What Is an SBC, and Why Does Your Phone System Need One?

Once your phone lines move off copper and onto the internet, something has to stand at the door. That something is a session border controller. Most businesses have never heard of one, and plenty are running without one when they shouldn't be.

What an SBC is

SBC stands for session border controller. The easiest way to think of it is as border control for phone calls. Every call coming into or leaving your business passes through it, and it checks each one: is it allowed in, does it speak the right language, and is it going where it should?

It can be a physical box in your comms room, software on one of your servers, or a service run in the cloud by your provider. The job is the same either way.

Why it matters now

On the old copper network, your phone lines weren't on the internet, so nobody could reach them from the outside. That changes with the BT switch-off. Once calls travel over an internet connection, your phone system is exposed in a way it never was before, and it needs the same kind of protection your email and servers already have.

What it actually does

• gpp_maybe
  Stops phone fraud

  Automated scanners constantly search the internet for phone systems they can break into. Once in, criminals route expensive international calls through them, usually overnight or at weekends when nobody is watching. An SBC blocks unknown callers, limits call volumes and spots unusual patterns.

• translate
  Translates between systems

  Internet calling follows a common standard called SIP, but every manufacturer and provider speaks a slightly different dialect of it. Teams, an older on-site phone system and a phone line provider often can't talk to each other directly. The SBC sits in the middle and fixes the differences.

• dialpad
  Controls where calls go

  It rewrites numbers into the format each side expects, decides which calls go to which provider, and can send calls to a backup route if one fails.

• lock
  Encrypts calls

  It can scramble both the call setup and the conversation itself, so calls can't be listened in on as they cross the internet.

• sync_alt
  Connects old and new

  During a migration, an SBC lets an old phone system and Teams run side by side, calling each other on extension numbers. Some models also have ISDN or analogue ports, which makes them the "gateway box" I mentioned in my ISDN guide for keeping an old system alive a little longer.

Do you need one?

Examples of models

A handful of manufacturers make most of the SBCs used by UK businesses. This isn't a recommendation of any one of them; the right choice depends on the size of the site, what it connects to, and who will support it.

Most are licensed by the number of calls they can handle at once rather than by user, so a 30-channel site buys capacity for 30 calls, not for every member of staff.

The part people forget: looking after it

An SBC isn't fit-and-forget. It needs its software keeping up to date, particularly for Teams, where Microsoft only supports specific certified versions. It also relies on security certificates that expire, and an expired certificate on an SBC can stop every call in and out of a business in one go. Whoever installs it, make sure someone owns the renewals, the updates and the monitoring afterwards.

And if it's the only route in and out for your calls, it's a single point of failure. For anything business-critical, that usually means a pair, ideally in two locations, or a managed service that builds that in.

Common questions

Certified models for Teams Direct Routing are listed by Microsoft and change over time. Check the current list before buying.