{"id":6144,"date":"2026-02-27T09:01:57","date_gmt":"2026-02-27T07:01:57","guid":{"rendered":"https:\/\/www.msb365.blog\/?p=6144"},"modified":"2026-02-27T09:01:57","modified_gmt":"2026-02-27T07:01:57","slug":"how-to-configure-a-pin-protected-pstn-call-flow-in-microsoft-teams-calling-plans","status":"publish","type":"post","link":"https:\/\/www.msb365.blog\/?p=6144","title":{"rendered":"How to Configure a PIN-Protected PSTN Call Flow in Microsoft Teams (Calling Plans)"},"content":{"rendered":"<style>\n\/* WordPress Compatible CSS for Teams Blog Post *\/\n.teams-blog-post {\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Oxygen-Sans, Ubuntu, Cantarell, \"Helvetica Neue\", sans-serif;\n    line-height: 1.6;\n    color: #333;\n    max-width: 900px;\n    margin: 0 auto;\n    padding: 20px;\n}\n.teams-blog-post h1 {\n    color: #464EB8; \/* Microsoft Teams Purple *\/\n    font-size: 2.5em;\n    border-bottom: 2px solid #E1DFDD;\n    padding-bottom: 10px;\n    margin-bottom: 20px;\n}\n.teams-blog-post h2 {\n    color: #333;\n    font-size: 1.8em;\n    margin-top: 40px;\n    border-left: 4px solid #464EB8;\n    padding-left: 10px;\n}\n.teams-blog-post h3 {\n    color: #555;\n    font-size: 1.4em;\n    margin-top: 30px;\n}\n.teams-blog-post p {\n    margin-bottom: 20px;\n}\n.use-case-box {\n    background-color: #F3F2F1;\n    border: 1px solid #D2D0CE;\n    border-radius: 6px;\n    padding: 20px;\n    margin-bottom: 30px;\n}\n.use-case-box h3 {\n    margin-top: 0;\n    color: #464EB8;\n}\n.pro-con-table {\n    width: 100%;\n    border-collapse: collapse;\n    margin-bottom: 30px;\n}\n.pro-con-table th, .pro-con-table td {\n    border: 1px solid #D2D0CE;\n    padding: 15px;\n    text-align: left;\n    vertical-align: top;\n}\n.pro-con-table th {\n    background-color: #464EB8;\n    color: white;\n    font-size: 1.1em;\n}\n.pro-con-table td:first-child {\n    background-color: #f9fef9;\n}\n.pro-con-table td:last-child {\n    background-color: #fffaf9;\n}\n.step-card {\n    background-color: #ffffff;\n    border: 1px solid #E1DFDD;\n    border-top: 4px solid #464EB8;\n    box-shadow: 0 2px 4px rgba(0,0,0,0.05);\n    padding: 20px;\n    margin-bottom: 20px;\n    border-radius: 4px;\n}\n.step-number {\n    display: inline-block;\n    background-color: #464EB8;\n    color: white;\n    width: 30px;\n    height: 30px;\n    text-align: center;\n    border-radius: 50%;\n    line-height: 30px;\n    font-weight: bold;\n    margin-right: 10px;\n}\n.notice {\n    background-color: #FFF4CE;\n    border-left: 4px solid #FBC11E;\n    padding: 15px;\n    margin: 20px 0;\n    font-size: 0.95em;\n}\ncode {\n    background-color: #F3F2F1;\n    padding: 2px 6px;\n    border-radius: 3px;\n    font-family: Consolas, monospace;\n    font-size: 0.9em;\n    color: #d63384;\n}\n<\/style>\n<div class=\"teams-blog-post\">\n<p>Securing a specific phone number so that only authorized callers can reach the destination is a common request in modern telecommunications. But how do you achieve this in Microsoft Teams Phone when you are using <strong>Microsoft Calling Plans<\/strong> and don&#8217;t have a Session Border Controller (SBC) to handle complex pre-routing logic?<\/p>\n<p>In this guide, we will walk you through a highly effective configuration workaround that uses native Teams features to create a PIN-protected entry point.<\/p>\n<p><em>[Insert your flowchart diagram here showing PSTN call routing with PIN authentication]<\/em><\/p>\n<div class=\"use-case-box\">\n<h3>&#x1f3af; The Use Case: Why Are We Doing This?<\/h3>\n<p>Imagine you have a dedicated VIP support hotline, an emergency IT-escalation number, or an exclusive dial-in for remote field workers. You publish a standard PSTN number, but you only want the call to ring the target team if the caller knows a specific secret code (PIN).<\/p>\n<p><strong>The Desired Flow:<\/strong><\/p>\n<ol>\n<li>Caller dials the PSTN number.<\/li>\n<li>Caller hears an announcement: <em>&#8220;Please enter your access code.&#8221;<\/em><\/li>\n<li><strong>If correct:<\/strong> The call is routed to the target user or Call Queue.<\/li>\n<li><strong>If incorrect \/ no input:<\/strong> The caller is told the code is invalid, and the call drops.<\/li>\n<\/ol><\/div>\n<h2>The Challenge: Microsoft Teams Calling Plans Limitations<\/h2>\n<p>If you use Direct Routing, an SBC (like AudioCodes or Ribbon) would intercept the call, ask for the PIN, verify it, and then forward the call to Teams. However, with <strong>Microsoft Calling Plans<\/strong>, the call goes straight into the Microsoft cloud. Microsoft Teams <strong>does not<\/strong> have a native &#8220;Require PIN&#8221; toggle for Auto Attendants.<\/p>\n<p><strong>The Solution: The &#8220;Dial by Extension&#8221; Hack.<\/strong> We will configure an Auto Attendant to ask for the PIN, but technically, Teams will be using its <em>Dial by extension<\/em> feature. The &#8220;PIN&#8221; will actually be the target user&#8217;s configured extension.<\/p>\n<h2>Pros and Cons of This Configuration<\/h2>\n<table class=\"pro-con-table\">\n<tr>\n<th>&#x2705; Advantages (Why we do it this way)<\/th>\n<th>&#x26a0;&#xfe0f; Disadvantages (What you need to know)<\/th>\n<\/tr>\n<tr>\n<td>\n<ul>\n<li><strong>No Extra Costs:<\/strong> Uses existing Teams Phone licenses and Auto Attendants.<\/li>\n<li><strong>Fully Cloud-Native:<\/strong> No SBC, on-prem hardware, or Azure Communication Services development required.<\/li>\n<li><strong>Simple to Maintain:<\/strong> PINs can be updated by changing a user&#8217;s extension in Entra ID.<\/li>\n<\/ul>\n<\/td>\n<td>\n<ul>\n<li><strong>Not Enterprise-Grade Security:<\/strong> This is a routing trick, not cryptographic multi-factor authentication.<\/li>\n<li><strong>Static System Prompts:<\/strong> If the user enters a wrong PIN, Teams plays a default system message (e.g., <em>&#8220;We didn&#8217;t find a match&#8221;<\/em>) before dropping the call. You cannot fully customize the &#8220;Wrong PIN&#8221; audio prompt.<\/li>\n<li><strong>Directory Search Limits:<\/strong> The PIN (extension) must be uniquely assigned to a user in your directory.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/table>\n<hr>\n<h2>&#x2699;&#xfe0f; Step-by-Step Configuration Guide<\/h2>\n<p>Follow these steps to set up the PIN-protected routing in your Microsoft 365 environment.<\/p>\n<div class=\"step-card\">\n<h3><span class=\"step-number\">1<\/span> Prepare the Target User (Assigning the &#8220;PIN&#8221;)<\/h3>\n<p>First, we need to assign the secret PIN as an extension to the user who should receive the calls.<\/p>\n<ol>\n<li>Go to the <strong>Microsoft 365 Admin Center<\/strong> > <strong>Users<\/strong> > <strong>Active users<\/strong>.<\/li>\n<li>Select the target user (this user must have a Teams Phone license).<\/li>\n<li>Go to <strong>Manage contact information<\/strong>.<\/li>\n<li>In the <strong>Office phone<\/strong> field, enter a dummy number with the desired PIN as the extension. Format it strictly like this: <code>+10000000000;ext=8524<\/code> (Assuming <strong>8524<\/strong> is your desired PIN).<\/li>\n<li>Save the changes. <em>Note: It can take up to 24 hours for the Teams directory sync to recognize the new extension, though it often takes only a few hours.<\/em><\/li>\n<\/ol>\n<div class=\"notice\">\n            <strong>Pro Tip:<\/strong> If you want the call to go to a Call Queue instead of a single person, assign this extension to a &#8220;dummy&#8221; licensed user account, and set that user&#8217;s Teams client to immediately forward all calls to the desired Call Queue.\n        <\/div>\n<\/p><\/div>\n<div class=\"step-card\">\n<h3><span class=\"step-number\">2<\/span> Create the &#8220;PIN Gateway&#8221; Auto Attendant<\/h3>\n<p>Now, we create the Auto Attendant that will act as the gatekeeper.<\/p>\n<ol>\n<li>Open the <strong>Teams Admin Center<\/strong>.<\/li>\n<li>Navigate to <strong>Voice<\/strong> > <strong>Auto attendants<\/strong> and click <strong>Add<\/strong>.<\/li>\n<li>Name it something like <em>AA &#8211; PIN Gateway<\/em>.<\/li>\n<li>Set the <strong>Operator<\/strong> to &#8220;Disconnect&#8221; (since we don&#8217;t want callers bypassing the PIN).<\/li>\n<li>Set the Time Zone and Language. (The language determines the voice of the default system error messages).<\/li>\n<\/ol><\/div>\n<div class=\"step-card\">\n<h3><span class=\"step-number\">3<\/span> Configure Call Flow &#038; Menu Options<\/h3>\n<p>This is where the magic happens. We will use the Menu Options to force the caller to interact, allowing the Directory Search to capture their DTMF (keypad) input.<\/p>\n<ol>\n<li>Under <strong>Call flow<\/strong>, choose <strong>Play menu options<\/strong>.<\/li>\n<li>For the audio, choose <strong>Play an audio file<\/strong>. Upload a professionally recorded MP3 or WAV file that says: <em>&#8220;Welcome. Please enter your 4-digit access code to proceed. If you do not have a code, please hang up.&#8221;<\/em><\/li>\n<li><strong>Crucial Step:<\/strong> Do NOT assign any keys (0-9) to routing options. Leave the dial pad assignments empty.<\/li>\n<li>Under <strong>Directory search<\/strong>, select <strong>Dial by extension<\/strong>.<\/li>\n<\/ol>\n<p><strong>What happens here?<\/strong> The Auto Attendant plays your custom audio. Because &#8220;Dial by extension&#8221; is enabled, it listens for keypad inputs. If the caller types <code>8524<\/code>, the system searches the directory, finds the user from Step 1, and routes the call to them.<\/p>\n<\/p><\/div>\n<div class=\"step-card\">\n<h3><span class=\"step-number\">4<\/span> Configure Default Routing (For incorrect \/ no PIN)<\/h3>\n<p>We must define what happens if the caller just waits and presses nothing.<\/p>\n<ol>\n<li>Still in the <strong>Call flow<\/strong> section, look for the setting regarding what happens when callers don&#8217;t make a choice (Timeout).<\/li>\n<li>Set the default action to <strong>Disconnect<\/strong>.<\/li>\n<\/ol>\n<p><strong>What about wrong PINs?<\/strong> If a caller enters <code>1111<\/code>, Teams will look for extension 1111. When it doesn&#8217;t find it, the Microsoft default voice will say <em>&#8220;We couldn&#8217;t find a match.&#8221;<\/em> After a few failed attempts, the system automatically drops the call. This fulfills the requirement that invalid codes cannot proceed.<\/p>\n<\/p><\/div>\n<div class=\"step-card\">\n<h3><span class=\"step-number\">5<\/span> Assign the PSTN Number via Resource Account<\/h3>\n<p>Finally, we need to make this Auto Attendant reachable from the outside world.<\/p>\n<ol>\n<li>Create a new <strong>Resource Account<\/strong> in the Teams Admin Center.<\/li>\n<li>Assign a <em>Microsoft Teams Phone Resource Account<\/em> license to it.<\/li>\n<li>Acquire a PSTN number from your Microsoft Calling Plans inventory and assign it to this Resource Account.<\/li>\n<li>Assign this Resource Account to your newly created Auto Attendant.<\/li>\n<\/ol><\/div>\n<h2>Conclusion<\/h2>\n<p>While Microsoft Teams doesn&#8217;t offer a simple &#8220;PIN toggle,&#8221; utilizing the <em>Dial by extension<\/em> feature provides a robust, zero-cost workaround for Microsoft Calling Plan users. It successfully gates a phone line behind a numeric code, ensuring only authorized callers reach your internal teams, all while keeping your infrastructure 100% in the cloud.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Securing a specific phone number so that only authorized callers can reach the destination is a common request in modern telecommunications. But how do you achieve this in Microsoft Teams Phone when you are using Microsoft Calling Plans and don&#8217;t have a Session Border Controller (SBC) to handle complex pre-routing logic? In this guide, we [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":6146,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1923,15],"tags":[],"class_list":["post-6144","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-365","category-ms-teams"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/6144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6144"}],"version-history":[{"count":1,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/6144\/revisions"}],"predecessor-version":[{"id":6145,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/6144\/revisions\/6145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/media\/6146"}],"wp:attachment":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}