Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/11-network-and-call-quality/feature-network-qos-dscp-marking.md
feature-network-qos-dscp-marking.mdv1 · history
CurrentApplies to AllUpdated 3 weeks agoSource Microsoft Learn ↗

What it does

Teams media is pinned to known source port ranges and marked with DSCP values so the network can put audio, video and screen sharing in the right queues. The Teams admin center switch turns the markings on; the real work is matching policy on every switch, router and Wi-Fi controller in the path.

Key facts

  • Microsoft's recommended ranges and markings: audio 50000–50019 at DSCP 46 (EF); video 50020–50039 at DSCP 34 (AF41); screen sharing 50040–50059 at DSCP 18 (AF21); calling and meetings signalling 50070–50089 UDP at DSCP 40 (CS5).
  • The signalling range (50070–50089) isn't configurable.
  • Turn markings on in the Teams admin center under Meetings > Meeting settings > Network with "Insert Quality of Service (QoS) markers for real-time media traffic". The PowerShell equivalent is Set-CsTeamsMeetingConfiguration -EnableQoS $true.
  • Port ranges are set with "Specify port ranges" in the same place, or ClientMediaPortRangeEnabled plus ClientAudioPort/ClientAudioPortRange, ClientVideoPort/ClientVideoPortRange, ClientAppSharingPort/ClientAppSharingPortRange (defaults 50000/50020/50040, 20 ports each). ClientMediaPortRangeEnabled defaults to False, which means any port from 1024–65535.
  • On Windows the client marks packets via Policy-based QoS in Group Policy (Computer Configuration > Windows Settings > Policy-based QoS), keyed on the executable ms-teams.exe, landing under HKLM\Software\Policies\Microsoft\Windows\QoS.
  • macOS, iOS and Android use hard-coded markings: EF (46) for audio, AF41 (34) for both video and screen sharing. The tenant setting still has to be on.
  • Teams Rooms on Windows: configure via Intune (NetworkQoSPolicy CSP) or GPO — and with GPO, don't specify the application name, just ports and DSCP.
  • Teams Rooms on Android follow the tenant setting and also mark screen sharing as AF41 (34), not AF21. Teams phones mark audio EF (46).
  • Browser clients keep using dynamic ports, so port-based classification doesn't catch them.

When to use / skip

Implement QoS on any managed network where Teams calls share links with other traffic and you control the path end to end: campus LANs, Wi-Fi, and MPLS or SD-WAN where the carrier honours markings. It earns its keep at congested branch links and on busy Wi-Fi, which is where most "robotic voice" complaints actually come from.

Don't sell it as the fix for home workers or anything crossing the public internet — DSCP is ignored or stripped out there, and Microsoft's own guidance is that QoS only works when it's applied on every link. If the client's network is overprovisioned and CQD shows no loss or jitter, QoS is a nice-to-have rather than a priority. And if the network team can't or won't configure matching queues, marking packets on the client achieves nothing.

Configuration decisions

  • Port-based classification at the router (ACLs on the source port ranges), client-side DSCP marking, or both. Microsoft recommends both; port-based is the more reliable because it doesn't trust the endpoint.
  • Whether to keep Microsoft's default ranges or move them. Keep the defaults unless they clash with something else — everyone's documentation and every vendor's template assumes them.
  • Whether to mark screen sharing at AF21 per the Windows default or align with AF41 because Macs and Android rooms send AF41 anyway. Pick one story for the network team.
  • How Windows markings are delivered: GPO for domain-joined estates, Intune for Entra-joined ones. Most modern estates will be Intune.
  • Whether Wi-Fi controllers map DSCP to WMM access categories, and whether the carrier preserves or re-marks DSCP across the WAN.
  • Whether to trust markings from guest and BYOD VLANs.

Gotchas

  • Enabling QoS in the admin center only marks packets leaving the client. Return traffic from Microsoft arrives unmarked; you need port-based rules on the inbound side too.
  • Never leave "Automatically use any available ports" selected once you're doing QoS — the client will use anything from 1024 to 65535 and your ACLs won't match.
  • Ranges must not overlap and should be adjacent. Make them too narrow and you'll drop calls when a user has several sessions going.
  • You can move port ranges in the tenant, but the DSCP values per traffic type aren't configurable there. Marking values come from GPO/Intune on Windows; everything else is hard-coded.
  • The GPO keys on ms-teams.exe. Old policies written for classic Teams (Teams.exe) don't mark anything on the new client — check this on every migration project.
  • Don't assume Windows markings apply everywhere a laptop goes. Check a packet capture on a real device both on the corporate network and off it before you tell anyone QoS is "done".
  • Running media over a full-tunnel VPN wraps it in the tunnel, and the markings are lost with it.

Consultant notes

  • Prove it with a capture: start a call, run Wireshark on the client, and confirm DSCP 46 on audio from source ports 50000–50019. Then ask the network team to show the same packet on the WAN side.
  • Use gpresult /h on a test machine to confirm the policies landed before you chase the network.
  • Write the DSCP/port table into the low-level design and hand it to the network team verbatim. Most QoS projects fail on the handover, not the Teams side.
  • Measure before and after in CQD by building and subnet. Without building data uploaded, you can't show the improvement.
  • Teams Rooms deserve their own line in the design; their marking behaviour differs between Windows and Android.

Check the GPO still keys on ms-teams.exe after the next major client packaging change, and whether Microsoft ever lets the tenant set DSCP values directly

Was this accurate?
Related
Teams network bandwidth planning and Network Planner11-network-and-call-qualityTeams Phone Survivable Branch Appliance (SBA)03-teams-phoneTeams network readiness: connectivity test and Network Assessment Tool11-network-and-call-qualityTeams Premium meeting protection: watermarking and end-to-end encryption10-security-and-complianceTeams media flows, ports, TURN and VPN split tunnelling11-network-and-call-qualityDirect Guest Join and third-party meetings on Teams Rooms06-teams-rooms-and-devices