Microsoft Teams access and Edge SWG
Article ID: 227439
Updated On:
Products
Issue/Introduction
Please note that you really shouldn't be sending teams calls via a proxy, the IP addresses listed as optimize, in this list (the Microsoft doc. with URL below ) need to have directly, unrestricted connection.
Resolution
Please note that you really shouldn't be sending teams calls via a Edge SWG , the IP addresses listed as optimize, in this list (the Microsoft doc. with URL below ) need to have directly, unrestricted connection.
For a quality experience with audio calls Teams needs to be sending UDP/STUN traffic directly, as it's not HTTP it has nothing to do with proxy settings or PAC. Only if these ports are being blocked Teams will attempt to use HTTPS but the reliability and latency suffer. I can't really explain the difference you see, but maybe you've got some elements in your pad which take a long time to respond, for example using isInNet(), isResolvable(), and dnsResolve() are generally unacceptably slow.
Note:
A PAC file only defines what happens to HTTP traffic, it's not at all relevant or considered by UDP, so by definition you can't get teams UDP media to bypass your proxy through a PAC. It relies on your network edge firewalls and DNS allowing traffic to resolve.
Not using a proxy server is recommended:
When it comes to Teams or Skype for Business traffic over proxies, Microsoft recommends bypassing Edge SWG. Edge SWG don't make Teams or Skype for Business more secure because the traffic is already encrypted.
And having a Edge SWG can cause issues. Performance-related problems can be introduced to the environment through latency and packet loss. Issues such as these will result in a negative experience in such Teams or Skype for Business scenarios as audio and video, where real-time streams are essential.
If you need to use a Edge SWG server:
Some organizations have no option to bypass a Edge SWG for Teams or Skype for Business traffic. If that's the case for you, the problems mentioned above need to be kept in mind.
Microsoft also strongly recommends:
Using external DNS resolution
Using direct UDP based routing
Allowing UDP traffic
Following the other recommendations in (Microsoft's) networking guidelines: Prepare your organization's network for Teams.
https://docs.microsoft.com/en-us/microsoftteams/prepare-network
Microsoft Reference Doc: https://docs.microsoft.com/en-us/microsoftteams/proxy-servers-for-skype-for-business-online
Feedback
