If the dial pad in Teams suddenly disappears after your company updates a network firewall, you are not alone. The dial pad is a core part of the Phone system, and it relies on specific network endpoints to load. When a firewall change blocks or reroutes those endpoints, the dial pad fails to appear even though other Teams features work fine. This article explains the exact network settings that control the dial pad and provides a step-by-step fix to restore it.
You will learn how to verify the firewall rules, update the Teams client, and confirm the dial pad returns. The fix takes about 15 minutes and does not require admin rights for every step. By the end, you can make calls again and prevent the same outage from happening after future network changes.
Key Takeaways: Restoring Teams Dial Pad After Firewall Changes
- Teams admin center > Org-wide settings > Teams apps: Check if the Phone app is enabled for your users.
- Teams client > Settings > Privacy > Network: Verify the client can reach the required media endpoints.
- Firewall rule for teams.microsoft.com: Allow HTTPS traffic to the Teams service and all subdomains to load the dial pad.
- Teams client > Settings > About: Confirm you run the latest Teams version after a network change.
- Teams admin center > Users > Manage users > Policies: Ensure the calling policy allows the dial pad to appear.
Why the Teams Dial Pad Disappears After a Firewall Change
The Teams dial pad is not a static button. It loads dynamically from the Teams web service when you open the Calls tab. The client sends a request to the Teams endpoint teams.microsoft.com and receives the dial pad configuration, including the number keys, call buttons, and your assigned phone number. If the firewall blocks or reroutes that request, the client cannot fetch the dial pad, so the Calls tab shows an empty area or a message that says “Dial pad is unavailable.”
Firewall changes often affect the DNS resolution or the TLS handshake. A new rule might block the IP address that Teams uses for the Calls service, or a proxy might strip the HTTPS headers needed for authentication. The dial pad is especially sensitive because it requires a real-time connection to the media stack. Other Teams tabs like Chat and Files cache their content locally, so they keep working. The Calls tab always fetches fresh data, which makes it the first feature to break.
Another common cause is a policy change that removes the Phone system license or the calling plan. However, your title specifies a network firewall change, so the primary suspect is the network path. Still, you should rule out policy issues first because they are easier to check. The steps below cover both the network and the policy side to give you a complete fix.
What Network Endpoints Does the Dial Pad Depend On?
The dial pad requires access to these endpoints:
teams.microsoft.comand all subdomains for the service configurationapi.teams.skype.comfor the calling APImedia.lync.comfor the media transportlogin.microsoftonline.comfor authentication tokens
If your firewall uses an allowlist, any one of these missing entries can block the dial pad. Check your firewall logs for denied requests to these domains after the change.
Steps to Restore the Teams Dial Pad After a Firewall Change
Follow these steps in order. Each step builds on the previous one. If you do not have admin rights, skip step 2 and ask your IT department to run it.
- Verify the Phone system license and calling policy
Open the Teams admin center at admin.teams.microsoft.com. Go to Users > Manage users and select your account. Check that the Phone System license and a Calling Plan or Direct Routing license are assigned. Then go to Voice > Calling policies and confirm the policy allows the dial pad. If the policy is set to “Disable”, the dial pad will not appear even with a working network. - Check the firewall rules for the required endpoints
On the firewall or proxy, look for rules that block or redirect traffic to the endpoints listed in the previous section. Add or update the rules to allow HTTPS outbound traffic toteams.microsoft.com,api.teams.skype.com,media.lync.com, andlogin.microsoftonline.com. If the firewall uses IP-based rules, allow the IP ranges published by Microsoft for Teams. Do not use a wildcard URL in the rule; specify the exact domain and all subdomains in the rule description. - Clear the Teams client cache
Close Teams completely. Press Ctrl+Shift+Esc to open Task Manager and end any Teams processes. Then open File Explorer and go to%appdata%\Microsoft\Teams. Delete the contents of the Cache, Code Cache, and GPUCache folders. Restart Teams. This forces the client to re-fetch the dial pad configuration instead of using a cached failure. - Sign out and sign back into Teams
Click your profile picture in Teams, then select Sign out. Close Teams. Reopen Teams and sign in with your work account. This refreshes the authentication token and reconnects to the media service. - Update Teams to the latest version
Click your profile picture, then select Check for updates. Teams will download and install the latest version automatically. After the update, restart Teams. Newer versions often include fixes for network-related dial pad issues. - Test the dial pad in a web browser
Open a browser and go to teams.microsoft.com. Sign in with the same account. Navigate to Calls and check if the dial pad appears. If it works in the browser, the issue is specific to the desktop client. If it does not work, the network or policy is still blocking the service.
If Teams Still Has Issues After the Main Fix
Sometimes the dial pad remains missing even after you adjust the firewall. The following issues are the most common and have their own fixes.
Teams Shows “Dial Pad Is Unavailable” in the Desktop App but Works on the Web
This indicates a client-side problem. The desktop app might be using a cached proxy configuration or a corrupted local state. Uninstall Teams completely, then reinstall it from the Microsoft 365 portal. After reinstalling, sign in and test the dial pad.
The Dial Pad Appears but Calls Fail to Connect
The dial pad loads, but the media stream fails. This happens when the firewall blocks UDP ports 3478 through 3481 or TCP port 443 for media traffic. Open those ports for the Teams media endpoints. Check the Teams client logs at %appdata%\Microsoft\Teams\logs.txt for errors related to media connectivity.
Teams Uses a Proxy That Strips the TLS Headers
Some proxies inspect HTTPS traffic and remove headers that Teams needs for authentication. Configure the proxy to bypass inspection for the Teams endpoints. In the Teams client, go to Settings > Network and set the proxy address manually if your organization uses a PAC file. Test with the proxy temporarily disabled to confirm the cause.
Teams Desktop Client vs Teams on the Web: Dial Pad Behavior After Firewall Changes
| Item | Teams Desktop Client | Teams on the Web |
|---|---|---|
| Dial pad loading | Fetches configuration from the Teams service and caches it locally | Fetches configuration fresh on every page load |
| Firewall sensitivity | Higher because it uses long-lived media connections | Lower because it reconnects more often |
| Cache behavior | Can store a failed state that hides the dial pad | Clears cache on browser refresh |
| Fix after firewall change | Clear cache, sign out, update client | Clear browser cache or use an incognito window |
Now you know how to restore the Teams dial pad after a network firewall change. You can verify the policy, adjust the firewall rules, clear the client cache, and test in a browser. If the issue persists, reinstall the client or check the media ports. For future changes, keep the Microsoft Teams firewall documentation handy and test the dial pad immediately after any network update. Use the Teams admin center to review your calling policies before making network changes to avoid a similar outage.