How to Choose a SIP Trunk Provider for a Hosted PBX
How to Choose a SIP Trunk Provider for a Hosted PBX
Tom Reed · Updated 14 October 2026
On a hosted PBX you usually bring your own SIP trunk provider, a model often called bring-your-own-carrier (BYOC). The phone system runs your extensions, apps and call flows; the carrier supplies your numbers and carries calls to and from the public phone network. Choose a provider on number coverage, porting, caller ID rules, fraud spend limits, channel capacity and authentication method, then connect it, test it properly and keep a plan for switching later.
This guide is for small teams that have already decided on a hosted PBX and now need to pick, connect and live with a carrier. It is not a league table and it does not rank or recommend carriers. If you want the basics of what a trunk is first, start with our guide to SIP trunks for small businesses.
What does bring-your-own-carrier mean on a hosted PBX?
A SIP trunk is a voice connection over the internet between your phone system and a carrier, which in turn connects to ordinary phone numbers. With a hosted PBX, the phone system lives in the cloud and the trunk plugs into it rather than into a box in your office.
There are two broad ways a hosted phone system can handle outside calls. Some services bundle numbers and call allowances into the subscription, so one supplier bills you for everything. Others separate the two jobs: the platform runs your phone system and you connect a carrier of your choice for external calls. That second model is BYOC.
SessionPBX uses the BYOC model. In its own words: "Internal team calls are included. For calls to the outside world, connect the SIP trunk you already use — any SIP-compliant carrier works out of the box." SessionPBX does not supply numbers, lines or porting. Your carrier still supplies and bills your numbers and calls; SessionPBX doesn't.
| Question | Bundled service | Bring your own SIP trunk |
|---|---|---|
| Who supplies your phone numbers? | The phone system supplier | Your carrier |
| Who sets your call rates? | The phone system supplier, often as an allowance | Your carrier, billed to you directly |
| Who handles moving numbers in or out? | The phone system supplier | Your carrier |
| Who do you call about caller ID display? | The phone system supplier | Your carrier, plus your PBX settings for which number each person shows |
| Can you change carrier without changing phone system? | Usually not | Yes, if the PBX lets you add and switch trunks |
A quick note on the term. "BYOC" is also used for Microsoft Teams calling, where it means something different. In this guide, BYOC means connecting your own carrier to a hosted PBX. Teams Phone and Teams Business, mentioned below, are SessionPBX plans, not Microsoft Teams.
What should you check before you pick a SIP trunk provider?
Most carrier problems show up after go-live: a number that cannot be moved, a caller ID that displays wrongly, a spend cap that was never set, or a contract that is awkward to leave. Ask about each of these before you sign. The table below is a checklist you can send to any carrier you are considering.
| Criterion | Why it matters | What to ask the carrier |
|---|---|---|
| Number coverage | You need local, national or non-geographic numbers in the places your customers are | Which countries, regions and number types can you supply, and what do you need from us to issue them? |
| Porting in and out | Moving existing numbers is often the slowest part of a switch | Can you port our current numbers in? How do you handle porting out if we leave, and what do you need from us? |
| Outbound caller ID rules | Calls may show the wrong number, or be blocked, if caller ID is not set up to the carrier's rules | Which numbers can we present as caller ID? Can we present numbers held with another carrier, and what verification do you need? |
| Fraud spend caps and alerts | A compromised account can run up international calls quickly | Can we set a hard spend limit, daily or monthly caps, and alerts? Can we block destinations we never call? |
| Concurrent channel limits | Calls beyond your channel limit fail or are rejected | How many simultaneous calls are included, how do we raise the limit, and what happens when we hit it? |
| Authentication method | Your PBX and carrier must agree on how the trunk proves who it is | Do you support IP authentication, credential (username and password) registration, or both? |
| Support hours and route | When calls fail you need someone who can read a trace | What are your support hours, how do we raise an urgent fault, and do you give call-level diagnostics? |
| Exit terms | Long contracts and porting friction make switching costly | What is the notice period, are there early termination charges, and will you release our numbers promptly? |
Regulatory rules sit with the carrier. In the UK, Ofcom sets the rules for number allocation, caller ID and number porting; in the US, the FCC does. As of October 2026 both regulators have rules on what caller ID can be presented, and those rules change from time to time. Your carrier is the party that has to apply them, so ask how it does. This is orientation, not legal advice.
Coverage beats price. A carrier that is cheap for calls but cannot issue numbers in an area you need, or cannot port your existing numbers, will cost you more in workarounds than you save.
Get exit terms in writing. The most useful thing BYOC gives you is the freedom to change carrier later. That only works if your carrier will release your numbers without a fight.
How do IP authentication and credential authentication differ?
Your carrier needs to know that calls arriving on your trunk really come from your phone system, and your phone system needs to know which carrier is sending inbound calls. There are two common ways to do this.
IP authentication trusts traffic from known addresses. You tell the carrier which addresses your hosted PBX sends calls from, and the carrier accepts calls from those addresses only. There is no password to leak, but you depend on the address list staying correct.
Credential authentication (sometimes called registration) works like a login. The PBX registers with the carrier using a username and password, and the carrier accepts calls from that registration. It is simpler to set up when addresses change, but the password becomes something you must protect and rotate.
Which should you use? Whatever your carrier supports and recommends. SessionPBX supports both: "Register with your carrier by IP or by credentials — whichever your provider prefers." If you use credentials, the platform says "Your SIP trunk usernames and passwords are stored encrypted at rest with AES-256-GCM."
Authentication is only half of the network story. Firewalls and routers at your office also affect call quality and registration for your team's apps. Our VoIP firewall ports checklist covers that side.
How do you connect a SIP trunk to a hosted PBX and test it?
The exact screens differ by platform, but the order of work is similar everywhere. On SessionPBX this happens in the admin portal, and each inbound number can then be routed: "Give each inbound number its own route to a person, group, queue or call flow."
Connect-and-test checklist
- Collect the carrier details. Trunk host or proxy, authentication method, credentials or IP allowlist entries, and the list of numbers on the account.
- Set up authentication on both sides. Add your PBX addresses to the carrier's allowlist, or enter the carrier's credentials in your PBX. Check that both sides agree on the method.
- Add the trunk in your PBX admin portal. Name it clearly, for example by carrier and purpose, so a second trunk later is easy to tell apart.
- Route each inbound number. Send each number to the right person, ring group, queue or call flow. Decide what happens out of hours.
- Set outbound caller ID. Choose which connected number each member presents. SessionPBX lets you "set each member's outbound caller ID from your connected numbers."
- Test inbound calls. Call each number from an outside line and confirm it reaches the right destination and shows the right caller.
- Test outbound calls. Call outside numbers, including a landline and a mobile, and check the caller ID shown to the person you call.
- Test failure cases. Make several calls at the same time to confirm your channel limit, and temporarily break authentication in a quiet period to confirm you get a clear failed-registration or rejected-call result rather than silence.
If you are still deciding how calls should flow once they arrive, our guide to the PBX phone system explains the building blocks.
How do you size channels without overbuying?
A channel is one simultaneous external call. The number you need depends on how many outside calls happen at the same moment at your busiest time, not on how many people you employ.
Look at your busiest periods in your current call logs, allow some headroom for growth and unusual days, and ask your carrier how quickly it can raise the limit. Internal calls do not use trunk channels on SessionPBX: "Team-to-team calls never leave our network — no PSTN cost, no per-minute charges. Only external calls hit your SIP trunk." For a fuller method, see how many SIP channels you need.
How do you limit toll fraud when the trunk is live?
Toll fraud is when someone gains access to your trunk or phone system and uses it to make calls you pay for, often to expensive international destinations.
Layer your defences:
- Set spend caps at the carrier. A hard limit, plus daily or monthly caps and email alerts, is your last line of defence. Ask your carrier which of these it offers before go-live.
- Block destinations you never call. If your business has no reason to call certain countries or premium-rate ranges, ask the carrier to bar them and restrict international dialling in your PBX to the people who need it.
- Use IP allowlists where possible. Accepting calls only from known addresses removes a whole class of password-guessing attacks.
- Protect credentials. Long, unique trunk passwords, limited admin access and prompt changes when people leave.
On the platform side, SessionPBX says "IP access controls and automated blocking help protect your phone system against repeated login attempts, suspicious traffic, and toll fraud." That helps, but it does not replace carrier-side spend limits; set both. Our VoIP toll fraud prevention guide goes deeper on warning signs and response.
How do you switch SIP trunks later without downtime?
Rates change, coverage needs change and support quality changes. With BYOC you can change carrier without changing your phone system, but numbers and caller ID need care so callers never notice. SessionPBX describes it as "no lock-in — switch trunks in the admin portal whenever your rates change", and adds "You pay your carrier what your carrier charges."
Switch-trunk playbook
- Prepare the new carrier. Open the account, agree exit terms in writing, set spend caps and allowlists, and confirm it can port your numbers in.
- Add the second trunk alongside the first. Keep the old trunk live. Give the new one a clear name in your PBX.
- Dual-run outbound first. Move a small group of users, or one route, to the new trunk for outbound calls. Check caller ID and call quality for a few working days.
- Port numbers in batches. Ask the new carrier to port your least critical numbers first. Each time a number moves, confirm that its inbound route still reaches the right person, group, queue or call flow.
- Cut over the rest. Move remaining outbound routes and the main numbers once the trial batches are clean. Pick a quiet period and keep the old trunk connected until every number has moved.
- Decommission the old trunk. Remove it from your PBX, revoke its credentials or allowlist entries, and close the old account only after the final invoice and porting confirmations.
Choosing a carrier for SessionPBX
If you are evaluating SessionPBX, the carrier choice is yours. The platform says "Any SIP-compliant carrier works", and "You bring the trunk, we handle the routing, and you pay your carrier direct." Teams Phone covers everyday calling "with SIP trunks for external calls"; Teams Business adds ring groups, queues, call flows and recording. Both are SessionPBX plans, not Microsoft Teams. Compare plans and start a free trial on the SessionPBX hosted PBX page. For a broader view of cloud systems, see our guide to the cloud-based phone system.
FAQ
Does a hosted PBX include phone numbers?
It depends on the service. Some bundle numbers in; others use a bring-your-own-carrier model. SessionPBX does not supply numbers: you get numbers from your SIP carrier, connect the trunk, and the carrier bills you directly for numbers and calls.
What is BYOC on a business phone system?
BYOC means bring your own carrier. The hosted PBX runs your extensions, apps and call routing, and you connect a SIP trunk from a carrier you choose for calls to outside numbers. It is not the same thing as BYOC for Microsoft Teams calling, which uses the same term for a different setup.
Can I use any SIP trunk provider with SessionPBX?
SessionPBX says any SIP-compliant carrier works, with IP or credential authentication. Check the carrier against the checklist above, especially number coverage, caller ID rules, spend caps and exit terms, rather than choosing on price alone.
IP authentication or username and password: which should I use?
Use whatever your carrier supports and recommends. Both work on SessionPBX, and trunk credentials are stored encrypted at rest. IP authentication avoids a password to protect; credentials are easier when addresses change.
Can I change SIP trunk providers later?
Yes, if your PBX lets you add and switch trunks, as SessionPBX does in the admin portal. Plan a dual-run: add the new trunk, move outbound routes, port numbers in batches, then remove the old trunk once everything has moved.
