ms-teams.exe outbound connections to external IP.

Mane, Nikhil 0 Reputation points
2026-09-19T09:54:55.6566667+00:00

We observed ms-teams.exe creating a network connection during a Teams call/screen-sharing session. We would like Microsoft to confirm:

Whether Teams can establish direct peer-to-peer media connections to another participant's public IP.

Under which conditions Direct Media Connection is used instead of Microsoft Transport Relays.

Whether Teams screen-sharing traffic can ever legitimately use destination port 3389.

Microsoft Teams | Microsoft Teams for business | Meetings and calls | Screen sharing
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jayden-P 3,045 Reputation points Independent Advisor
    2026-09-19T10:08:03.81+00:00

    Hi @Mane, Nikhil

    Based on the official Microsoft documentation provided, the AI answer appears to be correct.

    Microsoft states that Teams media connectivity is implemented using the standard IETF Interactive Connectivity Establishment (ICE) framework, which allows Teams to evaluate and select the most efficient media path available.

    Regarding destination port 3389, I could not find any Microsoft documentation identifying TCP/UDP 3389 as a standard Teams media or screen-sharing destination port. Based on the published Teams networking and call flow documentation, port 3389 is not listed among the expected Teams media ports.

    image

    Port 3389 is the default network port used by Microsoft Remote Desktop Protocol (RDP), a Microsoft technology that allows users to remotely access and control another Windows computer or server over a network. Do you use RDP? https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/ports-used-by-rds

    Was this answer helpful?

  2. AI answer

    2026-09-19T09:55:11.4566667+00:00
    • Yes. Teams can establish a direct media path to another participant when ICE connectivity checks determine that a direct path works. The candidate set includes local, relay, and reflexive candidates, and the best working path is selected. If local or reflexive candidates have connectivity, the direct path between clients, including through NAT, is selected for media.
    • Direct media is used instead of Microsoft Transport Relays when direct connectivity is available. From the documented call flows:
      1. If both clients are on the customer network, the direct path should be selected, and this requires direct UDP connectivity within the customer network.
      2. If both clients are nomadic cloud users, direct connectivity can be used depending on the NAT/firewall.
      3. If direct connectivity does not work, a Teams Transport Relay candidate is used.
      4. UDP is highly recommended for media; TCP is supported as a fallback.
    • For Direct Routing media bypass with an SBC, direct media to the SBC public IP is also possible. In that case, media bypass is used when the Teams client can reach the SBC public IP directly, including from an internal network. If the client cannot reach the SBC public IP, media flows through Teams Transport Relays instead. Signaling still flows through Microsoft 365.
    • Screen sharing is real-time media traffic. Teams documentation classifies screen sharing as RTP media traffic and states that media should use the most direct path possible and use UDP rather than TCP for best quality.
    • Destination port 3389 is not listed as a legitimate Teams media destination port in the provided documentation. The documented Teams media-related ports in this context are:
      • UDP 3478, 3479, 3480, 3481 for Teams connectivity to Microsoft 365
      • Client media source port range 50000-50019 in the QoS guidance
      • Direct Routing media bypass client port range 50000-50019
      • Transport Relay destination ports 50000-59999 and 3478-3481
      • Media Processor ports 3478-3481 and 49152-53247
      Based on the provided documentation, port 3389 is not identified as a valid Teams media or screen-sharing destination port.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.