3CX and Microsoft Teams integration: call from Teams with your phone system

The short answer: yes, your staff can make calls from Microsoft Teams while keeping 3CX as the phone system. 3CX’s official method is Direct Routing: 3CX acts as the gateway (SBC) between Teams and your lines. Selected users make and receive calls in Teams with their business number, and 3CX keeps doing what it does better than Teams: queues, IVR menus, recording and reporting. You do, however, need specific prerequisites on the Microsoft and network side, and a Microsoft licence including telephony for every connected user.

Our comparison 3CX, Yeastar or Teams Phone helps choose a platform. This guide covers a different, increasingly common case: a business that chose 3CX but where some teams live in Teams. As a 3CX partner in Morocco, Bronze and Advanced Certified, and a Microsoft partner, we set up this integration in Casablanca and across Morocco. Everything below comes from the official 3CX Version 20 documentation; we do not quote licence prices.

What the integration does, and what it is not

3CX is clear about this on its Teams page: 3CX is not an add-on hidden behind Teams. They are two connected systems, each keeping its own features.

• For the Teams user: they dial a number in Teams and the call goes out through 3CX’s lines (SIP trunks). They receive calls to their number in Teams, and they call 3CX colleagues just like Teams colleagues.
• For the business: telephony features stay in 3CX, queues, IVR menus, routing, recording and reports, with a single administration.
• For the budget: 3CX highlights that you can connect only key users to Teams and leave the others on 3CX, with no Microsoft Calling Plan since your own lines carry the calls.

What the integration is not: a way to run 3CX queues inside Teams. The features of the two platforms do not mix.

Direct Routing or Microsoft 365 sync: two building blocks

Two separate integrations are often confused:

Building block	What it does	Required to call from Teams
Microsoft 365 integration	Syncs users, Microsoft sign-in, contacts and Teams presence	Yes, it is a prerequisite
Teams Direct Routing	Carries calls between Teams and 3CX	Yes, it is the integration itself

Presence sync is useful even without Direct Routing: when someone is in a Teams meeting, their 3CX status changes and calls are routed accordingly. It applies to users with a Teams licence, and you choose the sync direction and status mapping. Watch out for loops: 3CX recommends mapping the same statuses in both directions.

Prerequisites on the Microsoft side

The 3CX documentation lists the following:

• The Microsoft 365 integration configured in 3CX, which requires a Microsoft 365 subscription that includes Exchange.
• A licence including telephony for each connected user: Microsoft 365 E1, E3, E5 or A5, or a Microsoft 365 plan with the Phone System or Business Voice add-on. The 3CX documentation also refers to a “Teams Phone System” licence. 3CX notes that these rules differ by region and change often: we check them with Microsoft before any commitment.
• No Microsoft Calling Plan on these users: with the Business Voice add-on, 3CX asks you to untick the domestic calling plan.
• An “Office phone” number in E.164 international format (+212…) set for each user in Microsoft 365.
• A domain registered in the tenant for the gateway name: “teams.yourdomain.ma”, for example. An “onmicrosoft.com” name is not accepted.

If your Microsoft 365 plan needs to change, see Microsoft 365 Business Basic, Standard or Premium.

Prerequisites on the 3CX and network side

• The 3CX edition: the 3CX technical documentation states the AI edition from 16 simultaneous calls, while the PRO edition page lists Teams Direct Routing among its integrations. We have 3CX confirm this when quoting. Choosing an edition is covered in 3CX licence: which edition to choose.
• A static public IP address that the gateway name’s DNS record points to. Teams does not support IPv6.
• An SSL certificate from a Microsoft-approved authority, covering exactly that name. Wildcard certificates are not suitable.
• SIP port 5062 (or 5061 in some cases) open on the firewall, plus flows to the Microsoft address ranges documented by 3CX for signalling and media.

These openings must be restricted to Microsoft’s ranges, not open to the whole internet. We configure them on the firewall following the principles in our 10 FortiGate settings after installation.

Setup steps

The official procedure has eight steps:

1. Check the prerequisites: Microsoft licences, E.164 numbers, tenant domain.
2. Enable Teams Direct Routing in the 3CX console (Integrations, Teams), choose the gateway name, then create the DNS record.
3. Generate the certificate request with the tool provided by 3CX.
4. Obtain the certificate from an approved authority, with its intermediate certificates.
5. Upload the certificate and its private key to 3CX.
6. Open the SIP port on the firewall.
7. Generate and run the dial plan script in PowerShell, with an up-to-date MicrosoftTeams module.
8. Generate and run the user script, to be re-run for each new user connected to Teams.

Microsoft does not apply licences and scripts instantly, and the Teams client sometimes needs a restart to show the new configuration. We therefore plan the switchover in two stages: preparation, then go-live for a pilot group.

Keep the configuration alive

Direct Routing is not a one-off setup. Each time a user joins or leaves the Teams group, their Microsoft licence, Office phone number and 3CX settings must be updated, and the user script re-run. The certificate also has an expiry date: if it lapses, Teams can no longer reach 3CX. We record these maintenance tasks in the monitoring file, so the link between the two platforms does not break silently.

Settings not to forget

• Teams voicemail: by default, Teams sends unanswered calls to its own voicemail, even when the client is closed. 3CX recommends letting 3CX handle voicemail and overflow, by setting “If unanswered” to “Do nothing” in Teams.
• Teams Rooms: they need a first and last name in the directory and their own telephony licence to be integrated.
• Outbound rules: numbers arrive from Teams in +212 format; depending on your carrier, 3CX’s rules must be adapted.
• Teams calling policies: a restrictive policy on the Microsoft side can block outbound calls without a clear message.

Day to day: what the user sees

Once the scripts are applied, the connected user has a dial pad in Teams, with their business number linked to their 3CX extension shown beneath it. Until that information appears, calls fail: it is the first check we make with each pilot user.

They then call as usual: a customer from the dial pad or the history, a 3CX colleague by extension number, a Teams colleague by name. Inbound calls to their number ring in Teams, on desktop and mobile. If they belong to a 3CX queue, the queue keeps distributing calls according to its rules, and statistics stay in 3CX. Reception, operators and customer service teams usually keep the 3CX app or a desk phone, which give access to all supervision features.

Which scenario for which business

Situation	Our recommendation
Office teams who spend the day in Teams, customer service on 3CX	3CX with Direct Routing for Teams users only
Business on Microsoft 365 that mainly wants to see who is available	Microsoft 365 integration and presence sync, without Direct Routing
Office with no reception or queue, fully on Microsoft 365	Teams Phone alone may be enough, compare on total cost
Sales reps and technicians mostly on mobile	3CX app, more complete for telephony
Reception, operators, agent floor	3CX app or Web Client, and desk phones

The right choice depends less on technology than on your teams’ habits. We always start from the question: who calls, from which tool, and for what kind of calls.

Mistakes we fix

1. A wildcard certificate reused to save time: the connection with Teams never comes up.
2. A missing or badly formatted “Office phone” number: the user is missing from the script, or their outbound calls fail.
3. An old Teams connector left in place: 3CX recommends resetting Teams policies to default before configuring its integration.
4. The SIP port open to the whole internet instead of Microsoft’s ranges only.
5. Two apps ringing on iPhone: only one actually rings; the calling tool must be chosen per profile.
6. Everyone connected to Teams on principle, when only a few profiles benefit.

Checklist before connecting 3CX to Teams

• List of users who will call from Teams, and of the others.
• Microsoft licences including Teams Phone, without a Calling Plan, checked user by user.
• Numbers in +212 format in Microsoft 365.
• 3CX edition and licence size confirmed.
• Static public IP, DNS name in your domain, Microsoft-approved certificate.
• Firewall rules restricted to Microsoft’s ranges.
• Calling tool on mobile chosen: Teams or the 3CX app.

How we work

We start with a free audit of your telephony and your Microsoft 365 tenant: licences, numbers, dial plan, firewall. We then prepare the certificate, DNS and network rules, configure the Microsoft 365 integration and Direct Routing, and go live with a pilot group before rolling out. If your teams also need customer records on incoming calls, we connect your CRM, see 3CX CRM integration. After the switchover, the phone system and the Teams link are monitored 24/7, and a critical incident is handled in under 15 minutes.

See our IP telephony in Morocco offering, then request your free phone system audit: we reply within 24 business hours.