Configuring Pexip Infinity as a Microsoft Teams gateway

Before configuring Pexip Infinity as a Microsoft Teams gateway, you should have:

• Performed a basic installation of the Pexip Infinity platform — see Pexip Infinity installation guidelines for complete information about all of the environments into which you can deploy the Pexip Infinity platform.
• Installed the Pexip Teams Connector as described in Installing and configuring the Teams Connector in Azure.

If necessary, contact your Pexip authorized support representative to purchase the required license. Note that appropriate call licenses are also required for each gateway call that is placed into a Microsoft Teams conference.

Go to Platform > Global settings and in the Connectivity section ensure that Enable support for Pexip Infinity Connect clients and Client API is selected.

The number of tenants you can configure is controlled by your teams license. Service providers need to obtain an appropriate number of licenses for each tenant they are managing. Multiple Teams tenants (tenant IDs) can use the same Teams Connector (you must ensure that each Tenant ID has been consented to use the Pexip CVI app).

To configure your Teams tenant:

1. Go to Call control > Microsoft Teams Tenants and select Add Teams Tenant.

2. Add the details of your tenant:

   Name	The name that you specify here is used elsewhere in the Pexip Infinity interface when associating the tenant with a Teams Connector.
   Description	An optional description of the Teams tenant.
   Teams tenant ID	The Office 365 tenant ID where the Microsoft Teams users are homed. To retrieve your tenant ID from the Azure portal: Select Azure Active Directory. Under Manage, select Properties. The tenant ID is shown in the Directory ID field. You can use the Click to copy option to copy it. You can also check your tenant ID at https://www.whatismytenantid.com/.

3. Select Save.

This Teams tenant is now available to associate with your Teams Connectors.

To configure the address of your Teams Connector and decide whether to enable the Azure Event Hub (for scheduled scaling and enhanced status reporting):

1. Go to Call control > Microsoft Teams Connectors and select Add Microsoft Teams Connector.

2. Add the details of your Teams Connector:

   Name	The name that you specify here is used elsewhere in the Pexip Infinity interface when associating the Teams Connector with a system location, Call Routing Rule or Virtual Reception.
   Description	An optional description of the Teams Connector.
   Address of Teams Connector	The FQDN of the Teams Connector to use when placing outbound calls to Microsoft Teams. This is the address you stored in $PxTeamsConnFqdn in the PowerShell variables initialization script, and is the FQDN (DNS name) of the Teams Connector load balancer in Azure that fronts the Teams Connector deployment e.g. pexip-teamsconn-eu.teams.example.com.
   Port	The IP port to connect to on the Teams Connector.
   Teams tenant	Select the Teams tenant to associate with this Teams Connector.
   Enable Azure Event Hub	When enabled, this provides the ability to create scheduled scaling policies, and also provides enhanced status information for each Teams Connector node, such as call capacity and current media load.
   Azure Event Hub connection string	When the Azure Event Hub is enabled you need to specify its connection string. The connection string is in the format Endpoint=sb://examplevmss-lltsgzoqun-ehn.servicebus.windows.net/;SharedAccessKeyName=pexip_teams_connector_access;SharedAccessKey=[string] To find this string in the Azure portal: Go to the static resource group for the Teams Connector (this has a name in the format <prefix>-TeamsConn-<optional version>-<region>-static-RG). Select the Event Hubs Namespace component (<name>-EHN). From the left-hand navigation menu, under Settings select Shared access policies. Select the pexip_teams_connector_access policy. Copy the Connection string–primary key. You can also obtain it via the following PowerShell script (you must run your variables initialization script first): Copy to clipboard $eventHub = (Get-AzResource -ResourceGroupName $PxTeamsConnStaticResourceGroupName -ResourceType Microsoft.EventHub/namespaces)[0] $eventHubKey = Get-AzEventHubKey -Name "pexip_teams_connector_access" -NamespaceName $eventHub.Name -ResourceGroupName $eventHub.ResourceGroupName Write-Host "The Azure Event Hub connection string' for $($PxTeamsConnFqdn) is: $($eventHubKey.PrimaryConnectionString)"
   Minimum number of instances	The minimum required number of instances in the Teams Connector scale set. This setting only applies when the Azure Event Hub is enabled, and is the number of instances that are always running when there are no scaling policies in effect (it overrides the manual scaling settings in the Azure portal). See Scheduling scaling and managing Teams Connector capacity for more information. If you increase this setting it can temporarily raise the "Scheduled scaling: some or all of the requested Teams Connector instances are not operational" alarm. It will last for a few minutes until the new instances are up and running. This is expected behavior and can occur with or without any scheduled scaling policies. Default: 1

3. Select Save.

This Teams Connector is now available to associate with any system locations, Call Routing Rules or Virtual Receptions that you configure (as described below) to handle Teams conferences.

To configure a location with a Teams Connector:

1. Go to Platform > Locations and select the required location.
   

2. In the Microsoft Teams Connector field, select the required Teams Connector from the drop-down list, and then select Save.

   

There are two ways you can configure Microsoft Teams gateway calls within Pexip Infinity:

• Routing indirectly via a Virtual Reception: here you configure Pexip Infinity to act as an IVR gateway or "lobby" by configuring a Virtual Reception to capture the Conference ID of the required conference, and then use a Call Routing Rule (typically the same rule as used for direct routing) to route the call into the Teams conference.
• Routing directly via the Infinity Gateway: here you only use one or more Call Routing Rules to route incoming calls for specific alias patterns — that will typically include the Conference ID — directly into the relevant Teams conferences.

The Conference ID for a Teams meeting is between 9 and 12 digits long.

You will typically always configure the Virtual Reception indirect routing option, but depending on your requirements you may also choose to allow direct routing. The configuration required for these methods is explained below. Note that you always need to configure at least one Call Routing Rule whichever method(s) you use.

Routing indirectly via a Virtual Reception (IVR gateway)

To route calls to Teams conferences via a Virtual Reception (IVR gateway) you need:

• A Virtual Reception configured specifically to handle Microsoft Teams conferences.
• A Call Routing Rule to route the calls handled by the Virtual Reception into the relevant Teams conference. Typically you would configure the Virtual Reception and Call Routing Rule patterns so that the same rule can also support direct routing if required.

The Virtual Reception requests the caller to enter the Teams Conference ID which it then sends to the Teams Connector for verification. You can then optionally transform the Conference ID to meet any dial plan requirements, before the Infinity Gateway then matches the (optionally transformed) Conference ID and routes the caller to the appropriate Teams conference.

The Virtual Reception details you enter here must correspond to the "Alternate VTC dialing instructions" that you specified in the InstructionUri switch in the New-CsVideoInteropServiceProvider command when installing the Teams Connector (see Authorize trusted app to bypass Teams lobby and configure dialing instructions).

To configure the Virtual Reception:

1. Go to Services > Virtual Receptions and select Add Virtual Reception.

2. Configure the following fields (leave all other fields with default values or as required for your specific deployment):

   Option	Description
   Name	The name you will use to refer to this Virtual Reception, for example "Microsoft Teams IVR gateway".
   Theme	If required, assign a customized theme to this Virtual Reception to brand it as the gateway to Teams conferences, for example by customizing the voice prompts or changing the appearance of the Virtual Reception splash screen.
   Virtual Reception type	Select Microsoft Teams.
   Teams Connector	Select the name of the Teams Connector to use to resolve Teams codes.
   Lookup location	Specify the location that contains the Conferencing Nodes (typically Proxying Edge Nodes) that will communicate with the Teams Connector. These are the nodes referenced in the $PxNodeFqdns variable in the initialization script.
   Alias (#1)	Enter the alias that users will dial to use this Virtual Reception to place calls into Teams conferences. This must correspond to the ivr and d parameters that were specified in the InstructionUri switch in the New-CsVideoInteropServiceProvider command when installing the Teams Connector, i.e. the alias of the Virtual Reception is ivr@d, for example teams@example.com.

3. If you have specified the ip parameter in the InstructionUri switch in the New-CsVideoInteropServiceProvider command when installing the Teams Connector, then you must specify that IP address as an alias of this Virtual Reception.

   Select Add another Alias and add Alias (#2).

   Alias (#2)

   This must be the same IP address of the Conferencing Node that is specified in the ip parameter, e.g. 198.51.100.40.

4. Select Save.

To configure the associated Call Routing Rule:

• Configure the Call Routing Rule as described below for direct and indirect routing.
• If you want to use a different rule for routing via a Virtual Reception than the rules you want to use for direct routing (e.g. because you want to limit the supported incoming call protocols), then follow the same principles as the direct routing rule, but use different alias patterns in your Virtual Reception's Post-lookup regex replace string and your rule's Destination alias regex match string.

Call Routing Rules for direct and indirect routing

You need to create at least one Call Routing Rule, regardless of whether you are using indirect routing, direct routing, or both. The rule(s) must match the alias that has been captured — and probably transformed — by the Virtual Reception (for indirect routing) or match the alias originally dialed by the meeting participant (for direct routing).

Setting up direct routing

As with indirect routing, if you want to route calls to Teams conferences directly via the Infinity Gateway you need:

• To decide on an alias pattern that participants will dial to access the Teams conferences. The alias pattern will typically include the 9 to 12-digit Conference ID, for example the pattern could be just <conference ID> or <conference ID>@<domain>, for example 234567890@example.com to access a Teams conference with a Conference ID of 234567890.
  See Dial plan conflicts if you have a more complicated dial plan to consider.
• A Call Routing Rule that matches that alias pattern and, if necessary, transforms it such that it contains just the Teams Conference ID which it can then use to connect to the conference.

Setting up the rule for direct and indirect routing

In the examples used here, the alias pattern that the rule needs to match is <conference ID> or <conference ID>@<domain> in both the indirect and direct routing scenarios. For direct routing this is the alias format that is dialed, and for indirect routing it is simply the Conference ID that is captured by the Virtual Reception.

The other consideration you must make when configuring your rule is whether the participant is trusted and therefore can be admitted directly into the Teams meeting (bypassing the Teams lobby) or whether the participant is untrusted and therefore has to be admitted into the meeting by an existing participant (held in the Teams lobby). You can decide to treat all participants as either trusted or untrusted if that is appropriate for your environment.

If you need to distinguish between trusted and untrusted participants, you must set up at least two Call Routing Rules where, typically, the first rule is configured to match participants who meet your trusted criteria, and the second rule could simply be those participants who did not match the first rule (and are therefore untrusted). The rule configuration options that you are most likely to use to determine whether it is a trusted participant or not are:

• Calls being handled in location: participants who are on an internal network for example, and whose calls are being handled by Conferencing Nodes in specific locations could be considered as trusted. Calls being received by Conferencing Nodes in locations that receive calls from an outside network or DMZ could be treated as external guest participants and thus not trusted.
• Match incoming calls from registered devices only: you could choose to trust any call being placed from a device that is registered to Pexip Infinity.

For rules configured to match against trusted participants, you should enable the rule's Treat as trusted option, which would cause Pexip Infinity to route the call directly into the Teams meeting (see Authorize app to bypass Teams lobby and configure dialing instructions for more information). The call is held in the meeting lobby if the rule does not have Treat as trusted enabled.

The other important rule configuration option to consider is:

• Priority: a number that determines the order in which the rules attempt to match the properties of the incoming call. Rules are processed in ascending number order, therefore, for example, you should ensure that any rules with Match incoming calls from registered devices only selected have a higher priority (lower number) than those rules where it is not selected. This is to avoid the call matching first against the "not selected" rule if all of the other rule settings are the same. Pexip Infinity's rule matching logic stops as soon as a matching rule is found, and this is why we recommend that your higher priority rules handle the "trusted" matching criteria first.

  You can configure multiple "trusted" rules and multiple "untrusted" rules if necessary — if you have a complicated dial plan, for example, but we always recommended that you give your "trusted" rules a higher priority (lower number).

To configure your Call Routing Rules:

1. Go to Services > Call routing and select Add Call Routing Rule.

2. The following table shows the fields to configure for your Call Routing Rule, and shows example values for three rules:

   • Rule #1: treats all devices on your enterprise network (handled by Conferencing Nodes in your "Internal network" location) as trusted.
   • Rule #2: treats any device that is registered to Pexip Infinity as trusted (regardless of the source location of the call).
   • Rule #3: treats any other call (not matching rule #1 or rule #2) as coming from an untrusted device.

   (Leave all other fields with default values or as required for your specific deployment.)

   Option	Description	Rule #1	Rule #2	Rule #3
   Name	The name you will use to refer to this rule.	"Enterprise network"	"Registered devices"	"Unknown / guest"
   Priority	Assign the priority for this rule.	20	40	60
   Incoming gateway calls	Ensure this option is selected.	☑	☑	☑
   Outgoing calls from a conference	Leave unselected.	☐	☐	☐
   Calls being handled in location	Applies the rule only if the incoming call is being handled by a Conferencing Node in the selected location. To apply the rule regardless of the location, select Any Location.	"Internal network" location	Any location	Any location
   Match incoming calls from registered devices only	Select this option if you want this rule to only apply to calls placed from devices that are registered to Pexip Infinity. You will typically use this option in conjunction with the rule's Treat as trusted setting.	☐	☑	☐
   Match Infinity Connect Match SIP Match Lync / Skype for Business (MS-SIP) / Match H.323 / (Match Teams)	Select one or more of the match options as appropriate, depending on which types of systems/protocols you want to offer interoperability into Teams.	Select these options as appropriate
   Match against full alias URI	Leave unselected.	☐	☐	☐
   Destination alias regex match	Enter a regular expression that will match the calls to be sent to a Teams conference. For example, to match an alias in the form <conference ID> or <conference ID>@example.com, you could use: (\d{9,12})(@example\.com)? (Note that Teams Conference IDs are between 9 and 12 digits long. Putting ( )? around the @domain part of the regex makes that part of the dial string optional.)	(\d{9,12})(@example\.com)?
   Destination alias regex replace string	If required, enter the regular expression string to transform the originally dialed (matched) alias into the 9 to 12-digit Conference ID to use to place the call into the Teams conference. If you do not need to change the alias, leave this field blank. When used with the example Destination alias regex match shown above you would use: \1 which would extract just the <conference ID> element of the alias.	\1
   Call capability	To support incoming calls via SIP, H.323 and WebRTC/RTMP, Same as incoming call is recommended as this makes the most efficient use of Pexip Infinity resources. If you also want to support calls from Skype for Business / Lync, then you should select Main video + presentation instead to ensure that any SfB/Lync participants are able to escalate from audio-only to a video call after joining the conference (alternatively you can configure a separate rule just for matching incoming calls from Skype for Business / Lync and set that rule to use Main video + presentation).	Select these options as appropriate
   Maximum call quality	Controls the maximum call quality for participants connecting to this service: Use global setting: use the global maximum call quality setting. SD: each participant is limited to SD quality. HD: each participant is limited to HD (720p) quality. Full HD (1080p): allows any endpoint capable of Full HD to send and receive its main video at 1080p. Default: Use global setting See Setting and limiting call quality for more information.	Select these options as appropriate
   Theme	If required, assign a customized theme to this rule (which will then be used for callers that use this rule to gateway into Teams). For example, the theme could use alternative labels on some of the splash screens that are displayed when connecting to a conference. You can also customize and enable the in-lobby and mute notifications, or the in-conference DTMF/keypad layout control options.	Select these options as appropriate
   Call target	Select Microsoft Teams meeting.	Microsoft Teams meeting
   Outgoing location	Specify the location that contains the Conferencing Nodes (typically Proxying Edge Nodes) that will communicate with the Teams Connector. These are the nodes referenced in the $PxNodeFqdns variable in the initialization script.	Select the location that contains the Conferencing Nodes that are referenced in the $PxNodeFqdns variable in the initialization script
   Teams Connector	You can optionally select the Teams Connector you want to handle the call. If you do not specify anything, the Teams Connector associated with the outgoing location is used.	Leave unselected
   Treat as trusted	Select Treat as trusted if you want Teams to treat the devices routed via this rule as part of the target organization for trust purposes. Typically you will select this option if the rule is handling devices that are trusted from Pexip Infinity's perspective, for example, you could treat the device as trusted if the caller is coming from a specific location, or if the device is registered to Pexip Infinity. Trusted participants are automatically admitted into a Teams conference.	☑	☑	☐
   External participant avatar lookup	This determines whether or not the Teams Connector requests from Exchange Online an avatar for each participant in the Teams conference. Use global setting: use the global external participant avatar lookup setting. Yes: request the participant avatar from Exchange Online via the Teams Connector. No: use default avatar behavior. Default: Use global setting	Select these options as appropriate

3. Select Save.
4. Repeat the above steps adding your second and subsequent rules as appropriate.

Using the Microsoft Teams IVR gateway service

After the Virtual Reception and Call Routing Rule have been configured, third-party systems and devices can now dial the alias of the Virtual Reception (e.g. teams@example.com) and then, when prompted by the IVR service, enter the Conference ID of the Teams conference they want to join. The Infinity Gateway will then route the call into the appropriate Teams conference.

Using the direct gateway service

After the Call Routing Rule has been configured, third-party systems and devices can now dial an alias that matches your specified pattern (e.g. 234567890@example.com) to be routed directly into the appropriate Teams conference (in this example the conference with a Conference ID of 234567890).

Dial plan conflicts

If the 9 to 12-digit Teams Conference ID and <conference ID>@<domain> style aliases might overlap with your existing dial plan, you can use something more specific for your aliases such as teams.<conference ID>@<domain> i.e. "teams." followed by the Conference ID and then the domain of your Pexip Infinity platform, for example teams.234567890@example.com.

In this case you would need to make the following adjustments to your Virtual Reception and Call Routing Rules (based on our examples above):

• In your Virtual Reception:

  • set Post-lookup regex match to (.*)
  • set Post lookup regex replace string to teams.\1@example.com

  which will match everything entered into the Virtual Reception (which will be the Conference ID), and then prefix it with "teams." and append the "@example.com" domain, thus creating an alias in the form teams.<conference ID>@<domain>.

  For example, if the caller enters 121212121 into the Virtual Reception the post-lookup match and replace strings shown here will convert that into teams.121212121@example.com which then needs to be matched by your Call Routing Rule.

• In your Call Routing Rule(s):

  • set Destination alias regex match to teams\.(\d{9,12})@example\.com
  • leave Destination alias regex replace string set to \1

  which will match the alias pattern produced by the Virtual Reception and the new extended direct routing alias format.

With these changes, callers dialing the meeting directly would need to use this extended format of teams.<conference ID>@<domain>, but there is no change to callers going indirectly via the Virtual Reception (they would still dial teams@example.com and then enter the Conference ID as before).

You also need to configure a different set of "Alternate VTC dialing instructions" to use the prefix parameter to append "teams." to the displayed direct-dial addresses. In this case, our example New-CsVideoInteropServiceProvider command would look like this:

New-CsVideoInteropServiceProvider -Name Pexip -TenantKey "teams@example.com" -InstructionUri "https://px.vc.example.com/teams/?conf={ConfId}&ivr=teams&d=example.com&ip=198.51.100.40&test=test_call&prefix=teams.&w&qrcode" -AllowAppGuestJoinsAsAuthenticated $true -AadApplicationIds "c054d1cb-7961-48e1-b004-389e81356232"

If you have already configured the dialing instructions webpage, you can use the Set-CsVideoInteropServiceProvider command to amend it (see Changing the alternative dialing instructions or IVR address).

There are several steps involved in enabling Microsoft Teams Rooms SIP/H.323 calling, as described in this section. It covers:

• Licensing and software requirements
• Enabling your organization for Teams Room calling
• Enabling VTCs to call a Microsoft Teams Room
• Enabling a Microsoft Teams Room to call a VTC endpoint or VMR

Licensing and software requirements

To use Teams Rooms SIP/H.323 calling you must adhere to the following requirements:

Pexip licensing requirements:

• Teams Room SIP/H.323 Calling plan license count to match your Microsoft Teams Room Pro license count (contact your Pexip authorized support representative for details)

Microsoft requirements:

• Teams Room Pro license
• Windows based device
• Teams Room software needs to be at least 4.17.51.0

Enabling your organization for Teams Room calling

This section describes how to enable your organization and Teams Room systems for SIP/H.323 calling.

Enabling and configuring your Teams calling policy

Your IT administrator must run some Teams PowerShell cmdlets to enable the Teams Room calling policy and give permissions to their VTCs that are to be used for 1:1 calling.

1. Start a PowerShell session as Administrator.

2. Run the following commands to sign in to your Teams tenant:

   • In all standard deployments run:

     Import-Module MicrosoftTeams

     Connect-MicrosoftTeams

   • If this is a GCC High / Azure US Government Cloud deployment then use these commands instead:

     Import-Module MicrosoftTeams

     Connect-MicrosoftTeams -TeamsEnvironmentName TeamsGCCH

You can then use the following commands to configure your calling policies.

To get a list of your existing policies, run the following command:

Get-CsTeamsRoomVideoTeleConferencingPolicy

To create a new policy:

New-CsTeamsRoomVideoTeleConferencingPolicy -Identity "MtrSipCallingPolicy" -Enabled $true -AreaCode "<CVI App ID>" -ReceiveExternalCalls "Enabled" -ReceiveInternalCalls "Enabled"

where:

• <CVI App ID> is replaced with the CVI App ID of the Teams Connector to be contacted when the Teams Room places a call. (This means that you can have different policies assigned to different Teams Rooms within the same tenant. i.e. a tenant is not locked to a single logical Teams Connector App ID.)
• "MtrSipCallingPolicy" is the name of the policy being created. You can use any name of your choosing.

Note that ReceiveExternalCalls and ReceiveInternalCalls default to Disabled when not provided. These properties take only two values: Enabled or Disabled. This lets you configure which types of calls (marked as internal and/or externally originating) you can receive.

To grant a particular policy configuration to a user/room:

Grant-CsTeamsRoomVideoTeleConferencingPolicy -Identity "mtr01@pexample.com" -PolicyName "MtrSipCallingPolicy"

In the example above, "mtr01@pexample.com" is the Teams Room being configured within the "MtrSipCallingPolicy" policy.

Other useful commands

To update properties on an existing policy:

Set-CsTeamsRoomVideoTeleConferencingPolicy -Identity "MtrSipCallingPolicy" -ReceiveExternalCalls "Disabled"

The example above disables receiving external calls on the "MtrSipCallingPolicy" policy. Note that the Identity field is mandatory.

To view systems assigned with a policy:

Get-CsOnlineUser -Filter {TeamsRoomVideoTeleConferencingPolicy -eq "MtrSipCallingPolicy"} | Select-Object DisplayName, UserPrincipalName

The example above shows the systems assigned to the "MtrSipCallingPolicy" policy.

To delete a policy:

Remove-CsTeamsRoomVideoTeleConferencingPolicy -Identity "MtrSipCallingPolicy"

The example above deletes the "MtrSipCallingPolicy" policy.

Note that in Set and Remove commands the -Identity switch is the policy name, whereas in Grant commands the -Identity switch is the Teams Room being configured and the -PolicyName switch specifies the policy name.

Enabling VTCs to call a Microsoft Teams Room

To allow VTCs to call a Microsoft Teams Room you need to create a Call Routing Rule on Pexip Infinity with a Call target of Microsoft Teams Room. In the same manner as the rules used to enable calls into Teams conferences, you can distinguish between trusted and untrusted (external) device types — this corresponds to the ReceiveExternalCalls and ReceiveInternalCalls settings in your CsTeamsRoomVideoTeleConferencingPolicy described above.

To configure your Call Routing Rules:

1. Go to Services > Call routing and select Add Call Routing Rule.

2. The following table shows the fields to configure for your Call Routing Rule, and shows example values for three rules:

   • Rule #1: treats all devices on your enterprise network (handled by Conferencing Nodes in your "Internal network" location) as trusted.
   • Rule #2: treats any device that is registered to Pexip Infinity as trusted (regardless of the source location of the call).
   • Rule #3: treats any other call (not matching rule #1 or rule #2) as coming from an untrusted device.

   (Leave all other fields with default values or as required for your specific deployment.)

   Option	Description	Rule #1	Rule #2	Rule #3
   Name	The name you will use to refer to this rule.	"To MTR from Enterprise network"	"To MTR from Registered devices"	"To MTR from Unknown / guest"
   Priority	Assign the priority for this rule.	80	90	100
   Incoming gateway calls	Ensure this option is selected.	☑	☑	☑
   Outgoing calls from a conference	If you only want to support 1:1 calls then leave this option unselected. However, if you want to allow a VMR to dial out to a Teams Room (including Automatically Dialed Participants), then select this option.	Select these options as appropriate
   Calls being handled in location	Applies the rule only if the incoming call is being handled by a Conferencing Node in the selected location. To apply the rule regardless of the location, select Any Location.	"Internal network" location	Any location	Any location
   Match incoming calls from registered devices only	Select this option if you want this rule to only apply to calls placed from devices that are registered to Pexip Infinity. You will typically use this option in conjunction with the rule's Treat as trusted setting.	☐	☑	☐
   Match Infinity Connect Match SIP Match Lync / Skype for Business (MS-SIP) / Match H.323 / (Match Teams)	Select one or more of the match options as appropriate, depending on which types of systems/protocols you want to offer interoperability into Teams.	Select these options as appropriate
   Match against full alias URI	Leave unselected.	☐	☐	☐
   Destination alias regex match	Enter a regular expression that will match the calls addressed to a Microsoft Teams Room — this is the user principal (also referred to as the "calling URI") or mail address of a Teams room. For example, to match a UPN or alias in the form <username>@example.com, you could use: .+@example\.com however, something more specific and appropriate for your dial plan would be better, and also consider the Priority of your rules.	.+@example\.com
   Destination alias regex replace string	Leave blank
   Call target	Select Microsoft Teams Room.	Microsoft Teams Room
   Outgoing location	Specify the location that contains the Conferencing Nodes (typically Proxying Edge Nodes) that will communicate with the Teams Connector. These are the nodes referenced in the $PxNodeFqdns variable in the initialization script.	Select the location that contains the Conferencing Nodes that are referenced in the $PxNodeFqdns variable in the initialization script
   Teams Connector	You can optionally select the Teams Connector you want to handle the call. If you do not specify anything, the Teams Connector associated with the outgoing location is used.	Leave unselected
   Treat as trusted	Select Treat as trusted if you want Teams to treat the devices routed via this rule as part of the target organization for trust purposes. Typically you will select this option if the rule is handling devices that are trusted from Pexip Infinity's perspective, for example, you could treat the device as trusted if the caller is coming from a specific location, or if the device is registered to Pexip Infinity. If the "trusted" flag is set, the call is classed as "internal", and if the "trusted" flag is not set, the call is classed as “external”. This classification is used in conjunction with the Teams Room tenant policy to decide whether the call is delivered to a Teams Room.	☑	☑	☐

3. Select Save.
4. Repeat the above steps adding your second and subsequent rules as appropriate.

Enabling a Microsoft Teams Room to call a VTC endpoint or VMR

There are some additional steps that must be followed to enable a Microsoft Teams Room to call a VTC or VMR via a Teams Connector, as described below.

Allow incoming calls on any firewalls protecting your Conferencing Nodes

To enable calls from Teams Rooms to reach Pexip Infinity, port 4277 must be enabled on any protecting firewalls for your Conferencing Nodes to allow inbound calls towards those nodes from your Teams Connector.

Enabling the Teams Connector to receive calls from a Teams Room

You must configure the Teams Connector Azure Bot to receive calls from a Teams Room.

To do this you can run the following PowerShell commands:

1. Run the variable initialization script. If you performing these steps in a new session you must also assign the $AppId variable.

2. Run the following commands to configure the Azure Bot:

   Copy to clipboard

   # Connect to Azure
   Connect-AzAccount
   # Import the PexTeamsCviApplication PowerShell module
   Import-Module .\PexTeamsCviApplication.psm1
   # Enable incoming calls from a Teams Room
   Enable-PexTeamsBotIncomingCallRoute -SubscriptionId $PxSubscriptionId -ResourceGroupName $PxBotResourceGroupName -AppId $AppId -TeamsConnectorFqdn $PxTeamsConnFqdn

The Teams Connector can now handle incoming calls from a Teams Room (and route them onwards to Pexip Infinity).

Calling into a VMR

No additional configuration is required to enable calls into a Pexip Infinity VMR — the Teams Room should just dial the VMR alias.

Note that Teams Rooms dialing into a Virtual Reception, Test Call Service, Media Playback Service or a VMR breakout room, or any other type of call that requires a call transfer, is not supported.

Calling a SIP or H.323 endpoint

To allow a Microsoft Teams Room to call a SIP or H.323 endpoint you need to create a Call Routing Rule on Pexip Infinity that matches incoming calls of type Teams.

To configure a Call Routing Rule:

1. Go to Services > Call routing and select Add Call Routing Rule.

2. Configure the following fields (leave all other fields with default values or as required for your specific deployment):

   Option	Description
   Name	The name to use to refer to this rule e.g. "Incoming Teams Room calls".
   Priority	Assign the priority for this rule.
   Incoming gateway calls	Ensure this option is selected.
   Outgoing calls from a conference	Leave unselected.
   Calls being handled in location	Applies the rule only if the incoming call is being handled by a Conferencing Node in the selected location. To apply the rule regardless of the location, select Any Location.
   Match Infinity Connect (WebRTC / RTMP) Match SIP Match Lync / Skype for Business (MS-SIP) Match H.323 Match Teams	Select Match Teams and deselect all of the other options.
   Destination alias regex match	Enter a regular expression that will match the calls received from the Teams Room. For example, to match any alias in the vc.example.com domain: .+@vc.example.com
   Destination alias regex replace string	If required, enter the regular expression string to transform the originally dialed (matched) alias into the alias to use to place the outbound call. If you do not need to change the alias, leave this field blank.
   Call target	Select the appropriate target for the call, typically Registered device or external system or Registered devices only depending on your requirements.
   Protocol SIP proxy H.323 gatekeeper	Select the protocol and associated proxy/gatekeeper as required if you are routing to external systems.

3. Select Save.

Note that this is a guest join experience, therefore someone has to be in the Microsoft Teams meeting to admit you from the lobby.

When using SIP Guest Join, your calls are routed via the Pexip Service, therefore you need to contact your Pexip authorized support representative to perform the necessary steps to enable the guest join process on your behalf. This includes:

• Purchasing a Trusted Devices license for the number of endpoints you own. Note that the Enterprise Room Connector (ERC) premium licensing package for Infinity includes SIP Guest Join (which allows for external Teams calls outside the organization, up to the purchased calling capacity).
• Providing the domains and IP addresses of all of the systems that will send SIP call signaling to the Pexip Service (typically these are the addresses of your externally-facing Conferencing Nodes, or VCS Expressway if relevant).

Note that you do not need to register your endpoints to the Pexip Service, or route any of your non-guest Teams interop calls via the Pexip Service.

Scope and limitations

This is a Teams commercial focused capability, thus all Teams meetings for Work or School i.e. used by enterprises and most governments in the commercial cloud are supported.

Note that the following are not supported:

• Teams meetings with "teams.live.com" (part of Teams for Home or Small Business)
• Teams meetings with "gov.teams.microsoft.us" (part of the Microsoft Government cloud)

Enabling guest join in Pexip Infinity

As a prerequisite to using the guest join feature you must be using One-Touch Join on the endpoints that you will use to join the Teams conferences.

To enable guest join you must create a suitable OTJ Meeting Processing Rule to handle invitations to Teams meetings (see Adding One-Touch Join meeting processing rules for general details on how to do this), and ensure that your guest join calls are routed to the Pexip Service:

1. Add an OTJ Meeting Processing Rule (One-Touch Join > OTJ Meeting Processing rules):

   If you are using Pexip Infinity version 32 or later:

   • You must add a new OTJ Meeting Processing Rule with a Meeting type of Microsoft Teams SIP Guest Join.

   If you are using Pexip Infinity versions 29 to 31:

   • You must add a new OTJ Meeting Processing Rule with a Meeting type of Custom.

   • Use the following script in the rule's Custom template field:

     Copy to clipboard

     {% set matches = pex_regex_search("https:\/\/teams\.microsoft\.com\/(?:l\/meetup-join|meet)\/([A-z0-9-\^\%_.]+)\/([0-9]+)\?context=([A-z0-9-\^\%.]+)", calendar_event.body) %}
     {% set context = "" %}
     {% set organizerId = "" %}
     {% set messageId = "" %}
     {% set tenantId = "" %}
     {% set threadID = "" %}
     
     {% if matches %}
      {% set context = pex_regex_search("%7b%22Tid%22%3a%22([a-z0-9-]+)%22%2c%22Oid%22%3a%22([a-z0-9-]+)%22%7d", matches[2]) %}
      {{(matches[0] ~ "," ~ matches[1]~ "," ~ context[1]) | pex_base32 ~ "." ~ context[0]}}@pex.ms
     {% else %}
     
      {% set matches = pex_regex_search("\"(https://teams.microsoft.com/meetingOptions.*?)\"+", calendar_event.body) %}
      {% set matches = matches[0] | replace("&","&") %}
     
      {% set threadID = pex_regex_search("threadId(?:=|%3D)([a-zA-Z0-9_@.]+)", calendar_event.body) %}
      {% set threadID = threadID[0] | replace("_",":", 1) %}
     
      {% set messageId = pex_regex_search("messageId(?:=|%3D)([a-zA-Z0-9_@.]+)", calendar_event.body) %}
     
      {% set organizerId = pex_regex_search("organizerId(?:=|%3D)([a-zA-Z0-9_@.-]+)", calendar_event.body) %}
     
      {% set tenantId = pex_regex_search("tenantId(?:=|%3D)([a-zA-Z0-9_@.-]+)", calendar_event.body) %}
     
     
      {% set threadID = pex_url_encode(('threadId', threadID)) %}
     
      {% set threadID = pex_regex_search("threadId=([a-zA-Z0-9_@.%-]+)", threadID) %}
      
      {% if threadID[0] and messageId[0] and organizerId[0] and tenantId[0] %}
       {{(threadID[0] ~ "," ~ messageId[0]~ "," ~ organizerId[0]) | pex_base32 ~ "." ~ tenantId[0]}}@pex.ms
      {% endif %}
     {% endif %}

     (This rule looks for https://teams.microsoft.com/<meetingcode> and converts it into a SIP URI that can be routed via the Pexip Service.)

   Consider the priorities of your rules. If you use Teams interop for your own Microsoft Teams meetings then your rules for those meetings should have a higher priority (lower number).

2. Ensure that the SIP Guest Join calls placed from your endpoint are routed to the Pexip Service.

   Typically you can do this via DNS as follows:

   1. Add a Call Routing Rule (Services > Call routing).

   2. Configure the following fields (leave all other fields with default values or as required for your specific deployment):

      Option	Description
      Priority	Choose a suitable priority based on your existing rules.
      Incoming gateway calls	Ensure this option is selected.
      Outgoing calls from a conference	Leave unselected.
      Match incoming calls from registered devices only	Select this option if you want the rule to apply only to calls received from devices that are registered to Pexip Infinity.
      Match Infinity Connect (WebRTC / RTMP) Match SIP Match Lync / Skype for Business (MS-SIP) Match H.323 (Match Teams)	Select the relevant types of system/protocols you want to support, typically Match SIP or Match H.323.
      Match against full alias URI	Leave unselected
      Destination alias regex match	Enter a regular expression that will match the Teams calls that are sent to the Pexip Service. We recommend: .*@pex\.ms
      Destination alias regex replace string	Leave blank.
      Call target	Select Registered device or external system.
      Protocol	Select SIP.
      SIP proxy	Select Use DNS.

Setting the default layout

Pexip's 1+7 layout is used by default for VTC participants within a Teams meeting, however this default can be changed to any of the other supported layouts.

The easiest way to change the default layout for all Teams gateway calls is to use local policy. This method also lets you control other layout options, such as the display of participant names, if required. You could, for example, use local policy to set the default layout to Adaptive Composition and then use one of the methods described below to dynamically change the layout to something else when and if required.

Note that the Teams Connector can only receive a maximum of 9 video streams from Teams, so, with the exception of the Adaptive Composition layout, you should not choose a layout that supports more than 9 participants.

This example local policy script enables the display of participant names and selects Adaptive Composition as the initial layout for all Microsoft Teams gateway calls:

{
  {% if service_config and service_config.service_type == "gateway" and service_config.called_device_type == "teams_conference" %}
    "action" : "continue",
    "result" : {{service_config|pex_update({"enable_overlay_text": true, "view":"five_mains_seven_pips"})|pex_to_json}}
  {% elif service_config %}
    "action" : "continue",
    "result" : {{service_config|pex_to_json}}
  {% else %}
    "action" : "reject",
    "result" : {}
  {% endif %}
}

If you want to apply the policy to a specific Call Routing Rule you can test against service_config.name (the Name of the rule), for example: service_config.name == "name of routing rule"

To use the 4 + 0 layout with Teams you would use: "view":"four_mains_zero_pips".

All of the layout names for the view setting are listed here.

Teams-like layout

To use the Teams-like layout you must use "view":"teams" and also enable the overlay text and active speaker indicators, as shown in the following script:

{
 {% if service_config and service_config.service_type == "gateway" and service_config.called_device_type == "teams_conference" %}
  "action" : "continue",
  "result" : {{service_config|pex_update({"enable_overlay_text": true, "view":"teams", "enable_active_speaker_indication":"true"})|pex_to_json}}
 {% elif service_config %}
  "action" : "continue",
  "result" : {{service_config|pex_to_json}}
 {% else %}
  "action" : "reject",
  "result" : {}
 {% endif %}
}

Note that:

• The layout cannot be customized via themes.
• It has the same hardware resource usage requirements as the Adaptive Composition layout.
• This layout is only suitable for use with Teams gateway calls.

See Using external and local policy to control Pexip Infinity behavior for full details of how to implement a local policy script.

Dynamically changing the layout during a conference

The most convenient way for a VTC participant to control the layout during a conference is to use DTMF/keypad commands directly from their endpoint. This allows the user to select which layout they receive, and to control how presentation content is displayed.

By default the layout changes every time the endpoint sends *8 to the conference, and it cycles through all of the available Pexip layout types in this order: 1+7, Adaptive Composition, 1+21, 2+21, 2x2, 3x3, 4x4, 5x5, 1+0, 1+33. However, some of these layouts are unsuitable for use with Teams as they support more video streams than can be received by Pexip Infinity from Teams, and would result in "broken camera" images being displayed.

{
  "theme_version": 2,
  "dtmf_conference_control_commands": {
  "*3": "toggle_teams_large_gallery",
  "*4": "toggle_pres_in_mix",
  "*6": "toggle_self_mute",
  "*8": "cycle_layout",
  "*9": "toggle_multiscreen"
  },
  "dtmf_allowed_layouts": ["1:7", "ac", "2x2", "3x3", "1:0"]
}

This theme would override the default behavior and limit the DTMF controls to the following options that are relevant to a VTC connected to a Teams conference:

• *3 command: toggles between the current layout and Microsoft's Large Gallery view
• *4 command: toggles whether the presentation stream is sent to that endpoint in the main video mix (replacing some of the other video participants), or as a separate stream
• *6 command: toggles the mute status of the participant
• *8 command: cycles the layout through the set of available layouts as defined in dtmf_allowed_layouts
• *9 command: toggles multiscreen participant display

It also limits the available layouts to Adaptive Composition ("ac") plus the other Pexip layouts that have a maximum of 9 or fewer video participants. If required, you can adapt the list to change the order, or to further reduce the available layouts by removing the layout types you do not want to use. See Layout examples for more information about the layout types.

You can then apply this theme to your Call Routing Rule(s) used to route calls into Teams (or you can set it as your default theme if appropriate for your deployment).

Note that:

• You cannot use the Pexip branding portal to create your theme configuration file (themeconfig.json). You have to manually create your own theme configuration file (using the example above as the basis for this) and package it into a theme ZIP file. See Rules and requirements for customized themes for more information.
• If multiple endpoints are gatewayed into the same Teams conference then they will all start with the same default layout, but any commands to change the layout received by the endpoint only apply to the endpoint issuing the commands.
• If you switch from a less resource-intensive layout (such as "1+7") to a more resource-intensive layout (such as "ac") this will consume additional Conferencing Node hardware resources.

See Example themes below for links to some example downloadable theme files.

Other layout control options

You can also use the Pexip APIs to control the layout:

• Client API: you can use the client API (typically via the Connect web app) to dynamically change the layout applied to a Teams gateway call. This involves using the transform_layout function with the client REST API or the transformLayout function with the PexRTC JavaScript client API.
• Management API: you can use the transform_layout management API command.
• Cisco endpoint macros: Cisco endpoints can use the Pexip Layout Controls macro that allows you to dynamically change the layout, or the Pexip Meeting Controls macro which offers an even greater range of conference control features in Teams meetings.

Using Adaptive Composition in a Teams conference

When Adaptive Composition is used with a Teams conference:

• Up to 9 video participants are shown in the Adaptive Composition layout seen by VTC participants.
• Each participant's video that is received from Teams for display to VTC participants is cropped and framed as appropriate.
• The VTC participant's video stream sent to Teams is cropped and framed as appropriate.
• Audio participant avatars are not supported.
• Inactive video participants are not removed from the video layout.
• Raised hand indicators are not supported.
• Spotlighting is not supported.

The following tables describe the relevant theme elements you can customize.

Settings in the themeconfig.json file:

For example, to implement the text label changes suggested above, and to enable muted indicators, you would configure your themeconfig.json file with:

{
  "theme_version": 2, 
  "conference_locked_indicator_n_waiting_text": "{number_of_waiting_participants} waiting in lobby", 
  "conference_locked_indicator_text": "Action required", 
  "conference_unlocked_indicator_text": "The lobby is empty",
  "disable_watermark_mute_icon": false
}

In-conference graphic indicators:

File name	Content in Base theme	Usage guidance
icon_conference_locked.svg		Used in conjunction with the conference_locked_indicator_text and conference_locked_indicator_n_waiting_text labels when people are in the Teams lobby.
icon_conference_unlocked.svg		Used in conjunction with the conference_unlocked_indicator_text when the lobby becomes empty.
watermark_mute_icon.png		Used in conjunction with the disable_watermark_mute_icon setting, and is displayed when a conference participant is administratively muted.

Audio files:

Example themes

We have provided some example themes that you can download from https://dl.pexip.com/resources/themes/index.html.

An example theme zip file, containing suggested themeconfig.json file settings for the in-lobby and mute notification, and some alternative svg graphics files for the locked/unlocked indicators is available in lock-mute-indicator-theme.zip. The indicators in the example theme look like this:

Another example theme, lock-mute-indicator-dtmf-theme.zip, extends the previous theme by including the recommended subset of DTMF commands that may be used to control a Teams conference.

See Rules and requirements for customized themes for more information on customizing themes.

• See DNS record examples for general information about enabling endpoints to route their calls to Conferencing Nodes, and Certificate and DNS examples for a Microsoft Teams integration for a specific example for the Teams Connector.
• See Pexip Infinity port usage and firewall guidance for full information about the ports used when Conferencing Nodes connect to the Teams Connector and other devices, and Firewall ports for the Teams Connector and NSG rules for specific information about Teams integrations.

• Each participant who is gatewayed via Pexip Infinity into a Teams conference consumes two call licenses (one for the inbound leg of the call and one for the outbound leg, as is standard for calls via the Infinity Gateway). Any external participants who are connected directly to the Teams conference do not consume a license. See Pexip Infinity license installation and usage for more information.

• Bi-directional content sharing is supported between VTCs and Teams clients via VbSS:

  • A Teams client can only share its screen or a window with a VTC system. However, VTC endpoints do see a splash screen if a Teams client starts PowerPoint Live sharing, or uses any other non-supported content share sources, such as Excel or Whiteboard:

    

  • If a VTC starts sharing content while it is held in the Teams lobby, when the VTC is admitted to the meeting the presentation will not be visible to the other participants in the meeting. The VTC participant would need to restart content sharing after being admitted into the meeting.

• A CVI participant's ability to share content in a Teams meeting depends on their role (Presenter or Attendee) in the meeting, and the "Who can present" setting in the meeting options:

  • A trusted CVI participant is always given a Presenter role in the Teams meeting (and thus can present). However, you can subsequently change that specific participant's role if required.
  • An untrusted CVI participant joins the meeting with the Presenter role only if the "Who can present" meeting setting is Everyone, otherwise it joins as an Attendee and cannot present.
  • If a CVI participant is an Attendee and attempts to share content from their endpoint, the sharing request is denied and the attendee is informed via a message on their endpoint such as "Sharing failed" (the exact message depends on the endpoint, and some endpoints may not display a message at all).
• Pexip provides the participant's display name if it is provided by the participant's device. This is independent of whether the device is trusted or not. If a display name is not provided, Pexip uses the device's SIP URI. Note that many devices use the system name as its display name. However, some older systems might choose, for example, to only provide the first part of the SIP URI (the part before the '@') as the display name.
• If a participant in a Teams meeting is spotlighted by a Teams client, that participant is also spotlighted in the layout presented to any gatewayed VTC system (except when using an Adaptive Composition layout).
• VTC endpoints that are gatewayed into a Teams meeting may sometimes be asked to send lower quality video (such as 180p). In these scenarios, even though Pexip Infinity / Teams Connector can support higher resolutions (and offers the higher resolutions to Teams), the video resolution requested by Teams can be lower — hence Pexip Infinity / Teams Connector sends the video format that Teams has requested. This is an operational behavior aspect of Teams and is beyond the control of Pexip software.

• The Teams Connector requests from Exchange Online an avatar for each participant in the conference. This avatar is used:

  • to represent any audio-only participant within the VTC's conference layout (replacing Pexip's standard audio indicator )
  • in the participant profile in the Connect app roster.

  If the avatar request fails (the participant is not found in Exchange Online, or has no avatar) then a substitute graphic is generated based on the initials of the participant's name.

• Teams users joining with PSTN audio (callback and manual dial-in):

  • If a Teams user chooses to get a callback from the meeting to their PSTN device (instead of using computer audio) the user appears in the Pexip layout as a video participant and also as an audio-only participant with the avatar of that user. However, the video participant does not get voice-switched into main view when they speak.
  • If a Teams user selects "manual dial-in" they appear in the Pexip layout as an audio-only participant without that user's avatar as that audio participant has no association with the Teams user (and is also separate from any video connection).
• You cannot limit the Maximum outbound call bandwidth (the call leg towards the Teams Connector) — it is managed automatically by Pexip Infinity.
• If the Teams conference is recorded or transcribed, audio prompts indicating that recording/transcribing has been started/stopped are played, and indicators are included in the video stream sent to gatewayed participants.