Configuring Pexip Infinity as a Microsoft Teams gateway

Pexip Infinity provides any-to-any video interoperability with Microsoft Teams.

It enables any video conferencing system to join Microsoft Teams meetings and allows authenticated systems to join as trusted participants without additional user interaction (i.e. lobby by-pass).

Third-party systems can connect to Teams meetings via the Pexip Distributed Gateway either via a Virtual Reception (IVR) or by dialing the conference directly.

Prerequisites

Before configuring Pexip Infinity as a Microsoft Teams gateway, you should have:

Ensuring a Microsoft Teams license is installed

You must have a teams license enabled on your platform (Platform > Licenses). It allows you to configure Microsoft Azure tenants and route calls to Microsoft Teams. The teams license controls how many Azure tenants can be configured; there is no limit to the number of Teams Connectors you can install or the number of instances within each Teams Connector.

If necessary, contact your Pexip authorized support representative to purchase the required license. Note that appropriate call licenses are also required for each gateway call that is placed into a Microsoft Teams conference.

Configuring your Microsoft Azure tenants

A Microsoft Azure tenant is a dedicated instance of Azure Active Directory (Azure AD) that your organization obtains when it signs up for a Microsoft cloud service such as Azure or Office 365. You must configure the details of your Azure tenant — your Tenant ID specifically — in Pexip Infinity and then associate your Azure tenant with your Pexip Teams Connector so that Pexip Infinity can communicate with your Teams environment.

The number of tenants you can configure is controlled by your teams license. Service providers need to obtain an appropriate number of licenses for each tenant they are managing. Multiple Azure tenants (tenant IDs) can use the same Teams Connector (you must ensure that each Tenant ID has been consented to use the Trusted and Guest Pexip apps).

To configure your Azure tenant:

  1. Go to Call control > Microsoft Azure Tenants and select Add Azure Tenant.
  2. Add the details of your tenant:

    Name The name that you specify here is used elsewhere in the Pexip Infinity interface when associating the tenant with a Teams Connector.
    Description An optional description of the Azure tenant.
    Azure tenant ID

    The Azure tenant ID where the Microsoft Teams users are homed.

    To retrieve your tenant ID from the Azure portal:

    1. Select Azure Active Directory.
    2. Under Manage, select Properties.
    3. The tenant ID is shown in the Directory ID field. You can use the Click to copy option to copy it.

    You can also check your tenant ID at https://www.whatismytenantid.com/.

  3. Select Save.

This Azure tenant is now available to associate with your Teams Connectors.

Configuring your Teams Connector addresses

All communication between Pexip Infinity and Microsoft Teams is managed by Pexip's Teams Connector hosted in Azure.

To configure the address of your Teams Connector:

  1. Go to Call control > Microsoft Teams Connectors and select Add Microsoft Teams Connector.
  2. Add the details of your Teams Connector:

    Name The name that you specify here is used elsewhere in the Pexip Infinity interface when associating the Teams Connector with a system location, Call Routing Rule or Virtual Reception.
    Description An optional description of the Teams Connector.
    Address of Teams Connector

    The FQDN of the Teams Connector to use when placing outbound calls to Microsoft Teams.

    This is the address you stored in $PxTeamsConnFqdn in the PowerShell variables initialization script, and is the FQDN (DNS name) of the Teams Connector load balancer in Azure that fronts the Teams Connector deployment e.g. pexip-TeamsConn-eu.teams.example.com.

    Port The IP port to connect to on the Teams Connector.
    Azure tenant Select the Azure tenant to associate with this Teams Connector.
  3. Select Save.

This Teams Connector is now available to associate with any system locations, Call Routing Rules or Virtual Receptions that you configure (as described below) to handle Teams conferences.

Configuring a Teams Connector per location

You can optionally configure each system location with a Teams Connector to use by default for outbound calls to Teams meetings placed from Conferencing Nodes in that location. However, you can also explicitly configure individual Virtual Receptions or Call Routing Rules with a Teams Connector that will override the system location's Teams Connector.

To configure a location with a Teams Connector:

  1. Go to Platform > Locations and select the required location.
  2. In the Microsoft Teams Connector field, select the required Teams Connector from the drop-down list, and then select Save.

Configuring Virtual Receptions and Call Routing Rules

There are two ways you can configure Microsoft Teams gateway calls within Pexip Infinity:

  • Routing indirectly via a Virtual Reception: here you configure Pexip Infinity to act as an IVR gateway or "lobby" by configuring a Virtual Reception to capture the meeting code of the required conference, and then use a Call Routing Rule (typically the same rule as used for direct routing) to route the call into the Teams conference.
  • Routing directly via the Pexip Distributed Gateway: here you only use one or more Call Routing Rules to route incoming calls for specific alias patterns — that will typically include the meeting code — directly into the relevant Teams conferences.

The meeting code for a Teams meeting is always 9 digits.

You will typically always configure the Virtual Reception indirect routing option, but depending on your requirements you may also choose to allow direct routing. The configuration required for these methods is explained below. Note that you always need to configure at least one Call Routing Rule whichever method(s) you use.

Routing indirectly via a Virtual Reception (IVR gateway)

To route calls to Teams conferences via a Virtual Reception (IVR gateway) you need:

  • A Virtual Reception configured specifically to handle Microsoft Teams conferences.
  • A Call Routing Rule to route the calls handled by the Virtual Reception into the relevant Teams conference. Typically you would configure the Virtual Reception and Call Routing Rule patterns so that the same rule can also support direct routing if required.

The Virtual Reception requests the caller to enter the Teams meeting code which it then sends to the Teams Connector for verification. You can then optionally transform the meeting code to meet any dial plan requirements, before the Pexip Distributed Gateway then matches the (optionally transformed) meeting code and routes the caller to the appropriate Teams conference.

The Virtual Reception details you enter here must correspond to the "Alternate VTC dialing instructions" that you specified in the InstructionUri switch in the New-CsVideoInteropServiceProvider command when installing the Teams Connector (see Authorize Trusted app to bypass Teams lobby and configure dialing instructions).

To configure the Virtual Reception:

  1. Go to Services > Virtual Receptions and select Add Virtual Reception.
  2. Configure the following fields (leave all other fields with default values or as required for your specific deployment):

    Option Description
    Name The name you will use to refer to this Virtual Reception, for example "Microsoft Teams IVR gateway".
    Theme If required, assign a customized theme to this Virtual Reception to brand it as the gateway to Teams conferences, for example by customizing the voice prompts or changing the appearance of the Virtual Reception splash screen.
    Virtual Reception type Select Microsoft Teams.
    Teams Connector

    Select the name of the Teams Connector to use to resolve Teams codes.

    Lookup location

    Specify the location that contains the Conferencing Nodes (typically Proxying Edge Nodes) that will communicate with the Teams Connector. These are the nodes referenced in the $PxNodeFqdns variable in the initialization script.

    Alias (#1)

    Enter the alias that users will dial to use this Virtual Reception to place calls into Teams conferences.

    This must correspond to the ivr and d parameters that were specified in the InstructionUri switch in the New-CsVideoInteropServiceProvider command when installing the Teams Connector, i.e. the alias of the Virtual Reception is ivr@d, for example teams@example.com.

  3. If you have specified the ip parameter in the InstructionUri switch in the New-CsVideoInteropServiceProvider command when installing the Teams Connector, then you must specify that IP address as an alias of this Virtual Reception.

    Select Add another Alias and add Alias (#2).

    Alias (#2) This must be the same IP address of the Conferencing Node that is specified in the ip parameter, e.g. 198.51.100.40.
  4. Select Save.

To configure the associated Call Routing Rule:

  • Configure the Call Routing Rule as described below for direct and indirect routing.
  • If you want to use a different rule for routing via a Virtual Reception than the rules you want to use for direct routing (e.g. because you want to limit the supported incoming call protocols), then follow the same principles as the direct routing rule, but use different alias patterns in your Virtual Reception's Post-lookup regex replace string and your rule's Destination alias regex match string.

Call Routing Rules for direct and indirect routing

You need to create at least one Call Routing Rule, regardless of whether you are using indirect routing, direct routing, or both. The rule(s) must match the alias that has been captured — and probably transformed — by the Virtual Reception (for indirect routing) or match the alias originally dialed by the meeting participant (for direct routing).

Setting up direct routing

As with indirect routing, if you want to route calls to Teams conferences directly via the Pexip Distributed Gateway you need:

  • To decide on an alias pattern that participants will dial to access the Teams conferences. The alias pattern will typically include the 9-digit meeting code, for example the pattern could be just <meeting code> or <meeting code>@<domain>, for example 234567890@example.com to access a Teams conference with a meeting code of 234567890.
    See Dial plan conflicts if you have a more complicated dial plan to consider.
  • A Call Routing Rule that matches that alias pattern and, if necessary, transforms it such that it contains just the Teams meeting code which it can then use to connect to the conference.

Setting up the rule for direct and indirect routing

In the examples used here, the alias pattern that the rule needs to match is <meeting code> or <meeting code>@<domain> in both the indirect and direct routing scenarios. For direct routing this is the alias format that is dialed, and for indirect routing it is simply the meeting code that is captured by the Virtual Reception.

The other consideration you must make when configuring your rule is whether the participant is trusted and therefore can be admitted directly into the Teams meeting (bypassing the Teams lobby) or whether the participant is untrusted and therefore has to be admitted into the meeting by an existing participant (held in the Teams lobby). You can decide to treat all participants as either trusted or untrusted if that is appropriate for your environment.

If you need to distinguish between trusted and untrusted participants, you must set up at least two Call Routing Rules where, typically, the first rule is configured to match participants who meet your trusted criteria, and the second rule could simply be those participants who did not match the first rule (and are therefore untrusted). The rule configuration options that you are most likely to use to determine whether it is a trusted participant or not are:

  • Calls being handled in location: participants who are on an internal network for example, and whose calls are being handled by Conferencing Nodes in specific locations could be considered as trusted. Calls being received by Conferencing Nodes in locations that receive calls from an outside network or DMZ could be treated as external guest participants and thus not trusted.
  • Match incoming calls from registered devices only: you could choose to trust any call being placed from a device that is registered to Pexip Infinity.

For rules configured to match against trusted participants, you should enable the rule's Treat as trusted option, which would cause Pexip Infinity to use the Trusted app to route the call into the Teams meeting (see Authorize Trusted app to bypass Teams lobby and configure dialing instructions for more information). The Guest app is used if the rule does not have Treat as trusted enabled.

The other important rule configuration option to consider is:

  • Priority: a number that determines the order in which the rules attempt to match the properties of the incoming call. Rules are processed in ascending number order, therefore, for example, you should ensure that any rules with Match incoming calls from registered devices only selected have a higher priority (lower number) than those rules where it is not selected. This is to avoid the call matching first against the "not selected" rule if all of the other rule settings are the same. Pexip Infinity's rule matching logic stops as soon as a matching rule is found, and this is why we recommend that your higher priority rules handle the "trusted" matching criteria first.

    You can configure multiple "trusted" rules and multiple "untrusted" rules if necessary — if you have a complicated dial plan, for example, but we always recommended that you give your "trusted" rules a higher priority (lower number).

To configure your Call Routing Rules:

  1. Go to Services > Call routing and select Add Call Routing Rule.
  2. The following table shows the fields to configure for your Call Routing Rule, and shows example values for three rules:

    • Rule #1: treats all devices on your enterprise network (handled by Conferencing Nodes in your "Internal network" location) as trusted.
    • Rule #2: treats any device that is registered to Pexip Infinity as trusted (regardless of the source location of the call).
    • Rule #3: treats any other call (not matching rule #1 or rule #2) as coming from an untrusted device.

    (Leave all other fields with default values or as required for your specific deployment.)

    Option Description Rule #1 Rule #2 Rule #3
    Name The name you will use to refer to this rule. "Enterprise network" "Registered devices" "Unknown/guest"
    Priority Assign the priority for this rule. 20 40 60
    Incoming gateway calls Ensure this option is selected.
    Outgoing calls from a conference Leave unselected.
    Calls being handled in location

    Applies the rule only if the incoming call is being handled by a Conferencing Node in the selected location.

    To apply the rule regardless of the location, select Any Location.

    "Internal network" location Any location Any location
    Match incoming calls from registered devices only Select this option if you want this rule to only apply to calls placed from devices that are registered to Pexip Infinity. You will typically use this option in conjunction with the rule's Treat as trusted setting.
    Match Infinity Connect
    Match SIP
    Match Lync / Skype for Business (MS-SIP) /
    Match H.323

    Select one or more of Match Infinity Connect (WebRTC / RTMP), Match SIP, Match Lync / Skype for Business (MS-SIP) and Match H.323 as appropriate, depending on which types of systems/protocols you want to offer interoperability into Teams.

    Select these options as appropriate
    Match against full alias URI Leave unselected.
    Destination alias regex match

    Enter a regular expression that will match the calls to be sent to a Teams conference.

    For example, to match an alias in the form <meeting code> or <meeting code>@example.com, you could use:

    (\d{9})(@example\.com)?

    (Note that Teams meeting codes are always 9 digits long. Putting ( )? around the @domain part of the regex makes that part of the dial string optional.)

    (\d{9})(@example\.com)?
    Destination alias regex replace string

    If required, enter the regular expression string to transform the originally dialed (matched) alias into the 9-digit meeting code to use to place the call into the Teams conference. If you do not need to change the alias, leave this field blank.

    When used with the example Destination alias regex match shown above you would use:

    \1

    which would extract just the <meeting code> element of the alias.

    \1
    Call capability

    To support incoming calls via SIP, H.323 and WebRTC/RTMP, Same as incoming call is recommended as this makes the most efficient use of Pexip Infinity resources.

    If you also want to support calls from Skype for Business / Lync, then you should select Main video + presentation instead to ensure that any SfB/Lync participants are able to escalate from audio-only to a video call after joining the conference (alternatively you can configure a separate rule just for matching incoming calls from Skype for Business / Lync and set that rule to use Main video + presentation).

    Select these options as appropriate
    Theme If required, assign a customized theme to this rule (which will then be used for callers that use this rule to gateway into Teams). For example, the theme could use alternative labels on some of the splash screens that are displayed when connecting to a conference. Select these options as appropriate
    Call target Select Microsoft Teams meeting. Microsoft Teams meeting
    Outgoing location

    Specify the location that contains the Conferencing Nodes (typically Proxying Edge Nodes) that will communicate with the Teams Connector. These are the nodes referenced in the $PxNodeFqdns variable in the initialization script.

    Select the location that contains the Conferencing Nodes that are referenced in the $PxNodeFqdns variable in the initialization script
    Teams Connector

    You can optionally select the Teams Connector you want to handle the call. If you do not specify anything, the Teams Connector associated with the outgoing location is used.

    Leave unselected
    Treat as trusted

    Select Treat as trusted if you want Teams to treat the devices routed via this rule as part of the target organization for trust purposes.

    Typically you will select this option if the rule is handling devices that are trusted from Pexip Infinity's perspective, for example, you could treat the device as trusted if the caller is coming from a specific location, or if the device is registered to Pexip Infinity.

    Trusted participants are automatically admitted into a Teams conference.

  3. Select Save.
  4. Repeat the above steps adding your second and subsequent rules as appropriate.

Using the Microsoft Teams IVR gateway service

After the Virtual Reception and Call Routing Rule have been configured, third-party systems and devices can now dial the alias of the Virtual Reception (e.g. teams@example.com) and then, when prompted by the IVR service, enter the meeting code of the Teams conference they want to join. The Pexip Distributed Gateway will then route the call into the appropriate Teams conference.

Using the direct gateway service

After the Call Routing Rule has been configured, third-party systems and devices can now dial an alias that matches your specified pattern (e.g. 234567890@example.com) to be routed directly into the appropriate Teams conference (in this example the conference with a meeting code of 234567890).

Dial plan conflicts

If the 9-digit Teams meeting code and <meeting code>@<domain> style aliases might overlap with your existing dial plan, you can use something more specific for your aliases such as teams.<meeting code>@<domain> i.e. "teams." followed by the meeting code and then the domain of your Pexip Infinity platform, for example teams.234567890@example.com.

In this case you would need to make the following adjustments to your Virtual Reception and Call Routing Rules (based on our examples above):

  • In your Virtual Reception:

    • set Post-lookup regex match to (.*)
    • set Post lookup regex replace string to teams.\1@example.com

    which will match everything entered into the Virtual Reception (which will be the meeting code), and then prefix it with "teams." and append the "@example.com" domain, thus creating an alias in the form teams.<meeting code>@<domain>.

    For example, if the caller enters 121212121 into the Virtual Reception the post-lookup match and replace strings shown here will convert that into teams.121212121@example.com which then needs to be matched by your Call Routing Rule.

  • In your Call Routing Rule(s):

    • set Destination alias regex match to teams\.(\d{9})@example\.com
    • leave Destination alias regex replace string set to \1

    which will match the alias pattern produced by the Virtual Reception and the new extended direct routing alias format.

With these changes, callers dialing the meeting directly would need to use this extended format of teams.<meeting code>@<domain>, but there is no change to callers going indirectly via the Virtual Reception (they would still dial teams@example.com and then enter the meeting ID as before).

You also need to configure a different set of "Alternate VTC dialing instructions" to use the prefix parameter to append "teams." to the displayed direct-dial addresses. In this case, our example New-CsVideoInteropServiceProvider command would look like this:

New-CsVideoInteropServiceProvider -Name Pexip -TenantKey "teams@example.com" -InstructionUri "https://px.vc.example.com/teams/?conf={ConfId}&ivr=teams&d=example.com&ip=198.51.100.40&test=test_call&prefix=teams.&w" -AllowAppGuestJoinsAsAuthenticated $true -AadApplicationIds "c054d1cb-7961-48e1-b004-389e81356232"

If you have already configured the dialing instructions webpage, you can use the Set-CsVideoInteropServiceProvider command to amend it (see Changing the alternative dialing instructions).

Interoperability and deployment features

DNS and ports requirements

You need to ensure that the endpoints and systems you want to gateway into Microsoft Teams can call into Pexip Infinity Conferencing Nodes, and that Conferencing Nodes can call out to Microsoft Teams.

Call and participant status

When using the Pexip Infinity Administrator interface to monitor calls that are placed into Teams conferences, you should note that:

  • Each participant who is gatewayed into a Teams conference is listed as a separate gateway call. However, if multiple participants are connected to the same Teams conference, the Live View (Status > Live View) will show them as connected to the same external conference — which is identified as "Teams meeting <meeting code>".
  • When viewing the status of the gateway call (Status > Conferences), the Participants tab also lists the other participants in the conference. The format of their alias indicates the type of participant:

    • user:<id> represents another Teams client in the call
    • trusted:<id> represents another gatewayed participant who joined as a trusted participant
    • guest:<id> represents another gatewayed participant who joined as an untrusted participant

    These other participants do not have any associated media stream information.

    Note that only the gatewayed participant is shown as consuming a port license. The outbound leg of the gateway call (into the Teams Connector), which consumes the second license of each gateway call, is not represented in the participant list.

    The media streams associated with the call into the Teams meeting are shown against the conference backplane:

    • There is one audio stream and multiple video streams.
    • Multiple video streams are set up to receive video from the Teams Connector to support the Pexip conference layout seen by gatewayed participants; if there are fewer participants than streams then the currently unused streams are shown as "Off stage".
    • Pexip Infinity may simultaneously send up to 3 video streams at different resolutions to the Teams Connector, as requested by Teams.
    • You also see a presentation stream if any participant is sharing content.

  • You cannot control (e.g. disconnect, mute or transfer) any of the other participants connected to the Teams conference.

Additional information

  • Each participant who is gatewayed via Pexip Infinity into a Teams conference consumes two call licenses (one for the inbound leg of the call and one for the outbound leg, as is standard for calls via the Pexip Distributed Gateway calls). Any external participants who are connected directly to the Teams conference do not consume a license. See Pexip Infinity license installation and usage for more information.
  • Content sharing is supported between Teams clients (via VbSS) and gatewayed participants.
  • You cannot limit the Maximum outbound call bandwidth (the call leg towards the Teams Connector) — it is managed automatically by Pexip Infinity.
  • If the Teams conference is recorded, recording indicators are included in the video stream sent to gatewayed participants.