What it does

A small piece of Microsoft code that runs on, or next to, a Direct Routing SBC at a branch. When the site loses its internet connection to Microsoft 365, Teams clients there fail over to the SBA and can keep making and receiving PSTN calls through the local SBC until the link comes back.

Key facts

• Microsoft supplies the SBA code to SBC vendors; it's delivered as part of their platform. Learn lists AudioCodes, Ribbon, Oracle and TE-Systems (anynode).
• It's Direct Routing only — the SBC has to be the PSTN breakout at the branch — and the SBC must be configured for media bypass.
• Supported clients: Teams desktop on Windows and macOS, and Teams phones. Desktop clients only switch to SBA mode on physical machines — VDI/VM clients and the web client are not supported.
• In SBA mode users get: PSTN calls in and out via the local SBC, hold/resume, blind transfer, call forwarding and unanswered forwarding to a single number or Teams user, redirect of inbound calls aimed at a queue or auto attendant to a local agent or alternative target, VoIP fallback to PSTN, and VoIP between users on the same SBA.
• Configuration is PowerShell only — the Teams admin center doesn't support it. Cmdlets: New-CsTeamsSurvivableBranchAppliance (-Fqdn, -Site, -Description), New- / Set-CsTeamsSurvivableBranchAppliancePolicy (-BranchApplianceFqdns) and Grant-CsTeamsSurvivableBranchAppliancePolicy.
• You need one Entra ID app registration per tenant for all SBAs, with the API permission application_access_custom_sba_appliance under Skype and Teams Tenant Admin Access, and the client ID and secret go into the SBA configuration.
• Ports: 3443, 4444 and 8443 between client and SBA; 5061 (or your configured port) between SBA and SBC; UDP 123 to NTP; 443 to Microsoft 365. TLS 1.2 is required on the SBA host.
• Clients accept expired tokens for up to seven days, and can re-authenticate from a locally cached token after a restart — but only if they connected to that SBA in the last 24 hours.
• If the tenant uses Continuous Access Evaluation, SBA only stays usable for about 30 minutes.
• Not supported in SBA mode: emergency call routing policies and location sharing for emergency calls, reverse number lookup against Entra ID contacts, and switching the client to another tenant.
• Users see a banner in the client when they're in SBA mode. No banner means no SBA, and no calling.

When to use / skip

SBA is for branches where PSTN calling has to keep working during a WAN or internet outage and there's a local SBC handling breakout anyway — hospitals, manufacturing sites, retail stores, branch offices in countries with patchy connectivity. If the business case says "the phones must work when the internet's down" and the answer isn't "use your mobile", this is the native way to do it.

Skip it if the site uses Calling Plans or Operator Connect — there's no local SBC for it to talk to. Skip it if most users are on VDI; they won't fail over. And be honest about what survives: basic calling, hold and blind transfer. Queues, voicemail, presence, chat and meetings don't. Many clients find a cheaper answer in a second internet circuit or 4G/5G backup on the router.

Configuration decisions

• Which sites genuinely justify SBA versus resilient internet links.
• One SBA per site or several in a policy for resilience; the policy accepts multiple FQDNs.
• How users map to SBA policies — usually by site, assigned through group-based policy assignment tied to location.
• The SBC routing for local breakout and how emergency calls are handled during an outage, given emergency call routing policies aren't applied.
• Whether CAE is in use, and if so whether a 30-minute survivability window is acceptable.
• Certificate, DNS and firewall ownership for the SBA FQDN on the local network.

Gotchas

• Emergency calling is the big one. In SBA mode emergency dial strings bypass normalisation, so if no pattern matches in the regular voice routing policy the call fails. Test 999/112 through the SBA explicitly — this needs sign-off from the client's risk owner.
• CAE quietly cuts survivability to around half an hour. Find out early if the security team has it on.
• Users who haven't connected to the SBA in the last 24 hours can't validate against it. A new starter or someone back from holiday on outage day may get nothing.
• VDI users and anyone on the web client simply don't fail over. Branches with a lot of thin clients get much less out of SBA than the diagram suggests.
• New SBAs and policy assignments take time to appear and propagate; don't test failover the same afternoon you configure it.
• No admin centre support means the configuration lives only in PowerShell and the SBC — document it properly or nobody will find it later.

Consultant notes

• Pull the internet link and test properly: inbound, outbound, transfer, forwarding and emergency calls, on desktop and Teams phones. Do it before go-live and again after major SBC upgrades.
• Write the outage user guide around the banner — "if you see the banner, you can make basic calls; if you don't, use your mobile".
• Agree up front which vendor's SBA build you're on and how it's patched; it follows the SBC vendor's release cycle, not Microsoft's.
• Set expectations in the design document about what doesn't work in SBA mode. It's survival calling, not business as usual.

---

Worth rechecking the supported-features list and the CAE limitation after each SBC vendor's SBA release — and whether the admin centre ever picks up SBA configuration