What it does

Media bypass takes the Microsoft media processors out of the RTP path, so audio runs directly between the Teams client and the SBC while signalling still goes via the cloud. Local Media Optimization builds on it using your Teams network sites, so internal users send media to the SBC's private IP and branch calls can be steered via a proxy SBC to downstream SBCs that Microsoft never sees.

Key facts

• Enable per gateway: Set-CsOnlinePSTNGateway -Identity <FQDN> -MediaBypass $true.
• The SBC needs a public IP reachable by clients and must support ICE Lite. Clients use full ICE.
• Client media ports are UDP 50000–50019 to the SBC's own range. When the client can't reach the SBC directly, Teams Transport Relays are used: relay ports 50000–59999, plus 3478–3481 from the SBC to the relays.
• Supported endpoints: Teams desktop, iOS and Android, and Teams phones. The Teams web client isn't supported for bypass.
• Media processors get re-inserted when a call escalates to a group call, goes to a federated user, or is transferred to Skype for Business. Transport relays don't transcode; media processors do.
• Media bypass isn't supported on IPv6 gateways.
• LMO needs network regions, sites and subnets (New-CsTenantNetworkSite, New-CsTenantNetworkSubnet) and trusted IPs (New-CsTenantTrustedIPAddress), plus Set-CsOnlinePSTNGateway -GatewaySiteID ... -BypassMode Always|OnlyForLocalUsers -ProxySBC ... -GatewaySiteLbrEnabled.
• Always: internal users always get the SBC's internal IP. OnlyForLocalUsers: internal IP only when the user is at the same site as that downstream SBC — everyone else goes through the proxy.
• A client whose public IP is in the trusted list but whose subnet isn't in any network site is not treated as internal.
• With LMO, internal users need to reach the SBC's internal IP — there's no fallback to transport relays.
• Both proxy and downstream SBCs must be certified for LMO. Record-Route is only needed when a proxy SBC is used with LMO.

When to use / skip

Turn on media bypass on most enterprise deployments where the SBC sits in a data centre or Azure and users are on a corporate WAN. Fewer hops and the media stays off Microsoft's processors for 1:1 PSTN calls. Skip it where the SBC can't present a public IP, where a carrier-hosted SBC doesn't support it, or where you need AMR-WB or other non-bypass features.

LMO is a heavier commitment. If you already have media bypass working with public SBC IPs, Learn says outright you don't need to migrate. Use LMO when the client wants media to stay inside the WAN, has SBCs with private IPs only, or runs a hub-and-spoke model of a central proxy SBC with branch SBCs carrying local trunks. It's also the starting point for Location-Based Routing in toll-bypass-restricted countries.

Configuration decisions

• Bypass on every trunk, or a pilot trunk first? The pattern on Learn — a second FQDN on a different TLS port on the same SBC — is the clean way.
• Hair-pinning on the NAT so internal clients hitting the SBC's public IP don't leave the network.
• For LMO: Always vs OnlyForLocalUsers per downstream SBC — decided by how good the inter-site WAN is.
• Which SBC is the proxy and how many downstreams hang off it.
• Who owns the network site and subnet data — the voice team, the network team, or whoever looks after CQD building data. It needs to be one source of truth.
• Whether LMO's network sites double up for Location-Based Routing and dynamic emergency calling.

Gotchas

• Client firewall policies blocking 50000–50019 outbound make bypass "work" via relays, which hides the problem until a quality complaint.
• LMO has a documented few seconds of silence at call setup. Warn users before go-live or you'll get it raised as a fault.
• Hold and resume escalates the call, so after resume it leaves LMO and runs via the proxy SBC. Same for adding a third party.
• Auto attendant and call queue calls run via the proxy SBC and stay off the local path — except the leg transferred from the voice app to an LMO user.
• Missing subnets in network sites flip users to "external" silently. Every trusted IP needs matching site coverage.
• SDP with full ICE candidate lists can push SIP messages past about 1,500 bytes. Strip candidates and unused codecs before passing to a UDP carrier trunk.

Consultant notes

• Verify bypass by checking the SBC media IPs in a call trace, not by trusting the config flag.
• For LMO, get the SBC vendor's LMO config guide alongside Learn — the X-MS headers and site mapping on the SBC side are where most of the work is.
• Build the site/subnet data once in a spreadsheet and script it into tenant network settings. Reuse it for CQD and emergency calling.
• Test from home, from a branch, from HQ and over VPN. Each one takes a different media path.

---

Recheck the LMO limitations list after any SBC firmware upgrade or announced Direct Routing media changes