Best Practice - How to Automate Migration to Microsoft Teams Direct Routing via Microsoft Azure AD

Overview

This best practice details how to use Microsoft Azure AD to automatically route calls from a SIP Trunk or PSTN to Microsoft Teams Direct Routing at the same time user migrates to Microsoft Teams.

In this network scenario, a call arrives from the carrier and the SBC Edge Portfolio uses Azure AD information to detect if the called user had already been migrated to Microsoft Teams, as follows.

• If the user has been migrated to Teams, the call is sent to the Teams user using Microsoft Direct Routing.
• If the user is not a Teams user, call is sent to the PBX phone using the PBX connection.

SBC Edge Portfolio does not require any configuration updates when a user is migrated to Microsoft Teams.

Network Scenario- Use Azure AD to Automate Migration to Microsoft Teams Direct Routing

Overview - Call Routing Logic 

In the configuration example used for this Best Practice, a call arrives from the SIP Trunk and an IP address is associated with a SIP Signaling Group (SIP SG). The SIP Signaling Group points to a Call Routing Table which in turn specifies a Transformation Table.

The Transformation Table contains two entries:

• One transformation entry formats the Called Number to match the format used in Azure AD. The SBC Edge Portfolio adds a "+" to match the format of the telephoneNumber Azure Active Directory user attribute.
• The second transformation entry searches for this formatted value in the phoneNumber Active Directory user attribute stored in the local Azure AD cache.

For the purpose of this example, the following attributes are used:

Step 1: Prerequisites

The following prerequisites are required for configuring the SBC Edge Portfolio and Azure for automated migration:

• SBC 1000, SBC 2000 or SBC SWe Edge
• SBC Edge Portfolio License includes Active Directory
• Active Azure subscription
• Azure Active Directory tenant associated with your subscription (either synchronized with an on-premises directory or a cloud-only directory)

Setup the SBC Edge Portfolio

Before SBC Edge Portfolio configuration, setup the SBC Edge Portfolio according to the following:

Configure the SBC Edge Portfolio to Access PSTN, PBX and Direct Routing

Configure the SBC Edge Portfolio according to the following:

Prepare Azure Active Directory Domain Services

1. Configure Azure AD Domain Services. Refer to: Create and Configure an Azure Active Directory Domain Services instance.

2. Configure LDAPS on Azure AD Domain Services. Refer to: Configure Secure LDAP for an Azure Active Directory Domain Services Managed Domain. The section "Export a certificate for client computers" is not required.

   1. Take note of the "Secure LDAP External IP Address" or the FQDN that you associated. In this example, ldaps.domain.com is used.

   2. Add the SBC Public IP address to the Azure AD Domain Services Network Security Group (AADDS-domain.com-NSG).

3. Create a user in Active Directory with the correct "AAD DC Administrators". This user is used to query Azure AD from the SBC Edge Portfolio to read the Azure AD information. In this example, admin@domain.com is used.

Step 2: Configure SBC Edge Portfolio for Azure Active Directory

Verify Active Directory License

Active Directory based call routing can be preformed only with an AD feature license. Verify this license is installed as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to System > Licensing > Current Licenses.

3. Verify that the Active Directory feature is licensed.

   View Active Directory License

   
   
   

   For detailed information on licenses, refer to: Node-Locked Licensing.

Create/Configure Domain Controller

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Auth and Directory Services > Active Directory > Domain Controllers.
3. Click the Add Domain Controller icon at the top of the Domain Controllers Table page.

4. Add a domain controller per the parameters below. For details on creating a Domain Controller, refer to Adding and Modifying Domain Controllers.

5. Click OK.

   Domain Controller Screen

   

   Domain Controller Configuration

   Attribute	Value
   Description	Azure AD
   Domain Controller Address	<"Secure LDAP External IP Address" or the FQDN that you associated to it.>. Enter the user created in step 2 in Prepare Azure Active Directory Domain Services. Example: ldaps.domain.com.
   DC Type	Call Route
   Search Scope	<AD object that contains the domain user>  Example: DC=domain,DC=com
   LDAP Query	<Filter to query the proper user>. Example: displayName=*
   Server Timeout	5
   User Name	<User used to query Azure AD>. Enter the name created in step 3 in Prepare Azure Active Directory Domain Services. Example: admin@domain.com.
   Password	<Password for admin@domain.com>
   DC Role	Primary
   DC Priority	1

Create/Configure Active Directory

Create and configure an Active Directory entry as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Auth and Directory Services > Active Directory > Configuration.
3. Configure the settings per the table below. For details on Active Directory, refer to Configuring the SBC Edge Portfolio for Active Directory.

4. Click Apply.

   Active Directory Screen

   

   Active Directory Configuration

   Attribute	Value
   AD Enabled	True
   Use TLS	True
   Operating Mode	Update
   Query/Cache Attribute	displayName, telephoneNumber
   Nested Group Lookup for Authentication	True
   Normalize Cache	False
   Update Frequency	1440
   Configure Initial Update Time	False
   AD Backup Failure Alarm	Enable
   Encrypt AD Cache	True

Verify Telephone Number in AD Query 

The Active Directory Cache Query tool allows you to query the local AD Cache for records that match a selected property/value pair. The query returns the records associated with the first match it finds. This tool is useful in determining if the Cache has been updated after a record has been added on the Domain Controller. 

Perform an AD query as follows:

1. In the WebUI, click the Diagnostics tab.
2. In the left navigation pane, go to Tools > Query AD Cache.
3. In the Property to Match drop down list, select telephoneNumber.
   
4. In the Value to Match field, enter the Skype user's telephoneNumber (i.e:+12122139087)

5. Click OK.
   The query should return results similar to those shown below. 

   Query Results

   

   
   If the request is failing, LDAPS may be denying the ACL that protects the Logical Interface for Teams. Create the following rules:
   
   On the Outbound ACL, create the rule with the following parameters (ensure this rule is higher than "Deny All" rule):

   Outbound ACL

   

   Outbound ACL Configuration

   Attribute	Value
   Description	Outbound LDAPS Request
   Protocol	TCP
   Action	Allow
   Port Selection Method	Range
   Source IP Address	<IP Address of your logical interface>
   Source Netmask	255.255.255.255
   Source Minimum Port Number	0
   Source Maximum Port Number	65535
   Destination IP Address	<"Secure LDAP External IP Address">
   Destination Netmask	255.255.255.255
   Destination Minimum Port Number	636
   Destination Maximum Port Number	636

   
   On the inbound ACL, create the rule with the following parameters (ensure this rule is higher than "Deny All" rule):

   Inbound ACL

   

   Inbound ACL Configuration

   Attribute	Value
   Description	Outbound LDAPS Response
   Protocol	TCP
   Action	Allow
   Port Selection Method	Range
   Source IP Address	<"Secure LDAP External IP Address">
   Source Netmask	255.255.255.255
   Source Minimum Port Number	636
   Source Maximum Port Number	636
   Destination IP Address	<IP Address of your logical interface>
   Destination Netmask	255.255.255.255
   Destination Minimum Port Number	0
   Destination Maximum Port Number	65535

   
   

   For detailed information about ACLs, refer to Working with Access Control Lists and Session Control.

Step 3: Configure SBC for Active Directory Routing

Create/Configure Transformation Tables

A Transformation table contains a list of entries that contain routing rules. Two Transformation table entries are required:

• Entry for the Called Number to match the format used in Azure AD.
• Entry to search for the formatted value in the phoneNumber Active Directory user attribute stored in the local Azure AD cache.

Create the Transformation Table entries as follows:

1. In the WebUI, click the Settings tab.
2. In the left navigation pane, go to Call Routing > Transformation.

3. Create a Transformation table called From SIP-Trunk to Teams user.  For details, refer to Managing Transformation Tables.

4. In the left navigation pane, select the Transformation Table created in the previous step.

5. Add two entries. See below for configuration. For details, refer to Creating and Modifying Entries to Transformation Tables.

   From SIP-Trunk Teams User - Entry 1

    

   From SIP-Trunk to Teams Entry 2 - Attributes

   Attribute	Value
   Match Type	Mandatory
   Input Field Type	Called Address/Number
   Input Field Value	(.*)
   Output Field Type	User Value 1
   Output Field Value	+\1

   From SIP-Trunk to Teams User - Entry 2

    

   From SIP-Trunk to Teams Entry 2 - Attributes

   Attribute	Value
   Match Type	Mandatory
   Input Field Type	User Value 1
   Input Field Value	=telephoneNumber=
   Output Field Type	Called Address/Number
   Output Field Value	=telephoneNumber=