About updating from Site Administration to Control Hub


Updating a site from Site Administration to Control Hub will be enabled on most sites shortly after 41.11.4 is released. This feature won’t require an update of client versions. The following limitations for this feature are:

  • Sites with users who haven’t been linked to Control Hub yet aren’t eligible for this feature.

  • Some sites won't be enabled for this feature until the partners that manage those organizations are ready.

Webex is becoming a unified platform for managing meetings, messaging, calling, and other modes of collaboration. That's why we want to move the management of all Webex meetings sites from Site Administration to Control Hub.

We've started linking all customers' Meetings sites to Control Hub, to allow management from either place. This means that you should already have a Control Hub organization, but you may not have signed in yet.

We have a tool in Site Administration to help you through this change, so if your site is already eligible to update to Control Hub, you can get started by clicking on Update Administration in the navigation menu.

The benefits of managing sites in Control Hub include:

  • Unified license assignments across all Webex services, such as Meetings, Messaging, and Calling.

  • Consistent security policies across all Webex services.

  • Common sign-in experience for all end users between different Webex services.

  • Modern administrator controls, such as Directory Connector, SCIM, and active directory groups.

  • License templates to assign multiple licenses to users automatically.


You can't use Site Administration to manage a meetings site after updating to Control Hub.

The experience of managing sites in Control Hub is similar to managing in Site Administration. User management in Control Hub has more modern underlying technologies, so there are a few differences in managing sites in Control Hub. This section focuses on differences called out when updating your site.


For a more detailed overview of the differences between Site Administration and Control Hub, see this article.

User management

We have a centralized user management system underlying Control Hub, where users are distinct and unique within the whole organization (and all of Webex). In Site Administration, the user profile is distinct per meeting site.

Single Sign On (SSO) with automatic account creation

In Site Admin you have an “auto account creation” feature that creates users when they authenticate themselves by SSO.

Screenshot of site admin showing SSO option to allow automatic account creation

This feature isn't available in Control Hub because there are more robust ways to add new users. You must disable this feature in Site Administration before you update your site to Control Hub.

Many organizations that use SSO may prefer to centrally manage their users in external directory tools such as Microsoft® Active Directory and Microsoft Azure, as well as requiring authentication with external identity providers.

Read more about:

Control over users changing their names

In Site Admin you can prevent users on the site from changing their first name, last name, and display name (https://help.webex.com/nmig1kcb explains how users can do this if you allow it).

By unchecking the boxes shown below, you can prevent users from changing their names.

Screenshot of site administration showing options for mandatory profile options and user-configurable attributes

We do not have this feature in Control Hub because many organizations prefer to manage their user profiles in dedicated directory systems, such as Active Directory, and synchronize their directories with Webex. This prevents users from changing their profile via Webex.

If your organization is not synchronizing the user profile from an external directory, then users can change their profile. This affects their profile across your whole organization, including all meeting sites.

If you need to prevent users from changing their profiles, and you do not intend to synchronize a directory with Webex, then you should avoid updating to Control Hub at this time.

Mandatory profile data and tracking codes

Site Administration allows you to specify required profile fields for new users (previous screenshot). You can extend this to require tracking codes for user creation (screenshot below). If you configure these additional requirements, you cannot add users to the site without them.

Screenshot of site administration showing options for enforcing Tracking Codes

Control Hub only needs a display name and email address to create a user.

All other user fields are optional when you create a new user in Control Hub, so we do not enforce additional profile data for Control Hub managed sites.

You must disable mandatory profile fields and tracking codes before you update your site to Control Hub.

Password management and lockout

Site Administration has a feature that temporarily locks users out if they fail to sign in after a number of tries.

Control Hub has the following options to prevent unauthorized access:

  • Automatic timeout after the first few failed attempts.

  • A CAPTCHA mechanism (Completely Automated Public Turing test to tell Computers and Humans Apart).

  • Legitimate users have a self-service option to change their forgotten passwords.

Host licensing

Hosts must be in your Control Hub organization

In Site Admin you can assign a host license to any user. When you're managing the site in Control Hub, you can only assign host licenses (& attendee role) to users in the same Control Hub organization.

Self sign-up for Host account

In Site Admin you can choose to allow users to request a (host) account on the site. You can also allow users with an account to request additional services on the site. (see screenshots).

Screenshot of site admin showing "Allow host account signup" optionScreenshot of site admin showing the control to allow users to request additional services

When you are managing a meeting site in Control Hub, users cannot request their own host account for that site.

Control Hub has a centralized, automated way for you to assign meeting licenses to new users instead. Read https://help.webex.com/n3ijtao.

You can also manage user licenses by API or in bulk using CSV.

If you want users to request their host accounts, you can configure the site help/support with pointers to contact admins or link to other tools.

You must disable “Allow host account signup” and “Allow users to request additional services” in Site Administration before you update your site to Control Hub.

Control Hub has other license management options, like auto-assignment templates. You can get a report of inactive hosts to help you remove licenses from those users, individually or in bulk, or by API.

If you need this automated deactivation option, and the other options in Control Hub are not suitable for you, then you should avoid updating your site to Control Hub at this time.

Before you update your meeting site to be managed in Control Hub, you should prepare your Control Hub organization.

We strongly recommend verifying your domains and claiming your users. The following reading will help:

Your site may have API integrations from applications set up by your own company, your partners, or third party applications that your company uses, such as learning management system (LMS) integrations. This section outlines what API integrations will work when you update your site to Control Hub, and what API integrations won't work.

We publish APIs for you to manage administrative and user features of your meetings sites. The APIs are documented at https://developer.cisco.com/docs/webex-xml-api-reference-guide/. We also publish Webex URL APIs to enable integrations with Webex Meeting services.

If your API integration uses username for authentication instead of email, then the integration won't work with Control Hub managed sites, so those integrations will fail if the site is updated from Site Admin to Control Hub. Control Hub managed sites only support email address-based authentication, either with passwords or SSO. You must change your API integration before updating to Control Hub if you want to keep it.


* We're enabling API integrations that use username based authentication to continue to work even after updating to Control Hub. This is targeted for November (on 41.11.4 for the site page version, which doesn't require the Webex App to be updated).

Control Hub has its own APIs, including People and License REST APIs for creating and licensing users at:

Most of those APIs also work on Control Hub managed sites, but there are some differences related to user management (e.g. user creation and licensing).

If your integration does user management, such as adding or removing hosts or attendees to Webex Meetings sites, then you need to prepare your integration to use new APIs. Previous API integrations may no longer work after updating your site to Control Hub managed sites. The following XML API calls are the ones that require attention:

Table 1. APIs that require attention

API

API issue After updating site to Control Hub

Recommendation

Any XML API*

If username is used for WebexID or hostWebExID and it doesn't match any email, then the API integration will fail after updating site to Control Hub..

Use email rather than username

CreateUser**

Not supported in Control Hub managed sites.

Switch to use People API after site is updated to Control Hub.

DelUser**

Not supported in Control Hub managed sites.

Switch to use People API after site is updated to Control Hub.

SetUser**

Works with most parameters, such as tracking codes and session types, but not all.

Doesn't work with assigning or changing a user's role, such as attendee to host.

If assigning a user's role, then use People API after site is updated to Control Hub.

AuthenticateUser*

Not supported with username.

Use email

Username in securitycontext*

username as webExID in securitycontext isn't supported in Control Hub managed sites.

Use email

Session ticket

Session ticket before updating to Control Hub may not be valid after the update.

Assign session tickets after updating to Control Hub.

SSO bypass by admins

If API integration is using SSO bypass for authentication and the email address of the admin isn't in the same organization as the site, you must deactivate that admin's account before updating site to Control Hub.

If username is used, then the API integration will fail.

As a workaround, you can assign the admin as an external administrator in Control Hub after updating site to Control Hub. You can use the same email address as the original email address in Site Administration.

URLAPI*

All urlapi that use username for Webex identity (WID) will fail if username isn’t the same as email.

For example:
<Site>/p.php?AT=LI&WID=hostid&PW=pas

Use email rather than username


* As mentioned in the note at the beginning, we're enabling API integrations that use username based authentication to continue to work even after updating to Control Hub. This is targeted for November (on 41.11.4 for the page version, which doesn't require the Webex App to be updated).

** Starting on version 41.11.4 in November, we'll enable user management XML APIs to work with Control Hub managed sites, which allows your integrations to work even after updating your site to Control Hub. This is a bridging feature that will be supported for one year to give you time to update your integrations to use People APIs for user management.

You can use the People API to create organization administrators with full or read-only permissions, and these become administrators on all your Control Hub managed meeting sites.


Control Hub does have Webex site specific administrator roles, but the People API can't assign this role at this time.

Read more about assigning user roles, including Webex Site Administrator Roles, at https://help.webex.com/fs78p5.

Prepare your API integrations to use the People and License APIs before you update your site to Control Hub. Then you can switch your integration over to the new APIs after you update the site.

Currently, apps and integrations need to be associated to a Control Hub user's credentials.

Future plans

We plan to enable admin applications whose email address is independent of traditional users in a Control Hub organization, i.e, the identity of such integrations aren't tied to specific users. This is targeted for Q1 2022 and is subject to change. When this capability becomes available, users can create a new category of admin applications to integrate with Webex using a process similar to Webex integrations and bots at developer.webex.com.

Some features need to be disabled before you can update a Webex site to Control Hub. You can see a list that shows you what feature needs to be disabled. Features that are marked with a red circle X icon must be done. Features marked with a yellow triangle exclamation point icon are just for your information and require no action.

  1. Sign in to Webex Site Administration and go to Configuration > Common Site Settings > SSO Configuration.

    (Read about SSO configuration on your Webex site at https://help.webex.com/g5ey83.)

  2. Find and disable the Auto Account Creation option.

  3. Click Update.

  4. Go to Configuration > Common Site Settings > Options.

    • Find and disable the Allow host account signup option.

    • Find Require for account signup: and clear all the boxes for required user profile fields.

    • Find Allow user to change below fields: and clear all the boxes.

  5. Click Update.

  6. Go to Configuration > Common Site Settings > Tracking Codes.

  7. In the Host Profile column, change all the tracking code rows marked as Required to AdminSet or Optional.


    All tracking code values for users are preserved when you update a site to Control Hub.

The update administration tool updates your site's users to Webex users in your Control Hub organization.

Before you try to update users to Control Hub, review the Prepare your Control Hub Organization section from earlier in this article.

To make sure we update your users to Control Hub successfully, you must fix the following types of user problems before you update the site to Control Hub:

  • Users in other Control Hub organizations

  • Users with mismatched email addresses in Site Admin and Control Hub

If you try to update the site to Control Hub while users have these problems, the update administration process could fail. The tool doesn't check to see if you've corrected the issues until after you start the final update.

How to check for users that will block site update

  1. Sign in to Site Administration, and open the Update Site page.

  2. Open the Review prerequisites for updating administration control, and click Export affected users in CSV.

  3. Wait for the export to finish. This process can take a while depending on the start time and number of users in the site. There's a few minutes delay for this operation during the top of the hour.

  4. Click Download CSV once the export finishes.

    Your browser downloads users-to-review.csv.

  5. Open the CSV file and check the Recommended action column (the last column). Take the recommended action for each user in the file.

Users in other Control Hub organizations

You cannot update site users or administrators who are already in different Control Hub organizations to the Control Hub organization that you're updating to. The most common recommended action for these users will be to deactivate the users. Those deactivated users will lose their service on the site.*

There is an exception to this rule: site administrators are eligible for updating to Control Hub if they belong to the partner organization that created or manages your Control Hub organization. We don't list these users in the users-to-review.csv file.

Claiming eligible users (your company's users) into your Control Hub organization (requires that your organization has verified the email domain of those users) will reduce the number of users that need to be deactivated before updating your site to Control Hub. Read https://help.webex.com/nceb8tm.


* We plan to enable meeting site licensing for users that aren't in your Control Hub organization in the upcoming months. If you don't want to deactivate users who are in external organizations (not in your Control Hub organization), you may want to wait for this enhancement before updating a site to Control Hub.

Users with mismatched email addresses

Some users may have a different email address in Site Admin and Control Hub. This is possible if the user’s email was changed in only one of the two places after the user was linked from this site to Control Hub.

Try these actions to fix users with mismatched email addresses:


If you update your site to Control Hub without correcting user email mismatches, the affected users must use their Control Hub email addresses to log in to their meeting site. These users won't block you from starting the update administration process, but it's better to fix the email addresses before starting the update.

How to deactivate users


When you deactivate users, they lose their host license or attendee privilege (depending on which role they had while Active). Deactivated users will still appear in the site CSV export file after updating the site to Control Hub.

For individual user deactivation in Site Administration:

  1. Go to User Management > Edit User.

  2. Use the index, search, and filter controls to find the user.

  3. Uncheck the Active box.

  4. Submit the changes.

    See Manage User Accounts in Cisco Webex Site Administration for more information.

For batch user deactivation in Site Administration:

  1. Export the users to a CSV file.

  2. Open the CSV file and modify the Active column values to N for all affected users.

  3. Import the modified CSV file.

    The users you changed are now Inactive.

    See Batch Import and Export Webex Users in Webex Site Administration for more detail.

Before you begin

There are some features you must disable, and you must check that all users are in a good state to be updated to Control Hub. If you are using API integrated applications, you need to update them to use the Webex API.

You can read about these prerequisites in the earlier parts of this article.


Make sure that all your administrators know that you are updating the site to Control Hub, and that they must not make any changes in Site Admin after you start.

1

Sign in to Site Administration and click Update Administration.

2

Review the prerequisites, especially the CSV list of users in states that could affect the success of the update.

3

Read about the features that need to be disabled and the differences you can expect in user management and host licensing (also documented in this article).

4

Click Update to Control Hub. This button is only activated after the steps above have been completed.

A pop-up window appears. This window shows that updating a site to Control Hub is permanent and you can't undo the update once it finishes. When the update finishes, this site will no longer be managed in Site Administration. If you're not prepared to fully manage this site in Control Hub, exit the wizard now.
5

Click Update.

The update starts a banner appears above Site Administration to let you know that a site update is in progress. If anything goes wrong, you'll see an error message with suggested action. Otherwise, you'll see a success message.

6

Click Sign in to Control Hub.

After triggering the site update from Webex Site Administration, you can sign in to Control Hub to see the status of the site update.

  1. Sign in to Control Hub at https://admin.webex.com and open the Meetings page.

    You can see a list of your meeting sites.

  2. Click a site to see information about that site.

  3. Look for the Site Update section, where you can read the Update status.

    After the update is finished, you can download a list of all users in Site Administration and see which of those users were active or inactive on the site.


    It can take some time for the download button to appear (minutes for most organizations).

  4. Review the list to check for any problems while updating.

You can no longer manage this site in Site Administration once the site update finishes. All management for this site must be done in Control Hub. Here are some steps to familiarize yourself with and try out management of your site in Control Hub:

  1. Select a host, and verify their license and session types. Confirm that their scheduled meetings are effective.

    Ask the user to check that they can schedule and host new meetings.

  2. Add a new user to your organization. Grant them a host license, modify their session types, and verify that they can host meetings.

  3. Select a user who was a full administrator in Site Administrator, and verify that they have the appropriate level of access to the updated site in Control Hub.

    They should be able to read and modify the site; create, license, modify, and delete users.

  4. If your site has API integrations, then switch to using the People APIs. Confirm that the updated integration is working as expected.

Read more about managing meeting sites in Control Hub at https://help.webex.com/naqlzeu.