Teams RTMP-In: open ports 50118 and 50119 now

If anyone at your organisation streams into Teams — town halls, webinars, all-hands produced through an encoder or a hardware appliance — there is a firewall change worth making before it becomes urgent. Teams RTMP-In is consolidating onto a new endpoint and a new pair of outbound ports. The ports are documented and current. The deadline is real but provisional. Those two facts point to the same action.

What the ports actually are

From Microsoft's Learn page on managing RTMP-In, updated August 14, 2026:

Microsoft's own note on that page states that both stream types will move to *.rtmpingest.mcr.teams.cloud.microsoft and ports 50118/50119 by the end of 2026. No specific day is given. So the second row is where everything lands, and the first row is the configuration most firewalls currently allow.

What the deadline is, precisely

The Message Center notice covering this change, MC1387814, has been revised several times and its current position is worth stating carefully, because it is narrower than the summaries suggest:

• Events already set up with RTMP-In keep working through the end of 2026.
• Newly created events “may fail after December 31, 2026” if the network changes are missing.
• The notice's body text refers to action required by January 31, 2027, while its own act-by metadata field shows September 1, 2026 — the two do not agree.
• The rollout is paused. It was paused in July 2026 and, as of the September 4, 2026 revision, remained paused, with Microsoft saying it will announce through the Message Center when it is ready to proceed.

So the correct summary is not “Teams meetings break on January 1.” It is that new events created after the turn of the year may fail if you have not made a network change, on a schedule Microsoft has itself suspended and has not yet restarted.

Why we would still do it this month

Because the cost of acting is a change ticket and the cost of not acting is an incident during event season. Opening two outbound TCP ports to a named Microsoft endpoint is about as small as network changes get, it is reversible, and it is already required today for anyone using an additional RTMP stream — independent of any consolidation deadline.

The failure mode if you wait is specific and bad: a paused rollout resumes with limited notice, and the person who discovers the gap is a communications lead whose all-hands will not start. That is a change-control conversation you get to have calmly in September or urgently in January.

How to confirm the change actually took

A firewall rule that exists is not the same as a path that works, and RTMP-In gives you very little diagnostic feedback — a blocked stream usually presents as an encoder that connects and then simply never appears in the event. Three checks, cheapest first:

1. Test the egress path from the network the encoder actually sits on, not from a laptop on the corporate VLAN. Production streaming kit is frequently on a separate segment with its own rules, and that segment is the one that matters. A successful test from the wrong subnet is the most common false pass here.
2. Confirm the rule matches the right domain. Check that it covers *.rtmpingest.mcr.teams.cloud.microsoft specifically. A rule written against *.teams.microsoft.com will look correct in a review and will not match the new endpoint.
3. Run a real additional-stream event end to end before you need one. A single stream can succeed on the old endpoint while an additional stream fails on the new one, so testing the simple case proves nothing about the case that breaks. Book a throwaway town hall, add the second stream, and watch it arrive.

If you use an outbound proxy or TLS inspection, add one more: RTMPS on 50119 through an inspecting proxy is a common failure point, and the symptom is indistinguishable from a closed port. Exempt the endpoint from inspection rather than debugging it during an event.

Sources

Microsoft Learn, Manage RTMP-In for Teams meetings and events (updated August 14, 2026). Note that the older microsoftteams/rtmp-in URL now returns 404; this is the current page. Message Center notice MC1387814 is cited as reported, not quoted.

The 30-second version

Teams RTMP-In is consolidating onto *.rtmpingest.mcr.teams.cloud.microsoft with outbound TCP 50118 and 50119 by the end of 2026. Existing events keep working through 2026; newly created events may fail after December 31. The rollout is paused and Microsoft has not said when it resumes. Open the two ports now anyway — it is required for additional streams today, it is reversible, and the alternative is a firewall change under pressure in January.