About updating from Site Administration to Control Hub


 

Updating a site from Site Administration to Control Hub won’t require an update of client versions. Some sites won't be enabled for this feature until the partners that manage those organizations are ready.

Webex is becoming a unified platform for managing meetings, messaging, calling, and other modes of collaboration. That's why we want to move the management of all Webex meetings sites from Site Administration to Control Hub.

We have a tool in Site Administration to help you through this change, so if your site is already eligible to update to Control Hub, you can get started by clicking on Update Administration in the navigation menu.

For a demonstration on how updating your site to Control Hub works, see this video.

To help plan your site update, review the Site assessment readiness section.

The benefits of managing sites in Control Hub include:

  • Unified license assignments across all Webex services, such as Meetings, Messaging, and Calling.

  • Consistent security policies across all Webex services.

  • Common sign-in experience for all end users between different Webex services.

  • Modern administrator controls, such as Directory Connector, SCIM, and active directory groups.

  • License templates to assign multiple licenses to users automatically.


 

You can't use Site Administration to manage a meetings site after updating to Control Hub.

Site readiness assessment

Before updating your site to Control Hub, we highly recommend that you review the following items first to make the update go as smoothly as possible:

  • First, review this document and ensure that your organization follows the best practices that are recommended in the Prepare your Control Hub organization section.
  • Next, sign in to Webex Administration and click Update administration. In the site readiness phase, you shouldn't take any recommended action in the file from the review users section and shouldn't disable any features called out in the review features section yet. By following these instructions, the site readiness assessment becomes a read-only operation just to assess the changes you need to do before updating to Control Hub.
Assessing site before updating to Control Hub
  1. Under the Review users section, click on Export user CSV file and download the CSV file, which is called users-to-review-xxxxx.csv.

    This file will list all the users that need attention and will have a recommended action for each user. The number of users in this file gives you an idea of how many user-related issues you have to work on before you can update the site.

  2. Under the Review features section, look at any features listed with a red X in the consequences column. This will inform you on your site’s readiness from a feature-conflict perspective.
  3. Do not go to Step 2 and do not click the Update to Control Hub button yet.

Once you've reviewed the user CSV file and looked at what features you may have to reconfigure, continue reading the rest of the sections in this article to prepare your site and organization on how to update to Control Hub.


 

Note: If your site has API integrations done by your company or through third-party solutions, such as learning management solutions, make sure you review the Prepare site API integrations to work with Control Hub section.

Differences to expect in Control Hub

The experience of managing sites in Control Hub is similar to managing in Site Administration. User management in Control Hub has more modern underlying technologies, so there are a few differences in managing sites in Control Hub. This section focuses on differences called out when updating your site.


 

For a more detailed overview of the differences between Site Administration and Control Hub, see this article.

User management

We have a centralized user management system underlying Control Hub, where users are distinct and unique within the whole organization (and all of Webex). In Site Administration, the user profile is distinct per meeting site.

Single Sign On (SSO) with automatic account creation

In Site Admin you have an “auto account creation” feature that creates users when they authenticate themselves by SSO.

Screenshot of site admin showing SSO option to allow automatic account creation

This feature isn't available in Control Hub because there are more robust ways to add new users. You must disable this feature in Site Administration before you update your site to Control Hub.

Many organizations that use SSO may prefer to centrally manage their users in external directory tools such as Microsoft® Active Directory and Microsoft Azure, as well as requiring authentication with external identity providers.

Read more about:

Mandatory profile data and tracking codes

Site Administration allows you to specify required profile fields for new users (previous screenshot). You can extend this to require tracking codes for user creation (screenshot below). If you configure these additional requirements, you cannot add users to the site without them.

Screenshot of site administration showing options for enforcing Tracking Codes

Control Hub only needs a display name and email address to create a user.

All other user fields are optional when you create a new user in Control Hub, so we do not enforce additional profile data for Control Hub managed sites.

You must disable mandatory profile fields and tracking codes before you update your site to Control Hub.

Password management and lockout

Site Administration has a feature that temporarily locks users out if they fail to sign in after a number of tries.

Control Hub has the following options to prevent unauthorized access:

  • Automatic timeout after the first few failed attempts.

  • A CAPTCHA mechanism (Completely Automated Public Turing test to tell Computers and Humans Apart).

  • Legitimate users have a self-service option to change their forgotten passwords.

Host licensing

Hosts must be in your Control Hub organization

In Site Admin you can assign a host license to any user. When you're managing the site in Control Hub, you can only assign host licenses (& attendee role) to users in the same Control Hub organization.

Self sign-up for Host account

In Site Admin you can choose to allow users to request a (host) account on the site. You can also allow users with an account to request additional services on the site. (see screenshots).

Screenshot of site admin showing "Allow host account signup" option Screenshot of site admin showing the control to allow users to request additional services

When you are managing a meeting site in Control Hub, users cannot request their own host account for that site.

Control Hub has a centralized, automated way for you to assign meeting licenses to new users instead. Read https://help.webex.com/n3ijtao.

You can also manage user licenses by API or in bulk using CSV.

If you want users to request their host accounts, you can configure the site help/support with pointers to contact admins or link to other tools.

You must disable “Allow host account signup” and “Allow users to request additional services” in Site Administration before you update your site to Control Hub.

Control Hub has other license management options, like auto-assignment templates. You can get a report of inactive hosts to help you remove licenses from those users, individually or in bulk, or by API.

If you need this automated deactivation option, and the other options in Control Hub are not suitable for you, then you should avoid updating your site to Control Hub at this time.

Prepare your Control Hub organization

Before you update your meeting site to be managed in Control Hub, you should prepare your Control Hub organization.


 

Make sure there are no pending or blocking actions on the subscription. The update will fail if:

  • You have any pending actions on the subscription associated with the site that you’re updating.
  • The site has no subscription associated with it in the Control Hub organization.
  • The site license information in Site Administration doesn't match the site license information in Control Hub.

We strongly recommend verifying your domains and claiming your users. The following reading will help:

Organizations with directory sync

If your organization is configured for directory sync, then make sure all users that you want to be in your organization are present in the site. This should be done 24 hours before you start the site updating process so that users on the site can be linked to the new users in your Control Hub organization.


 
The update will fail if active users on the site can't be linked to Control Hub users.

Prepare site API integrations to work with Control Hub

Your site may have API integrations from applications set up by your own company, your partners, or third party applications that your company uses, such as learning management system (LMS) integrations. This section outlines what API integrations will work when you update your site to Control Hub, and what API integrations won't work.

We publish APIs for you to manage administrative and user features of your meetings sites. The APIs are documented at https://developer.cisco.com/docs/webex-xml-api-reference-guide/.

We also publish Webex URL APIs to enable integrations with Webex Meeting services, and have REST APIs for meetings: https://developer.webex.com/docs/meetings

Control Hub has its own APIs, including People and License REST APIs for creating and licensing users at:

However, the REST APIs above don't support all the user management functions available in XML APIs. For example, you'll still need to use XML APIs to change session types and to configure tracking codes for users. People API doesn't support the assignment of Site Admin roles to users. If you want to assign Site Admin roles via an API, you're still required to use XML API.

XML APIs are now forward compatible with Control Hub managed sites. You can read about the details and caveats at XML API 41.11.0 Updates.


 

As a best practice, we recommend that you update a test site first to confirm that your API integrations will work unmodified after updating to Control Hub.

You can also learn more about XML API integrations on Control Hub managed sites with this guide. This guide references Webex Integration token management and how to exchange these tokens for session tickets for use in XML APIs.

Most XML API integrations should work, without any changes, after updating your site. But there are some exceptions which are detailed in the following table.

Table 1. XML API issues that need attention for sites that update from Site Admin to Control Hub

API

API issue after updating site to Control Hub

Recommendation

Session ticket

Session ticket generated before the site update could become invalid if username doesn't match email address.

Renew session tickets after updating to Control Hub.

CreateUser

Works if user is already in the Control Hub organization that owns the site. Otherwise, will fail if user can't be added to that organization.

PMR ID parameter won't take effect for users who don't already have an Active status in Control Hub.


 

createuser API takes longer to complete on Control Hub managed sites. For better performance, you can add an additional thread to parallelize createuser calls.

Wait to update your site until we enable licensing of external users.

SSO bypass by admins

SSO bypass isn't supported in Control Hub organizations.

As a workaround, you can assign the admin as an external administrator in Control Hub after updating site to Control Hub. You can use the same email address as the original email address in Site Administration.

You can use the People API to create organization administrators with full or read-only permissions, and these become administrators on all your Control Hub managed meeting sites.


 

Control Hub does have Webex site specific administrator roles, but the People API can't assign this role at this time.

Read more about assigning user roles, including Webex Site Administrator Roles, at https://help.webex.com/fs78p5.

Prepare your API integrations to use the People and License APIs before you update your site to Control Hub. Then you can switch your integration over to the new APIs after you update the site.

Currently, apps and integrations need to be associated to a Control Hub user's credentials.

Future plans

In the future, we plan to:

  • Enable licensing for external users who aren't in the same organization that owns the Control Hub managed site. We'll also enable licensing external users with APIs.
  • Enable admin applications whose email address is independent of traditional users in a Control Hub organization, i.e, the identity of such integrations aren't tied to specific users. This is targeted for Q2 2022 and is subject to change. When this capability becomes available, users can create a new category of admin applications to integrate with Webex using a process similar to Webex integrations and bots at developer.webex.com.

Disable Site Administration features that block updating administration to Control Hub

Review features UI for updating administration in Site Admin

Some features need to be disabled before you can update a Webex site to Control Hub. You can see a list that shows you what feature needs to be disabled. Features that are marked with a red circle X icon must be done. Features marked with a yellow triangle exclamation point icon are just for your information and require no action.

For a demo on how to update your site to Control Hub, see this video.

  1. Sign in to Webex Site Administration and go to Configuration > Common Site Settings > SSO Configuration.

    (Read about SSO configuration on your Webex site at https://help.webex.com/g5ey83.)

  2. Find and disable the Auto Account Creation option.

  3. Click Update.

  4. Go to Configuration > Common Site Settings > Options.

    • Find and disable the Allow host account signup option.

    • Find Require for account signup: and clear all the boxes for required user profile fields.

    • Find Allow user to change below fields: and clear all the boxes.

  5. Click Update.

  6. Go to Configuration > Common Site Settings > Tracking Codes.

  7. In the Host Profile column, change all the tracking code rows marked as Required to AdminSet or Optional.


     

    All tracking code values for users are preserved when you update a site to Control Hub.

Review Site Admin users that could block site update

Before updating your site to be managed in Control Hub, make sure that:

  • All users of the site who should be in your organization are actually in your Control Hub organization.
  • All users of the site who shouldn't be in your organization are deleted from your organization.
  • Users in the organization can be authenticated by your IdP if your organization is configured for SSO.
  • You reviewed the Prepare your Control Hub organization section from earlier in this article.

For a demo on how to update your site to Control Hub, see this video.

To make sure we update your users to Control Hub successfully, you must fix the following types of user problems before you update the site to Control Hub:

  • Users in other Control Hub organizations

  • Users with mismatched email addresses in Site Admin and Control Hub

Review users UI for updating administration in Site Admin

If you try to update the site to Control Hub while users have these problems, the update administration process could fail. The tool doesn't check to see if you've corrected the issues until after you start the final update.

Users in organizations with directory sync

If there are unlinked users who should be in your organization, but aren't added yet, you must first add them to your organization. This is especially critical for organizations that are configured for directory sync (through Directory Connector or Azure AD) because directory sync won't allow the site updating process to add users.


 

The site update will fail if any active users on the site can't be linked to a Control Hub organization. If your organization is configured for directory sync, make sure all users on the site that must be part of the Control Hub organization are added to Directory Connector or Azure AD first before starting the update.

Users in Webex for Government organization email domains

If you have users whose email address domains belong to a Control Hub organization that's in Webex for Government, then those users must be deactivated in Site Administration before updating the site

How to check for users that will block site update

  1. Sign in to Site Administration, and open the Update Administration page.

  2. Open the Review prerequisites for updating administration control, and click Export affected users in CSV.

  3. Wait for the export to finish. This process can take a while depending on the start time and number of users in the site. There's a few minutes delay for this operation during the top of the hour.

  4. Click Download CSV once the export finishes.

    Your browser downloads users-to-review.csv.

  5. Open the CSV file and check the Recommended action column (the last column). Take the recommended action for each user in the file.

Users in other Control Hub organizations

You cannot update site users or administrators who are already in different Control Hub organizations to the Control Hub organization that you're updating to. The most common recommended action for these users will be to claim the users in Control Hub or deactivate the users. Those deactivated users will lose their service on the site.*

There is an exception to this rule: site administrators are eligible for updating to Control Hub if they belong to the partner organization that created or manages your Control Hub organization. We don't list these users in the users-to-review.csv file.

Claiming eligible users (your company's users) into your Control Hub organization (requires that your organization has verified the email domain of those users) will reduce the number of users that need to be deactivated before updating your site to Control Hub.


 

* We plan to enable meeting site licensing for users that aren't in your Control Hub organization in the upcoming months. If you don't want to deactivate users who are in external organizations (not in your Control Hub organization), you may want to wait for this enhancement before updating a site to Control Hub.

Users with mismatched email addresses

Some users may have a different email address in Site Admin and Control Hub. This is possible if the user’s email was changed in only one of the two places after the user was linked from this site to Control Hub.

Try these actions to fix users with mismatched email addresses:


 

If you update your site to Control Hub without correcting user email mismatches, the affected users must use their Control Hub email addresses to log in to their meeting site. These users won't block you from starting the update administration process, but it's better to fix the email addresses before starting the update.

How to deactivate users


 
When you deactivate users, they lose their host license or attendee privilege (depending on which role they had while Active). Deactivated users will still appear in the site CSV export file after updating the site to Control Hub.

For individual user deactivation in Site Administration:

  1. Go to User Management > Edit User.

  2. Use the index, search, and filter controls to find the user.

  3. Uncheck the Active box.

  4. Submit the changes.

    See Manage User Accounts in Cisco Webex Site Administration for more information.

For batch user deactivation in Site Administration:

  1. Export the users to a CSV file.

  2. Open the CSV file and modify the Active column values to N for all affected users.

  3. Import the modified CSV file.

    The users you changed are now Inactive.

    See Batch Import and Export Webex Users in Webex Site Administration for more detail.

Update a Meetings site to be managed in Control Hub

Before you begin

There are some features you must disable, and you must check that all users are in a good state to be updated to Control Hub. If you are using API integrated applications, you need to update them to use the Webex API.

You can read about these prerequisites in the earlier parts of this article.


 

Make sure that all your administrators know that you are updating the site to Control Hub, and that they must not make any changes in Site Admin after you start.

1

Sign in to Site Administration and click Update Administration.

2

Review the prerequisites, especially the CSV list of users in states that could affect the success of the update.

3

Read about the features that need to be disabled and the differences you can expect in user management and host licensing (also documented in this article).

4

Click Update to Control Hub. This button is only activated after the steps above have been completed.

A pop-up window appears. This window shows that updating a site to Control Hub is permanent and you can't undo the update once it finishes. When the update finishes, this site will no longer be managed in Site Administration. If you're not prepared to fully manage this site in Control Hub, exit the wizard now.
5

Click OK.


 

Site updates are paused for a few minutes before and after the top of the hour. Updates will take longer if you start at the top of the hour.

The update starts a banner appears above Site Administration to let you know that a site update is in progress. If anything goes wrong, you'll see an error message with suggested action. Otherwise, you'll see a success message.

Site update takes approximately 2 minutes + 500 users/minute to complete. For example, if you started the site update at 5:20 and your site has 3000 users, you can expect the update to be done in around 8 minutes. But your results could vary.

6

Click Sign in to Control Hub.

Validating site management from Control Hub

After triggering the site update from Webex Site Administration, you can sign in to Control Hub to see the status of the site update.


 
The site update will take longer to update if it's triggered near the top of the hour. Site updates are paused for a few minutes before and after the top of every hour.

  1. Sign in to Control Hub at https://admin.webex.com and open the Meetings page.

    You can see a list of your meeting sites.

  2. Click a site to see information about that site.

  3. Look for the Site Update section, where you can read the Update status.

    After the update is finished, you can download a list of all users in Site Administration and see which of those users were active or inactive on the site. Users that are shown as inactive in the user status column of Site Administration won't have access to the Control Hub managed site. Those users also won't be shown as having any access to the site in the user section of Control Hub.


     

    It can take some time for the download button to appear (minutes for most organizations).

  4. Review the list to check for any problems while updating.

You can no longer manage this site in Site Administration once the site update finishes. All management for this site must be done in Control Hub. Here are some steps to familiarize yourself with and try out management of your site in Control Hub:

  1. Select a host, and verify their license and session types. Confirm that their scheduled meetings are effective.

    Ask the user to check that they can schedule and host new meetings.

  2. Add a new user to your organization. Grant them a host license, modify their session types, and verify that they can host meetings.

  3. Select a user who was a full administrator in Site Administrator, and verify that they have the appropriate level of access to the updated site in Control Hub.

    They should be able to read and modify the site; create, license, modify, and delete users.

  4. If your site has API integrations, then switch to using the People APIs. Confirm that the updated integration is working as expected.

Read more about managing meeting sites in Control Hub at https://help.webex.com/naqlzeu.

End user sign in changes after updating site to Control Hub

  • Users will have a single, unified sign-in experience to the Webex App and all Control Hub managed sites.


     
    If the username doesn't match the user's email address in Site Administration, then those users will have an impact with the sign-in experience. Old usernames can no longer be used, and those users must use their email address to sign in.

  • User credentials are associated with their Control Hub identity. Those same credentials apply to all Control Hub managed sites in that same organization and to the Webex App.

  • If the Control Hub organization has SSO configured, then that SSO governs the sign-in experience to the Webex App and all Control Hub managed sites.

  • The sign in-experience to the Webex App isn't affected as a result of updating to Control Hub.

  • When users sign in to a Webex Meetings site, the sign-in screen will look different. Users must enter their email address to sign in even if their organization is configured for SSO.


     
    Admins can enable the Remember me option in Control Hub so that users don't have to enter their email address again each time they sign in.

  • Depending on each user's history, the number of sites they had an account on, etc.:

    • If users were linked to existing users in Webex Identity/Control Hub, then users will use that same password for all Webex sites that are updated to Control Hub.

    • If users were created in Webex Identity/Control Hub due to site linking, then their first linked site's credentials apply (if the org wasn't configured with SSO). Users are redirected to sign in to that site. If users have multiple sites with multiple credentials, the site URL should help them determine which credentials to use.

    • Users are allowed to reset their password in Control Hub organizations (if password isn't managed via SSO). If users forgot their password, they can just click on Forgot your username or password? at the sign-in screen to reset their password. Users can also reset their password by following these instructions:

Known issues

Settings that currently don't carry over when updating to Control Hub

  • The Allow attendee to join audio portion of Personal Conference before host setting doesn't carry over to Control Hub sites if it's enabled in Site Administration. We'll be making changes to ensure this setting will carry over.Allow attendee to join audio portion of Personal Conference setting in Site Administration

    Workaround: Contact Cisco to get the toggle EnablePCNAudioJBHForCISit set to ON for your site and then enable that setting again.

User issues that cause the update to fail

  • Users with email addresses that are linked to users in a Webex for Government organization will cause the update to fail if those users aren't deactivated before starting the update.

Common issues that cause the update to fail and recommended actions

If your site fails to update to Control Hub, check the following table to see if one of these comon errors are the cause and what you can do to fix it.

Errors that cause update to failRecommended action
The site type is invalid. Contact your Webex Support team to validate that the site is user-linked.
The site has no subscription associated with it. Sites must be associated with a subscription before it can be updated to Control Hub.
There is an issue with the organization ID. Site linked organization ID isn't the same as the subscription organization ID. Contact your Webex Support team.
The following subscription has pending operations in Control Hub: (SubID). Retry site update after pending operation is completed.
There are conflicts in the single sign-on (SSO) settings. If site is SSO enabled, then make sure that:
  • Auto-account creation is disabled.
  • SSO is enabled in the Control Hub organization.
The site license information in Site Administration doesn't match the site license information in Control Hub. Inconsistent license information between Site Admin and Control Hub. Contact your Webex Support team.
Some usernames or email addresses in Site Administration conflict with usernames or email addresses in Control Hub. A user's email in Site Admin is used by another user in Control Hub. Change one of the email addresses or usernames.
We had a problem updating your site. An internal error prevented this site from being updated. Contact your Webex Support team.
We had a problem updating the Webex users. An internal error prevented this site from being updated. Contact your Webex Support team.