Inquiry regarding Teams Media Codecs, Protocols, and Unlisted IP Ranges (48.x and 20.x) detected during Packet Analysis

Hi kdh

Thank you for reaching out to Microsoft Q&A forum

Based on the information you provided, I conducted some research and testing in my own environment, and uncovered several insights regarding your questions:

1/ Is Satin being used as the default for audio, or are SILK and G.722 still prioritized depending on the bandwidth?

As far as I know, Satin is now the default audio codec in Microsoft Teams. Microsoft introduced Satin to replace the older SILK and G.722 codecs, and it has been rolled out as the primary codec for all Teams calls (initially two-party calls, later meetings). In practice, Satin is prioritized for all bandwidth conditions, SILK and G.722 are no longer used in normal scenarios.

Link information: https://techcommunity.microsoft.com/blog/microsoftteamsblog/satin-microsoft%E2%80%99s-latest-ai-powered-audio-codec-for-real-time-communications/2141382

2/ For video, is H.264 (AVC/SVC) the primary codec, or has AV1 been fully implemented for standard client calls?

H.264 (AVC) remains the primary video codec for standard Teams video streams. Microsoft Teams has added support for AV1 video encoding, but it is not fully deployed for all calls. In late 2023 Microsoft began using AV1 in Teams meetings (and enabled it for screen sharing in March 2024) to improve quality and reduce bandwidth.

However, AV1 is only used when all participants’ devices support it, such as during screen sharing or on capable hardware; otherwise, Teams automatically falls back to H.264 for compatibility.

Link information: https://techcommunity.microsoft.com/blog/microsoftteamsblog/enhancing-screen-sharing-with-av1-in-microsoft-teams/4096056

3/ Does Teams still primarily use SRTP over UDP (ports 3478-3481)?

Yes, Microsoft Teams uses Secure RTP (SRTP) over UDP as the primary transport for audio, video, and sharing streams. Indeed, Teams clients send media over UDP ports 3478–3481 by default. These UDP ports are reserved for Teams media (3478 for STUN signaling, and 3479–3481 for the actual encrypted media traffic). Moreover, using UDP allows Teams to minimize latency and optimize call quality.

Link reference: https://learn.microsoft.com/en-us/microsoftteams/microsoft-teams-online-call-flows

4/ In what specific scenarios does it fallback to STUN/TURN or TCP/443?

Based on my research, Teams will fall back to using TURN relays and TCP/443 (TLS) in situations where UDP cannot be used. Specifically, during call setup Teams attempts direct UDP connectivity via STUN on 3478, if a direct peer-to-peer path or UDP relay path fails (e.g. due to strict firewalls or NAT), Teams uses its cloud TURN servers over TCP port 443 to relay media.

In this fallback scenario, the media is still SRTP but gets encapsulated in TLS packets on port 443 (essentially tunneling through HTTPS). This typically happens in networks that block UDP or when clients are behind symmetric NATs. In short, UDP 3478–3481 is tried first for media, and TCP 443 (via TURN) is used as a last resort to keep the call connected.

5/ Could you confirm if these ranges are now officially used for Teams Media Optimization or Transport Relays? If so, why are they missing from the ID 11 Teams-specific list, and should we officially whiltelist the entire Azure IP range for Teams quality?

In short, Microsoft Teams does use some 20.x.x.x and 48.x.x.x IP ranges for media transport, but these are part of broader Azure infrastructure and not listed under the Teams-specific ID 11 endpoint set. Microsoft only includes dedicated Teams IPs in that list. Organizations should not whitelist the entire Azure IP space, instead, follow Microsoft’s official guidance by allowing the documented Teams IPs and required FQDNs. This ensures necessary media traffic is permitted without overexposing the network.

You can read here for more information:

Microsoft 365 URLs and IP address ranges

Network recommendations

Hope that helps clarify it, for any further concern, kindly let me know

Best regards

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.