Since Microsoft Teams application uses dynamic IPs it is difficult to track the destination IP for isolation purposes and perform troubleshooting.
To identify the IP, follow the steps below:
In the command prompt of the test computer, enter the following commands:
tasklist | findstr teams
The process ID (PID) handling Teams traffic will be shown.
Example:
ms-teams.exe 20004 Console 1 83,924 K
(20004 is the PID in this example).
Run the next command:
netstat -ano | findstr 20004
(Replace PID 20004).
Output example:
TCP 192.168.68.51:61630 52.123.176.146:443 ESTABLISHED 20004
(52.123.176.146 in this example is the TEAMS server IP)
After discovering the IP, the following can be collected to further isolate and diagnose the issue with Microsoft Teams traffic. In FortiGate, filter the source IP of the test computer and destination IP retrieved from the command prompt (Teams IP) in the forward traffic logs.
Once confirmed, take packet captures:
# diagnose sniffer packet any 'host 52.123.176.146 and host x.x.x.x' 6 0 a
(x.x.x.x is the source IP)
Run the debug flow filter commands as referenced in the following article:
Technical Tip: Debug flow tool
Note: The same method can be used for identifying other applications which are using dynamic IPs. | 
