Architecture decision guide / 20 September 2026

Teams Phone ≠ ACS-free

Teams Phone changes the telephony identity. TPE still uses ACS for call control and audio.

Keep the ACS bridge, replace its control/media layer, or move the conversation into a managed product. See exactly which components change for each configuration.

Microsoft's integration models: Unify = ACS, Extend = Graph, Connect = certified SBC + Direct Routing.

Pick a configuration

Choose a direction

Compare the application boundary. Open an option for its diagram, call flows, and implementation detail.

Current ACS and four target configurations
Option / status	ACS in your app	Runtime boundary	Component change
1. Standalone ACSBaseline	Retained	Python + ACS control/media	No swap: reference architecture.
2. Teams via ACS/TPEProposed	Retained	Reuse Python + ACS bridge	ACS number → Teams resource account
3. Graph calling botProposed	Replaced for voice	Python behind new Windows/.NET media service	ACS → Graph control + .NET media
4. SIP gateway + TeamsProposed	Replaced for voice	Python behind new gateway bridge	ACS → gateway control + duplex audio
5. Managed agentsPreview	No custom ACS setup*	Conversation moves to the product	Custom voice runtime → managed agent

*The cited managed setup lists no custom ACS resource; Microsoft's internal stack is undisclosed. Graph/SIP replace the voice path, not other ACS dependencies.

Public-source scope & status definitions

Baseline: the linked public code, not proof of deployment. Proposed: this guide's integration design, not an implemented feature in that baseline or a product announcement. Preview: status in the cited public Microsoft documentation.

Sources are public Microsoft documentation and the public accelerator snapshot (09ecdfc). Proposed component mappings are design recommendations, not claims about unannounced work.

Lifecycle evidence

Microsoft's public statement: Azure Communication Services is introducing breaking changes, and some services are being retired. This guide does not infer service-specific deadlines or migration entitlements from that warning. Public Microsoft notice.

Publicly documented integration and routing distinctions

An SDK upgrade is not a Teams integration. Public TPE setup also requires a licensed resource account, its association with an ACS resource, configured connectivity, and access authorization. TPE prerequisites.

ACS Direct Routing and Teams Phone Direct Routing are different services. Microsoft's documentation requires different SBC FQDNs when the same SBC serves both. Do not treat documentation for one as the support contract for the other. ACS/Teams domain separation · Teams Direct Routing planning.

Read the diagrams

Solid blue / call control Dashed teal / audio Dotted purple / context

Expand an option to play or step through its flows. Node labels show reused/added/replaced components; double-ended media arrows mean receive + injection. Control never carries PCM. These are logical designs, not deployment or support claims.

01 Current standalone ACS

Baseline ACS owns call control and duplex audio. License checklist

Reference stack: ACS number, Call Automation, Event Grid/callbacks, and media WSS feeding the Python engine. Compare component swaps.

ACS architecture, call flows & runtime support

The outbound helper uses an ACS source phone number and CallAutomationClient.create_call. Inbound calls arrive through Event Grid; the app answers and receives subsequent ACS callbacks directly. The media socket is a separate, bidirectional WSS path. In this implementation it carries PCM16, mono, 16 kHz; the VoiceLive bridge handles the 24 kHz service audio boundary. Call setup and media options · VoiceLive bridge.

ACS has two distinct paths into FastAPI: HTTPS call events/control and duplex WSS audio. Event Grid delivers incoming-call events, not the media stream.

Text equivalent & all flow steps

Inbound call

A PSTN caller reaches the ACS number. ACS emits an IncomingCall event through Event Grid to the app.
FastAPI answers through Call Automation. ACS callbacks report the evolving connection state.
ACS opens duplex media WSS. The native Cascade or VoiceLive engine consumes audio and streams the response back.
YAML agents, tools, and scenarios drive the conversation; Redis and Cosmos retain the configured session and persistence data.

Outbound call

The app requests create_call using an ACS-purchased source number and the selected recipient.
ACS attempts the call and reports outcomes by callback. Request acceptance does not mean the recipient answered.
Once connected, duplex ACS media reaches the same native engine as an inbound call.
The same agent definitions, tool policy, and configured persistence apply.

Human handoff

The agent resolves an allowed human destination. This is a telephony transfer, not a YAML agent-to-agent handoff.
The app requests the configured ACS transfer. ACS attempts a new human call leg; it is not instantaneous.
Correlate success or failure callbacks. Do not tell the caller the transfer completed just because the request was accepted.
Retain authorized context and apply explicit failure/cleanup policy. Context is not automatically delivered to a human desktop by the phone call.

Keep

Python/FastAPI, native engines, YAML registries, tool policy, Redis/Cosmos, ACS callbacks and media framing.

Add

Nothing for this diagram. It documents the reviewed baseline, not an endorsement of future standalone lifecycle support.

Remove

Nothing. ACS numbers, call control, and media remain dependencies to inventory.

Actual channel support in this snapshot
Channel	Cascade	VoiceLive	Important boundary
Browser direct audio	Supported	Supported	A separate browser/app audio path; do not infer use of the ACS Calling SDK.
ACS	Supported	Supported	ACS telephony and media bridge.
Genesys AudioHook	Not supported	Supported	An existing specific integration, not a generic SIP gateway or a commitment to Cascade support.

Authoritative current-code references: voice runtime ownership and extension guide. Historical docs/legacy material is not current API guidance.

02 Teams Phone via ACS / TPE

Proposed Accelerator integration design based on public TPE documentation. License checklist

Reuse the ACS bridge; add Teams identity. TPE connects a licensed resource account and service number to ACS Call Automation. The design shown here aims to retain the Python runtime, callbacks, and media protocol; that reuse must be implemented and validated. TPE architecture · GA scope.

Swap: ACS source-number identity → Teams resource account. Add: TPE association and access. See what stays.

Known limit: Teams → third-party agent → external-number transfer/conference is documented as failing. Exact scenario.

Teams/TPE architecture, call flows & public prerequisites

Proposed accelerator integration using the public TPE model, shown with Direct Routing: carrier → certified SBC → Teams Phone RA, optionally through an auto attendant/call queue → TPE/ACS → accelerator. Calling Plans and Operator Connect are alternative PSTN connectivity choices.

Text equivalent & all flow steps

Inbound call

The carrier and certified SBC route a PSTN call into Teams Direct Routing and the configured resource-account number.
The configured Teams/AA/CQ path reaches the TPE application. ACS delivers the incoming event through Event Grid.
FastAPI answers with ACS Call Automation. Audio still arrives over the existing ACS duplex WSS protocol.
The same Cascade or VoiceLive engine, agents, tools, and persistence serve the conversation.

Outbound call

The app calls ACS create_call with the Teams resource-account object ID as teams_app_source, after server-side access assignment.
Teams telephony originates the PSTN leg using the RA's service identity and configured carrier route, not an ACS-purchased source number.
ACS callbacks report connection or failure. Missing licensing, authorization, or route configuration must surface as errors.
After connection, the reused ACS socket, engine, and session stack handle audio and context.

Human handoff

Resolve the destination and check the exact originating topology against the documented transfer limitations.
For a supported scenario, request transfer through ACS/TPE toward the Teams or PSTN human destination.
Wait for the actual outcome. The specific Teams-to-third-party-agent-to-external-number scenario below is documented as failing.
If transfer fails, retain or recover the caller under a designed fallback. Share only authorized context through a separate integration.

Reuse

ACS Call Automation, Event Grid/callbacks, duplex media, both engines, hangup, YAML agents/tools/scenarios, Redis/Cosmos.

Add

Teams RA, service number, licensing, app identity, RA-to-ACS association, server access assignment, carrier route; SBC/DNS/certificates when using Direct Routing.

Replace, not remove

Replace the ACS-purchased source-number assumption with Teams RA identity. Do not remove ACS control or media.

What the public TPE setup requires

These are documented Microsoft prerequisites, not a description of an accelerator provider selector or release.

Boundary	Publicly documented requirement
Resource account	Provision the RA, assign the Teams Phone Resource Account license and service number, and associate it with the ACS resource. Provisioning.
Server access	Authorize the RA through the Teams Phone access assignment API. This is separate from client-user consent. Access assignment.
Outbound call	Use the RA object ID as `TeamsAppSource`, configure outbound-capable PSTN connectivity, and provide a public HTTPS callback URI. Server outbound quickstart.
Python SDK	The public `create_call` API exposes `teams_app_source`; the SDK changelog records TeamsAppSource support in stable 1.5.0. Use a currently supported version. API · Changelog.

Transfer support is scenario-specific. The TPE capability matrix lists supported transfers, but the third-party voice-agent setup page separately states: when a call is transferred from Teams into a third-party voice agent, a subsequent conference/transfer to an external phone number fails. Preserve both statements; neither “all transfers work” nor “all transfers fail” is accurate. Known issue · Capability matrix.

Additional limits include forwarding/simultaneous-ring behavior and location-based routing. The server outbound guide also notes that its participant-move latency optimization does not yet apply to Direct Routing at publication. Do not promise identical latency or feature parity across routes. Server outbound prerequisites and limitations.

Build permission is not production certification. The FAQ permits starting development without certification; Microsoft's voice-agent support boundary is certified-partner solutions. The third-party integration page's June 15 GA entry is not blanket GA for managed agents or every transfer scenario. Support boundary · Third-party setup explicitly requires ACS and Event Grid.

03 ACS-independent Graph calling bot

Proposed New calling bot, media host, and bridge. License checklist

Keep Python behind a Windows/.NET media service. Graph controls calls, including documented PSTN scenarios; its REST API does not stream PCM. Graph v1.0 calling · Media requirements.

Swap: ACS control/media → Graph call control + Windows/.NET media. Add: a custom Python bridge. See the component mapping.

Support gate: Graph REST is v1.0; the separate real-time media platform page still says developer preview. This is not a Linux-only drop-in.

Graph architecture, call flows & media-host requirements

Graph HTTPS controls calls; the separate .NET real-time media SDK receives/injects audio. New bot, affinity, and bridge components sit in front of the retained Python runtime. No ACS node is part of this proposed path.

Text equivalent & all flow steps

Inbound call

A supported Teams/PSTN call reaches the bot's application instance. Graph delivers the incoming-call notification to its registered callback.
The bot answers with the appropriate permissions and application-hosted media configuration; pin the call to its media instance.
The Windows/.NET media SDK handles audio. A newly engineered duplex bridge exchanges it with Python, not through Graph REST.
Retain the native engine and business definitions; map identities, formats, backpressure, interruption, and lifecycle explicitly.

Outbound call

Custom orchestration asks the bot service to create a Graph call using an authorized application identity.
A provisioned, numbered application instance can originate documented PSTN scenarios; Graph is not limited to internal Teams calls.
Track asynchronous call state and the chosen media host. A successful API response is not proof the destination answered.
After connection, the .NET media leg and custom bridge carry audio to/from the retained AI runtime.

Human handoff

Resolve destination identity and tenant/number constraints; pass a correlated transfer request to the bot service.
Request a documented Graph transfer. Same-tenant Teams restrictions and application-instance PSTN requirements apply.
Treat HTTP 202 as acceptance, then observe asynchronous outcomes. Consultative transfer requires its own supported call topology.
Release media only when the call lifecycle permits it; retain context and a failure path if the handoff does not complete.

Reuse

Python AI engines, YAML definitions/tools, and storage behind an explicit new bridge. Reuse is a design goal, not current channel compatibility.

Add

Entra app/calling bot, application instance, Graph consent, Azure Windows/.NET media hosts, per-call affinity, callbacks, and a custom duplex/control bridge.

Remove from this path

ACS Call Automation, ACS Event Grid integration, ACS media framing, and ACS-number identity. Audit email/SMS separately before claiming complete ACS removal.

Graph supports PSTN origination, inbound, and transfer scenarios. Follow the application-instance/number prerequisites, rather than assuming every identity can call any destination. The transfer API notes a same-tenant Teams scope and PSTN transfer only for application instances. Bot number management · Answer · Transfer and asynchronous response.

REST v1.0 is not the media platform's release label. The application-hosted media article still calls the real-time media platform developer preview. It requires the Microsoft.Graph.Communications.Calls.Media .NET library, production Windows Server hosting in Azure (not Azure Web App), publicly reachable per-instance IP/port mapping, and call affinity. Calls remain pinned to their media host. The SDK must be current or no more than three months old. Confirm the operational and support boundary before committing. Exact media-host constraints.

04 SIP gateway + Teams Direct Routing

Proposed Gateway vendor and interface not selected. License checklist

Keep Python behind a programmable SIP/contact-center gateway. The gateway owns call control and duplex audio; a certified SBC supplies Teams connectivity. Connect model · Direct Routing prerequisites.

Swap: ACS control/media → vendor gateway. Add: a channel bridge for its duplex audio contract. See the component mapping.

Not sufficient: a certified SBC alone is not an AI media API, and does not certify the whole voice-agent solution.

SIP architecture, call flows & vendor transfer contract

Illustrative topology, not a selected vendor design. SIP/TLS is signaling; RTP/SRTP is media (Teams-side media uses SRTP). The gateway must anchor the required audio and expose a confirmed duplex interface. Media bypass can change the actual media route.

Text equivalent & all flow steps

Inbound call

The configured carrier/SBC/Teams route sends an incoming call to the chosen gateway. The exact entry route is a vendor design decision.
The gateway answers using its documented SIP/call-control interface; the SBC does not supply a generic answer API to Python.
The gateway anchors RTP/SRTP and simultaneously receives/injects audio through its confirmed app interface.
A new channel bridge maps formats, pacing, barge-in, and lifecycle into the retained engine, tools, and state.

Outbound call

Python requests origination through the selected gateway's documented control contract, not through Teams Direct Routing alone.
The gateway/SBC uses the authorized carrier or Teams route and permitted caller identity. Routing and commercial arrangements must be confirmed.
Track provisional, answered, failed, and disconnected states through the vendor's event contract.
After answer, the gateway bridges two-way audio. A one-way recording feed cannot serve this architecture.

Human handoff

Choose blind or consultative transfer, a validated destination, and a least-data context handoff contract.
Invoke the vendor-supported transfer flow. Validate SIP REFER/NOTIFY direction and any new INVITE legs for this topology.
Observe signaling and final call outcomes. REFER acceptance, ringing, and human answer are different milestones.
Retain or recover media on failure and close only the correct legs. Validate media-bypass and failure-recovery behavior explicitly.

Reuse

Python/Linux hosting, AI engines and business definitions, tools, and state behind a purpose-built channel bridge.

Add

Selected gateway/control service, confirmed duplex API, certified SBC, carrier/Teams routing, DNS/certificates/networking, monitoring, and vendor operations.

Remove from this path

ACS control, callbacks/Event Grid, ACS framing, and ACS number dependency. The gateway replaces these responsibilities; they do not disappear.

No invented endpoint: this guide deliberately does not name a generic wss:// SIP media URL. Transport, authentication, codecs, pacing, interruption, concurrency, and commercial rights remain vendor-dependent and unconfirmed.

Transfer direction matters. Microsoft's Direct Routing article describes the Teams SIP proxy either handling a transfer locally with a new INVITE, or sending REFER to the SBC, which handles a new INVITE using the provided context. SBC NOTIFY support is required; SBC REFER handling is required for the documented media-bypass transfer case. This is not a guarantee that an arbitrary bot-originated REFER into Teams will work. Validate REFER-TO/REFERRED-BY, Replaces behavior, and blind/consultative flows with the SBC/gateway vendor. Official SIP transfer contract.

A certified SBC establishes the Direct Routing device boundary, not certification of the entire voice-agent solution. Agree which party owns carrier incidents, Teams routing, gateway media, and the AI runtime. Contact-center solution certification.

05 Managed Teams Phone Agent / Copilot Studio

Preview Replace the conversational runtime, not just the phone provider. Teams Phone Agent licenses · Copilot Studio licenses

Move the conversation into a managed product. The native setup lists no custom ACS resource or PCM bridge to this accelerator; Microsoft's internal stack is undisclosed. Teams Phone Agent · Direct-dial Copilot Studio.

Swap: custom telephony and conversation runtime → managed product. Prompts and tools need migration, not just a new transport. See the component mapping.

Fit gate: the Copilot Teams channel is basic-voice only, not real-time, with classic orchestration and tenant enablement. Do not assume Cascade/VoiceLive or outbound-automation parity. Channel limits.

Managed architecture, call flows & preview boundaries

A Teams RA routes to a product-hosted agent. The custom accelerator voice loop is not in this path; prompts, tools, knowledge, and handoff behavior must be mapped to the chosen product's supported features.

Text equivalent & all flow steps

Inbound call

A configured Teams service number and AI Agent resource account route the call to the enabled product/channel.
Teams Phone Agent or the supported Copilot Studio voice channel runs the conversation in the managed runtime.
The managed agent uses its configured knowledge and allowed tools. Existing YAML/toolstore definitions do not automatically become product assets.
This path has no documented custom PCM bridge to Cascade or VoiceLive. Evaluate the supported product experience instead.

Outbound automation boundary

The cited native setup is not documentation for arbitrary app-originated outbound calls or SIP automation.
Do not reinterpret a product's call-transfer tool as a generic create_call API for this accelerator.
Confirm a separately documented product capability before designing proactive outbound scenarios. No outbound call is animated here because no such integration is established.

Human handoff

Configure only destinations and transfer behavior supported by the selected managed product.
The managed agent invokes its supported transfer workflow through Teams telephony.
Observe product outcomes and handle unsuccessful routing using the product's supported fallbacks, not assumed ACS/Graph hooks.
Any human-facing summary or business context needs a supported connector and appropriate permissions; it is not implied by the call transfer.

Carry forward

Business requirements, reviewed prompts, knowledge, and allowed tools as migration inputs, not drop-in YAML/runtime reuse.

Add

Product eligibility, tenant/channel enablement, licensed RA/number configuration, managed agent configuration, governance, and product-specific testing.

Replace

This application's telephony integration and conversational runtime. External business services may be connected only through supported product mechanisms.

Basic voice is not real-time channel parity. The linked Copilot Studio Teams channel supports basic voice agents only; real-time voice agents are explicitly unsupported. It calls for classic orchestration (not generative orchestration), tenant enablement by Microsoft, and Copilot Studio tenant/user licensing. Do not use Dynamics 365 real-time voice-agent documentation as proof of Teams channel support. Teams channel prerequisites and limitations · Separate Dynamics 365 real-time offering.

Teams Phone Agent remains Frontier Public Preview; direct-dial Copilot Studio is also preview. Native RA transfer, tools, and recording features have their own boundaries. These are not GA replacements with automatic parity for Cascade, VoiceLive, arbitrary outbound calls, or SIP automation. Product status and limitations.

Licenses & permissions

Choose what you want to enable. These are the building blocks to arrange — not a check of your tenant's entitlements.

Make ACS-only phone calls

PeopleNo Teams / E7 licenseFor the ACS-only path

App / serviceAzure + ACS resourceNo Teams resource account

Connectivity / usageACS number + callingAI and hosting billed separately

If you add a Teams recipient: Teams Phone and voice enablement are required.

Microsoft prerequisites · Full requirements

Connect the Python agent to Teams via ACS

PeopleTeams + Phone SystemHuman agents: Enterprise Voice enabled

App / serviceTeams Phone Resource AccountAcquire and assign the RA license

Connectivity / usagePSTN route + ACS usageAI and hosting billed separately

Calling Plan outbound: the RA needs PAYG + funding. ACS association and server authorization still apply.

Microsoft requirements · Full requirements

Build a Graph PSTN bot

PeopleTeams user rightsDepends on the calling scenario

App / serviceTeams Phone Resource AccountFor the numbered bot instance

Connectivity / usagePSTN + Azure media hostingWindows/.NET media service + AI

Check topology: the bot number guide uses a Calling Plan. Graph admin consent is separate.

Microsoft requirements · Full requirements

Connect a SIP gateway to Teams

PeopleTeams + Phone SystemFor Teams Direct Routing users

App / serviceVendor platform termsRA license only if using Teams voice-app RAs

Connectivity / usageCarrier + SBC + gatewayApp and AI usage are separate

Direct Routing: no Microsoft Calling Plan required for that route. Confirm the vendor's media/API licensing.

Microsoft requirements · Full requirements

Enable a native Teams Phone Agent

TenantAt least one Teams Phone licenseVoice-app base requirement

App / serviceTeams Phone Resource AccountOne license per RA

Connectivity / usageNumber + PSTN fundingPreview admission is separate

Frontier preview: no extra Teams Phone licensing for base features. Optional features have separate entitlements.

Microsoft requirements · Full requirements

Put a Copilot Studio agent on the phone

Tenant / makerTeams Phone + Copilot StudioStudio tenant + user entitlements

App / serviceTeams Phone Resource AccountFor the AI Agent RA

Connectivity / usageCopilot Credits / PAYG + PSTNDon't assume E7 funds anonymous calls

Channel gate: basic voice only, with Microsoft-enabled preview access.

Microsoft requirements · Full requirements

Already have a user suite?

E7 is not a blanket prerequisite.

E5 / E7: Phone System included
Base without Phone System, e.g. E3: Add Teams Phone Standard
E5 (no Teams): Add Teams access; keep Phone System

Confirm assigned service plans. Phone System is not PSTN minutes; RA licenses are separate. E7 source · Phone licensing · Exact suite combinations.

Adding queues, bookings, automation, or recording?

Queues App: Teams Premium for its users
Bookings tools: Appropriate Bookings entitlement
Power Automate: Appropriate flow licensing
Recording: SharePoint/storage or compliance-partner terms

Microsoft feature-specific requirements.

Full licensing requirements, permissions & Microsoft sources

Detailed requirements by architecture

E7 is not a blanket prerequisite. Microsoft 365 E7 bundles E5, Microsoft Copilot, Microsoft Entra Suite, and Agent 365. E5 includes Phone System rights; check the assigned Teams and Phone System service plans before adding a separate Teams Phone Standard license. The cited voice prerequisites do not specify E7 as a universal requirement. E7 bundle · Teams Phone licensing.

Human phone-user entitlement below means access to both Microsoft Teams and Microsoft 365 Phone System, supplied through a qualifying bundle or add-on. See E7, E5, and E3 examples. Resource accounts use their own license, not a human E7/E5 seat.

Which licenses belong to which architecture?
Architecture	Human user / tenant	Application identity	Connectivity + consumption
1. Standalone ACS	No E7 or Teams Phone requirement in the ACS-only prerequisites. Added Teams recipients need Teams Phone and voice enablement.	Azure subscription and ACS resource; an ACS phone number for the documented PSTN flow. No Teams RA for the ACS-only path.	ACS usage, AI services, and app hosting. Public ACS prerequisites.
2. Teams via ACS/TPE	Teams + Teams Phone entitlement for each human agent, plus Enterprise Voice enablement. See the bundle/add-on examples.	Teams Phone Resource Account license for the designated RA, plus its ACS association and server access assignment.	Selected PSTN route/funding and ACS/AI consumption. RA-originated Calling Plan calls have specific PAYG requirements. TPE licensing and charges.
3. Graph PSTN bot	E7 is not listed as a bot prerequisite. Human Teams users follow their scenario's licensing rules; Graph admin consent is separate.	A numbered application instance/RA with the Teams Phone Resource Account license (called “virtual user” in the bot guide).	The bot guide specifies a Calling Plan; validate current funding and the selected topology. Budget Azure Windows/.NET media hosting and AI separately. Bot number licensing.
4. SIP / Connect	Teams + Teams Phone for Teams Direct Routing users. Other contact-center agents follow the vendor's licensing terms.	An RA license is needed if the design uses Teams voice-app resource accounts; it is not a per-SBC license.	Carrier/SBC/gateway and app/AI charges. Direct Routing does not require buying a Microsoft Calling Plan for that route. Direct Routing licenses · PSTN licensing.
5a. Native Teams Phone Agent	Tenant: at least one Teams Phone license. Base Teams Phone Agent requires no extra Teams Phone licensing during Frontier Public Preview.	Teams Phone Resource Account license for each RA. Preview eligibility and configuration still apply.	Number/PSTN connectivity and applicable outbound funding. Bookings, Power Automate, and other optional features have their own entitlements. Voice-app licensing.
5b. Copilot Studio on Teams Phone	Channel: Copilot Studio tenant + user licenses, plus applicable Teams Phone licenses. Confirm bundle entitlements; do not assume E7 alone covers the channel.	Teams Phone Resource Account license for the AI Agent RA, and Microsoft-enabled preview access.	Copilot Studio funding (Copilot Credits / applicable PAYG) plus PSTN costs. Internal Copilot-agent benefits are not a blanket allowance for anonymous phone traffic. Channel requirements · RA setup · Consumption licensing.

Teams Phone supplies Phone System/PBX rights, not PSTN minutes. Choose Calling Plans, Operator Connect, or Direct Routing and fund that connectivity separately. E7's “Frontier Suite” name is not admission to the Frontier Public Preview. Check the product's actual eligibility and tenant enablement. Licenses also do not grant TPE server access or Graph application consent.

Use this as a scenario checklist, not a pricing quote or universal role recipe. Confirm the exact SKU, service plans, region, carrier, and commercial agreement.

Human users: E7, E5, or a Teams Phone add-on?

Existing license	What it covers	What still needs attention
Microsoft 365 E7	Includes E5 plus Microsoft Copilot, Microsoft Entra Suite, and Agent 365. E5 includes Phone System rights; avoid duplicating a Phone Standard entitlement already supplied by the suite.	Confirm the selected edition supplies Microsoft Teams as well as Microsoft 365 Phone System. RA licensing, PSTN funding, preview access, and channel-specific consumption remain separate. E7 components.
Microsoft 365 E5	The Teams Phone licensing guide says E5 includes Phone System; a separate Teams Phone Standard license is not needed.	E5 (no Teams) still includes Phone System, but needs a Teams license such as Microsoft Teams Enterprise. The documented legacy E5 combination includes both. “No Teams” does not mean “no Phone System.” Documented E5 combinations.
Eligible base without Phone System (for example, Microsoft 365 E3)	Add Microsoft Teams Phone Standard, and ensure the user also has Teams access. Phone Standard has eligible base-license prerequisites.	If Microsoft supplies the PSTN service, add the appropriate Calling Plan or choose a Phone-with-Calling-Plan bundle. For Operator Connect / Direct Routing, arrange carrier connectivity instead. Add-on prerequisites and PSTN choices.

RA license ≠ a human Teams Phone license. Microsoft states that Teams Phone Resource Account licenses cost zero, but they must still be acquired and assigned. Do not assign Teams Phone Standard to an RA. Teams Enterprise is not required for the voice-application resource account itself. RA license rules · Voice-application considerations.

Optional features, not universal prerequisites: Queues App users require Teams Premium; Bookings tools need the appropriate Bookings entitlement; Power Automate scenarios need the appropriate Power Automate licensing. Recording has SharePoint/storage or third-party compliance-recording requirements. These are not automatically covered merely because an agent can answer a call. Feature-specific requirements.

Plan an admin handoff, not permanent broad access. RA management guidance requires User Administrator plus an appropriate Teams role, with operation-specific editing restrictions. Teams Administrator, Teams Communications Administrator, and Teams Telephony Administrator have different voice-management scopes. Assign the documented roles for the provisioning task; application runtime credentials are a separate concern. RA administration · Teams roles.

Outbound Calling Plan funding: TPE guidance specifies PAYG Calling Plan plus appropriate funding for RA-originated Calling Plan traffic after 1 November 2025; Direct Routing numbers are unaffected by that change, while Operator Connect requires carrier coordination. Other voice-app pages use different funding phrasing. Validate the exact commercial scenario rather than promising free outbound calls. TPE server guidance · Current voice-app outbound guidance.

Graph: consent to the operations you actually implement

Operation	Application permission	Scope note / source
Create outgoing 1:1/PSTN call; transfer	`Calls.Initiate.All`	Create / transfer; number and scenario prerequisites still apply.
Create a group call	`Calls.InitiateGroupCall.All`	Choose only if implementing the group scenario. The name uses singular `GroupCall`.
Answer; group/meeting join as applicable	`Calls.JoinGroupCall.All`; `Calls.JoinGroupCallAsGuest.All` for the documented guest/higher-privilege case	Answer permission table. Do not substitute a chat-scoped RSC grant for tenant-wide PSTN authorization.
Application-hosted media access	Add `Calls.AccessMedia.All`	Required in addition to relevant call permissions, not instead of them.

These tenant-wide application grants require admin consent. Delegated permissions are not supported for the cited create/answer/transfer operations. Request only the relevant set; the bot-number tutorial is not a reason to grant every example permission. Graph permissions reference.

TPE: server access is not client-user consent

The documented server flow associates the RA with the ACS resource, then the ACS resource owner creates a Teams access assignment for the tenant/RA with principalType: "teamsResourceAccount". The separate Calling SDK client-user flow uses TeamsExtension.ManageCalls, admin consent, and permitted client IDs; do not present that as the server-only Call Automation grant. Optional Graph RA discovery uses a beta endpoint and is not a production prerequisite when administrators already provide the RA object ID. Server vs client assignments · Provisioning and discovery.

Human handoff: acceptance is not completion

Every path needs an observed outcome and a failure fallback. A YAML agent handoff changes the AI persona, not the telephone call.

Destination, transfer, outcome & recovery checklist

Resolve

Teams identity vs E.164 number; tenant scope, destination allowlist, caller consent, and identity policy.

Attempt

Blind vs consultative; hold/media ownership, new call legs, timeout, and correlation ID.

Observe

Accepted vs completed; asynchronous callback/notification, busy, no answer, rejection, and disconnect.

Recover

Retain caller or offer a designed fallback; avoid duplicate transfers; release only the correct media/legs.

Context is a separate data path. A summary, authentication state, transcript, and CRM reference do not automatically travel with a phone call. Use an authorized integration, scoped identifiers, and explicit retention/access policy. SIP headers or TPE context headers are not a universal human-desktop context protocol. TPE context and feature scope.

What changes in each configuration

Start with the current ACS stack on the left. Pick a target to see what stays, what is replaced, and the new connection to build.

Keep Existing component Replace New owner Adapt Reuse behind a new interface

Design mappings, not implemented configurations. “Keep” means intended reuse, not automatic compatibility. Baseline: public runtime.

Teams via ACS: change identity, keep the voice stack

Current ACS components mapped to Teams Phone via ACS/TPE
Component	Current ACS	Teams via ACS/TPE
Number / identity	ACS phone number	ReplaceTeams service number + resource account
Call control	ACS Call Automation	AdaptSame API, with TeamsAppSource identity
Call events	Event Grid + ACS callbacks	KeepEvent Grid + ACS callbacks
Audio bridge	ACS duplex media WSS	KeepACS duplex media WSS
Conversation	Python Cascade / VoiceLive	KeepSame native engine
Agents / tools	YAML + tool registry	KeepSame business definitions
App state	Redis / Cosmos	KeepSame app persistence

Add: Teams RA provisioning + TPE/ACS access assignment + PSTN route. Direct Routing also needs a certified SBC.

ACS is still in both control and media. TPE model · Call identity · Flows & limits · Licenses.

Graph bot: replace the ACS control and media layer

Current ACS components mapped to a Graph calling bot
Component	Current ACS	Graph calling bot
Number / identity	ACS phone number	ReplaceNumbered Teams application instance / RA
Call control	ACS Call Automation	ReplaceGraph calling bot + REST control
Call events	Event Grid + ACS callbacks	ReplaceGraph call notifications to bot callback
Audio bridge	ACS duplex media WSS	ReplaceWindows/.NET media SDK + custom bridge
Conversation	Python Cascade / VoiceLive	AdaptRetain engine behind the new bridge
Agents / tools	YAML + tool registry	AdaptKeep agent definitions; swap telephony tools
App state	Redis / Cosmos	AdaptRetain storage; map bot/call identities

Add: Azure Windows media host with per-call affinity, public endpoints, Graph consent, and a Python control/audio bridge.

Graph REST carries control, not PCM. Media-platform preview/support constraints still apply. Call control · Media host · Flows & limits · Licenses.

SIP gateway: replace ACS with a vendor-owned bridge

Current ACS components mapped to a SIP gateway with Teams Direct Routing
Component	Current ACS	SIP gateway + Teams
Number / identity	ACS phone number	ReplaceCarrier / Teams number and routing
Call control	ACS Call Automation	ReplaceGateway / B2BUA call-control contract
Call events	Event Grid + ACS callbacks	ReplaceVendor call-state events
Audio bridge	ACS duplex media WSS	ReplaceGateway RTP/SRTP + confirmed duplex API
Conversation	Python Cascade / VoiceLive	AdaptRetain engine behind new channel bridge
Agents / tools	YAML + tool registry	AdaptKeep agent definitions; swap telephony tools
App state	Redis / Cosmos	AdaptRetain storage; map vendor session IDs

Add: selected gateway + certified SBC/Direct Routing + a codec, pacing, interruption, and control bridge.

The SBC alone is not the bridge. Duplex media and transfers depend on the vendor/topology. Connect model · Flows & limits · Licenses.

Managed agent: replace the conversational runtime too

Current ACS components mapped to a managed Teams Phone Agent or Copilot Studio voice agent
Component	Current ACS	Managed Teams / Copilot agent
Number / identity	ACS phone number	ReplaceTeams voice-app / AI Agent RA + number
Call control	ACS Call Automation	ReplaceProduct-managed call routing
Call events	Event Grid + ACS callbacks	ReplaceProduct event/connector surface, if supported
Audio bridge	ACS duplex media WSS	ReplaceManaged audio; no custom PCM endpoint
Conversation	Python Cascade / VoiceLive	ReplaceProduct-hosted voice agent
Agents / tools	YAML + tool registry	AdaptRebuild prompts / knowledge / connectors
App state	Redis / Cosmos	ReplaceProduct conversation state; external data via supported connectors

Add: product configuration + supported tools/connectors. The Python voice loop is not connected to this path.

Preview and channel limits remain. Copilot Teams voice is basic-only; Microsoft's internal service stack is not disclosed. Native setup · Flows & limits · Native licenses · Copilot licenses.

Outside these voice swaps: existing email/SMS integrations do not change automatically. Replacing voice components does not replace other ACS dependencies. For retained Python code, use the runtime extension boundaries.

Sources & revision dates

Public sources retrieved 20 September 2026. Page-update dates are not release dates. Product claims below rely on public documentation; proposed integration designs remain recommendations.

Full Microsoft reference register & unresolved decisions

Evidence area	Primary Microsoft references	Revision / boundary
Integration taxonomy	Teams contact-center models	2026-07-29. Unify / Extend / Connect and separate solution certification.
TPE architecture	Overview; FAQ; Capabilities	2026-07-16 / 2026-09-01 / 2026-07-23. FAQ initial-GA PSTN scope; matrix is scenario-specific.
TPE setup and grants	Server outbound; Provisioning; Access assignment; Connectivity/cost	2026-09-07 / 2026-08-27 / 2026-07-17 / 2026-07-17. Server and client consent are separate.
Python TeamsAppSource	Python client API; SDK changelog	API retrieved 2026-09-20; stable 1.5.0 entry dated 2025-09-10.
Graph call control	Create; Answer; Transfer; Bot phone number; Permissions reference	2025-08-27 / 2025-12-03 / 2025-07-23 / 2025-08-06 / 2026-09-15. REST v1.0, documented PSTN scenarios, application grants.
Graph raw media	Application-hosted media requirements	2026-07-22. Developer-preview label remains; Windows/Azure, instance reachability, affinity, SDK freshness.
Routing and SIP	Direct Routing plan; SIP transfer; ACS infrastructure	2026-09-17 / 2026-08-21 / 2026-03-25. Directional transfer rules and separate ACS/Teams SBC FQDNs.
Third-party voice agents	Support boundaries; Setup / known issues	2026-08-17; setup `ms.date` 2026-08-31. Certified-partner support; explicit ACS/Event Grid; specific external-transfer failure.
Managed products	Teams Phone Agent; Direct-dial Copilot Studio; Copilot Teams channel	2026-09-17; direct-dial `ms.date` 2026-08-31; channel 2026-08-18. Preview/gating and basic-only channel limits.
Licenses and roles	Voice-app licensing; RA license; Admin roles; RA permissions	Licensing 2026-09-04 / 2026-04-27; roles 2026-07-28. RA permissions retrieved 2026-09-20. Commercial wording is not fully aligned across articles.
E7 / E5 / Teams Phone	E7 bundle components; Teams Phone licensing and user combinations	2026-09-09 / 2026-07-28. Suite entitlements, no-Teams variants, human users vs resource accounts, and separate PSTN connectivity.
Consumption and channel licensing	Copilot Studio billing/licensing; ACS-only call prerequisites	Copilot Studio 2026-08-03; ACS guide retrieved 2026-09-20. Do not infer external voice-channel funding from a user suite or confuse Azure consumption with Teams licenses.
Lifecycle notice	Public Microsoft notice	Notice `ms.date` 2026-02-25. A general warning only; no service-specific deadlines or migration entitlements are inferred.

Open decisions: lifecycle terms; exact license/funding agreement; certified-solution support; Graph media production support; SIP vendor/duplex contract; topology-specific transfer and media bypass; managed-preview eligibility. This page deliberately leaves those unresolved rather than inventing entitlements, costs, endpoints, or support guarantees.