers using registry keys. The initial question that arises is: what is mDNS in this context? It turns out that with WebRTC frameworks in the browser, it was possible to run a background check to discover a machine’s private IP address. This capability could potentially be exploited for monitoring or hacking purposes. Consequently, browser vendors implemented a feature that prevents JavaScript from accessing the private IP address of a machine. This is not desirable in this case, as a critical component of how eCDN functions is its need to access private IP address information to determine subnet mapping.

Upon further investigation, it appears that if users have granted microphone and camera access to the browser during the meeting setup, the mDNS IP address hiding functionality will be disabled by default. Therefore, if users enable their microphone and camera, they will be able to utilize the eCDN functionality without any issues. Below are examples of optimal settings that allow camera and microphone access:

If you run into a situation where clients are not getting linked to their group due to their IP Addresses being blocked then you can use Windows Registry settings that are specific for the browser being used: https://learn.microsoft.com/en-us/ecdn/how-to/disable-mdns

Networking

You will need to ensure that the Teams client have access to the following cloud-based web services to orchestrate this feature:

External Network Connections

Microsoft eCDN setup has some networking requirements for connecting to the eCDN services in Microsoft’s cloud:

1.      When a user browses to the event page, the client needs to download the Microsoft eCDN script - that requires an HTTPS connection to *.ecdn.teams.microsoft.com.

2.      It then creates a secure WebSocket connection to Microsoft’s eCDN backend.

3.      The peer-to-peer connection itself is a UDP connection over the port range 1025-65535, chosen randomly by the browser.

 

External Network Connections  

Hostname	Ports	Protocol	Description
*.ecdn.teams.microsoft.com	443	HTTPS over TCP	Microsoft eCDN scripts
*.ecdn.teams.microsoft.com	443	WebSocket over TCP	Microsoft eCDN backend

Internal Network Connections  

Connections that remain inside the corporate network. Usually packets in these connections don't go through a firewall and wouldn't need any configuration to allow them.

 

Hostname	Ports	Protocol	Description
n/a	1025-65535	SCTP over DTLS over UDP	P2P communication

 

Limit The Media Port Range in Browsers

The Media port range can be limited for both Microsoft Edge and Google Chrome browsers. Note: The Teams client requires ports 1025-65535 to be allowed on internal networks between peers.

·        https://chromeenterprise.google/policies/##WebRtcUdpPortRange

·        https://admx.help/?Category=EdgeChromium&Policy=Microsoft.Policies.Edge::WebRtcUdpPortRange

 

Limiting Access to the Service

To restrict eCDN access, you must specify the external public IP addresses from which clients will be accessing the Internet (i.e. the external NATed address). You do this by specifying Public IP Addresses under the Configuration > Security section. If no IPs are specified, then all users are allowed to connect from all public IPs.

Supported input formats:

•  Single IP - A single 4 octet IP. Example: 13.107.231.100
•  CIDR - A standard Classless inter-domain routing (CIDR) consisted of a start address and a subnet mask. Example: 13.107.231.0/24 (equivalent to: 13.107.231.0 - 13.107.231.255)
• JSON Format - A custom JSON format which matches the export format. Example: [ "13.107.231.0/24", "51.12.41.7/32" ]

Limitations

• IPv6 is not support at this time
• Up to 256 ranges

 

Testing eCDN

The Microsoft eCDN also provides the capability to conduct network tests to evaluate performance at scale before hosting a significant meeting on the platform. The silent test operates by running a script in the background on selected users’ machines, initiating a muted video session on the end-user’s device. This allows users to continue their work uninterrupted and unaware of the test. However, as the test imposes actual load on your networks, it should be used carefully.

To keep this post from getting too long, I will not go into all the details of setting up silent testing. If you want to know more you can find the docs here: https://learn.microsoft.com/en-us/ecdn/technical-documentation/silent-testing-framework

 

The Wrap Up

Apart from the Microsoft documentation, there is limited information available on the Microsoft eCDN service. This prompted me to conduct an in-depth exploration of the service. It offers clear advantages for organizations planning large internal Townhall meetings. Additionally, eCDN is a valuable component included with Teams Premium, especially if it is widely deployed within your organization.

For full eCDN documentation is available here for your reference: https://learn.microsoft.com/en-us/ecdn/intro

Read more →

Bulk Sign in for Microsoft Teams SIP Gateway

In 2024 we have received a new feature for Standard SIP phones on Teams which has had no fanfare whatsoever. Despite the lack of fanfare, this enhancement promises to alleviate some of the challenges associated with deploying a large number of devices on the Teams SIP Gateway. Microsoft’s official documentation doesn’t provide an exhaustive explanation of this feature, which may leave you scratching your head about exactly what it does and how it works. In this article, I’ll delve into the details, shedding light on what this feature entails. Additionally, I’ll introduce a practical tool that streamlines bulk sign-ins, making the deployment process even easier.

What is Bulk Sign-in anyway?

If you’ve ever connected a SIP Phone to Teams SIP Gateway you will know that the phone has two states:

The Signed out state: This is when your phone has been configured to connect to the provisioning servers within Microsoft’s infrastructure, but has not yet been signed into an account. In this state you’ll usually see something like this on the phone interface:

The Signed in state: In the signed in state you will see the phone number of the user on the screen and there will be whatever buttons are supported by the device. Here’s an example:

 

To transition Standard SIP phones between these states you usually have to do a sign in dance that involves a web sign-in flow, where you have to know the individual passwords for every phone account. This is both tedious and, in a lot of cases, impractical.

Are you ready to hear the cool part? What if I was to tell you that you can now bulk sign in 100 phones at a time without ever entering a password?? Well, that’s what we are talking about with the new Bulk Sign in process.

 

Prerequisites

As you can imagine, if you’re going to allow someone to sign in a bunch of phones without ever entering a password there are going to have to be some guardrails to ensure that people aren’t able to randomly sign phones in. The prerequisites are as follows:

• In addition to Teams Administrator, you must use an account that has the Global Administrator, Privileged Authentication Administrator or the Authentication Administrator role to run the cmdlets (and the Tool I've provided below). Note: You will get an “Access Denied” error when you try to run the bulk sign-in cmdlets.
• You must apply CommonAreaPhone policy to the accounts that are part of a bulk sign-in request.
• The accounts must not have Multi Factor Authentication (MFA) enabled.
• The accounts must have a phone number assigned.
• The accounts must have the SIP device Calling Policy assigned with AllowSIPDevicesCalling set to True.
• The BulkSignIn attribute must be set to Enabled in TeamsSipDevicesConfiguration policy.
• You must have Trusted IP Addresses applied for any external IP Address that Standard SIP phones will be using to access the internet.
• Account settings: The user account that is used for the device must not have User must change password at next login, or User's password can't be changed selected, or have the minimum password age set to a value more than 0.
• The phones provisioning URL must include the Azure Entra Tenant ID at the end. This is an additional “/tenantid/<your-tenant-ID-guid>” that is put at the end of the basic provisioning URL. Note: I have found if you leave this out, the error that you will receive is that the Trusted IP address is not assigned. I believe this is because it is unable to associate the phone to a tenant and by extension, the trusted IP will not be found.
• Phone accounts need a licence that includes Teams Phone capability. In most cases this will be a Microsoft Teams Shared Device Licence, but also can be standard user licensing too.

Like I said, if you expect to sign in devices without passwords you’re going to have to jump through some hoops. Here's the post from Microsoft that you can also check out: https://learn.microsoft.com/en-us/microsoftteams/sip-gateway-configure

 

Prerequisite Configuration Steps

Add the Trusted IP Address and Network Addresses in Teams Admin Centre (Locations > Network Topology):

Network Sites:

It’s not entirely clear if you need this configuration; however, you normally do for other Trusted IP configuration so I’m including it. You enter your Network Region and internal subnets:

Trusted IP Addresses:

Trusted IP Addresses are the external IP Addresses that your organisation uses to access the Internet (i.e. the external NATed IP Address of your network). This specifically needs to be the IP Address (or range) that your SIP Phones will be using to access the Internet. When they connect to the SIP Servers on the Microsoft side, the source IP Address will be noted by the service. When you request a specific Phone MAC Address to be logged in as a user account, the service will confirm that the source IP Address of the known MAC address is coming from a Trusted IP Address range.

Note: It may to 24 hours for these settings to take effect. If they haven’t, you will get an error message when you try to sign in the device that looks something like this: “Public IP IPv4 - <IP>, IPv6 -  for the device is not trusted. Please whitelist the public IP in TAC…”

 

Set the phone number:

Your phones' accounts will all need phone numbers associated with them:

Set-CsPhoneNumberAssignment -Identity CommonAreaPhone@domain.com -PhoneNumber +61399995555 -PhoneNumberType DirectRouting

 

Create a Teams IP Phone Policy for Common Area Devices and Assign it to all phones that need to be signed in:

New-CsTeamsIPPhonePolicy -Identity CommonAreaPhone -SignInMode CommonAreaPhoneSignin

Grant-CsTeamsIPPhonePolicy -Identity CommonAreaPhone@domain.com -PolicyName CommonAreaPhone

 

Create a Teams SIP Devices Configuration:

This is a new commandlet that was created specifically for the Bulk Sign-in feature. You can either assign it as a Global setting or create a User based policy that you assign directly to accounts.

#Global Setting Example

Set-CsTeamsSipDevicesConfiguration -identity Global -BulkSignIn "Enabled"

 

 

Ensure that you have a Teams Calling Policy that allows for SIP Devices to sign-in:

New-CsTeamsCallingPolicy -Identity SIPDevices -AllowSIPDevicesCalling $true -AllowCallRedirect Enabled

Grant-CsTeamsCallingPolicy -Identity CommonAreaPhone@domain.com -PolicyName SIPDevices

 

SIP Phone Provisioning:

When you prepare your SIP Phones for connection to the Teams SIP Gateway, you need to load in a provisioning URL that is slightly different than the default one. By this I mean it needs to include your Entra Tenant ID in the URL.

EMEA: http://emea.ipp.sdg.teams.microsoft.com/tenantid/<your-tenant-ID-guid>

Americas: http://noam.ipp.sdg.teams.microsoft.com/tenantid/<your-tenant-ID-guid>

APAC: http://apac.ipp.sdg.teams.microsoft.com/tenantid/<your-tenant-ID-guid>

Note: When the Tool boots it will print out what your provisioning URLs should be for your tenant. 

Bulk Sign in

Microsoft has given us some PowerShell commandlets to do the Bulk Sign in Process. The commands require that you import a CSV with the account and the MAC address of the device in it. The format for this file is as follows:

Username, HardwareId

CommonAreaPhone1@domain.com,00-04-f2-81-24-b3

CommonAreaPhone2@domain.com,00-04-f2-81-24-b4

 

The file can only contain 100 phones for each import process. So build up your CSV files with 100 devices per file. Once you have your CSV files you need to get them into the system. I found the Microsoft PowerShell here to be a bit clunky to use and I thought that I could improve the experience by building a GUI for it, so that’s what I did. Behold the Teams SIP Gateway Bulk Signin Tool:

Note: In addition to Teams Administrator, you will need to have Global Administrator, Privileged Authentication Administrator or the Authentication Administrator roles assigned to the account you use to sign the tool into PowerShell. If not, you will get an "Access Denied" error.

DOWNLOAD FROM GITHUB

 

Using the tool is dead simple - just click the Browse button and find your CSV file (as described earlier) and open it. When it’s opened, the users will be shown in the tool (the tool will also check the format of the file for you). Now all you need to do is click the “Bulk Sign In” button and the tool will handle the rest. If the phone gets signed in correctly it will change colour to green and if it fails then it will turn red.

The tool will run the New-CsSdgBulkSignInRequest command and Get-CsSdgBulkSignInRequestStatus commands for you and keep track of the batch for you until it completes.

When the tool first loads it will print out a list of the provisioning URLs for you, so you don't have to go searching for your Tenant ID and potentially make any mistakes with the formatting of the URL.

You can also Export a CSV of the results if you would like to keep that for future reference.

Note: When you download PowerShell scripts from the Internet, Microsoft Windows now requires that you open the properties and check the “Unblock” checkbox to allow it to run:

  

Error Messages Provided by Microsoft 365

Error messages that you may run into when signing your Standard SIP Phones into the system:

Error message	Potential solution
User not found in tenant.	Check the username or User Principal Name (UPN) is correct.
User missing phone number assignment.	Verify the user has a phone number assigned.
User missing AllowSIPDevicesCalling policy assignment	Verify that AllowSIPDevicesCalling policy is set to Enabled. See prerequisite 7.
User missing CAP policy assignment.	Verify that the account has CommonAreaPhone policy assigned. See prerequisite 4.
Device not found in records.	Check if the device was correctly provisioned to SIP Gateway, and the region parameter in bulk sign in request is correct.
BulkSignIn Tag missing for the device	Check to see if the device provisioning URL has the correct tenant ID.
Device is offline.	The device can't be found because it's powered off or disconnected from network. Reconnect the device and try it again.
Public IP not configured as Trusted IP.	The tenant ID listed in the provisioning URL isn't correct or the public IP address of the device isn't listed as a trusted IP address in Teams admin center. See prerequisite 1.
Bulk Sign-in deadline expired.	The device hasn't been signed in to within 72 hours of provisioning (or 168 hours).
Duplicate devices found for bulk sign-in.	Verify the MAC addresses you included in the CSV file are correct and there aren't duplicated addresses. IP addresses of the duplicate devices are returned.
Input hardware-ID is of wrong format	Verify the hardware-ID format. See How to create a bulk sign in request.
On-premises AD configuration failure.	Contact your on-premises Active Directory team.
On-premises AD throttling detected	Try it again but with a smaller number of devices in the batch. Depending on network connectivity, large batches will take more time to complete and may get stuck.
The Password writeback service failed to set a password on the tenant's local directory.	The user account that is used for the device must not have User must change password at next login or User's password can't be changed selected, OR have the minimum password age set to a value more than 0. Verify the password options aren't selected and the minimum password age is set to 0 and try again.

 

The Wrap Up

There you have it - all you should need to know about using Bulk Sign-in with Standard SIP phones on the Microsoft Teams Gateway. Enjoy the time savings!

 

Read more →