You can't currently use Azure AD Wizard App with Webex for Government. We’ll add support for Webex for Government in the future.

Some of the features described in this article are not yet available to all customers. They will be available soon.


Log in to Control Hub with full admin account.


Go to Organization Settings and then scroll down to the Directory Synchronization section.


Click Set up to start the configuration.

Image showing the Azure AD sync setup.

Authenticate the Azure AD admin account with the Azure AD configuration. Ensure that you use an account that has the permissions described in the next step.


Review the permissions and click Accept to grant the account authorization to access your Azure AD tenant.

Cisco Webex Identity Synchronization is an Azure AD enterprise application in Azure AD. The Wizard App connects to this application to access Azure AD graph APIs. The permissions required to access it are the minimum permissions needed to support and use it.

Image showing the available permissions.
Permission Usage
Manage apps that this app creates or owns

Required to manage the Cisco Webex Identity app in Azure AD Enterprise, including:

  • Create/delete this app in Azure AD

  • Attribute mapping configuration

  • Renaming the app in Azure AD

  • Enable/disable auto provision

Read all audit log data Used to access the Cisco Webex Identity provision audit log to read provisioning history. This information is used for the sync summary and sync report function in the Wizard App.
Read all groups/Read all group memberships Reads the list of groups from Azure AD to allow successful configuration of the groups sync scope.
Read all users’ full profiles Used when adding users in the sync scope. For example, this permission allows the reading of user information by searching for a user and displaying the users in the table on the user page.

For SMB customers, accept the default settings by checking the Sync defaults check box and clicking Proceed. For enterprise customers, go to the next step and continue the configuration.

If you accept the default settings, it means that you want to:
  • Synchronize all users to Webex.
  • Accept the default attribute mappings.
  • Enable the toggle to synchronize all users' profile pictures to display on Webex Services.
  • Enable auto-sync after the configuration completes.

The wizard synchronizes group objects to Webex by default. You must select the specific groups and add them in the scope.
Image showing the Azure AD sync default setting option

For Enterprise customers (more than 1000 users), or the customers who want to configure the settings manually, click the Attributes tab, and map the attributes. Click Save.

You can map other user attributes from Azure to Webex, or change existing user attribute mappings using the Attributes page. You can customize the mapping by ensuring that you configure it correctly. The value that you map as the username is important. Webex uses the user's email address as their username. By default, the userPrincipalName (UPN) in Azure AD maps to the email address (username) in Control Hub.

You can’t edit the mapping during the first setup. At that point, the corresponding instance isn’t built completely and there’s no instance of the customized mapping attribute. However, you can click Edit to change it when the setup completes.

Add users to the synchronization scope by clicking the Users tab.

You can input the username to search and add the user in the synchronization scope. ​​​​​​​You can also remove a user from the sync scope by clicking the right side Recycle Bin icon. Click Save.

If you want to select all users from Azure AD, select Select all users. If you select it, you don't need to select groups in the scope as this option synchronizes the groups at the same time.

Image showing all users synchronized


We don’t recommend using Select all users for significant enterprise customers with hundreds of thousands of users, as the initialization process requires a long time. If you accidentally synchronize a lot of users in Control Hub, it also takes longer to delete these users.

Click Save.


On the Groups tab, you can search for a group of users and add them to Webex. This synchronizes the users in those groups, but doesn't synchronize the groups themselves. Go to the More tab if you want to synchronize groups.

Image showing the screen to add or remove groups

Click Save.


On the More tab, you can configure some advanced synchronization options:

  • Sync user avatars: turn this on to allow Webex App to sync all in-scope user's avatars to Webex. When a users avatar is updated, the user’s avatar is automatically updated in Webex. It may not update immediately because it relies on the update notification to trigger the update.
  • Sync group objects: turn this on so that the selected groups on the Groups tab are synchronized to Webex.

You can decide if you want to allow synchronization to take place immediately or at a later stage. If you select the Allow now option, it applies all settings to the upcoming synchronization. If you select the Save and allow later option, synchronization doesn’t start until you allow auto-sync.

Image showing the option to save the configuration

The application communicates with Azure AD to set up the configuration and schedules the synchronization.

Image showing that the setup is successful
After the synchronization completes, one of the following results appears in the Job status field:
  • Active: the synchronization was successful.
  • Quarantine: the synchronization job was quarantined in Azure AD after multiple failures. See the Azure AD documentation for more information.
  • NotRun: this status appears only after first setup. The service has not yet run after first setup.

You can also click View summary to see additional information such as the time and date of the last synchronization, and the number of users synced, skipped, or failed:


  • Synced: shows the number of users successfully synced to Webex.
  • Skipped: shows the number of users that were skipped in the last synchronization. For example, new users in Azure AD that were not added to the Azure AD Wizard App sync scope. These users were not synced to Webex; add them in the sync scope to sync them to Webex.
  • Failed: shows the number of users that failed to sync. Check the Azure AD application provision audit log for more information about why these users failed to sync. If you need to sync these users immediately, you can provision users on demand.


  • Synced: shows the number of groups successfully synced to Webex and created in Control Hub.
  • To Be Synced: this status indicates that all of the users in a group have not yet been added. The users must first be successfully synced to Webex.

The Azure AD Wizard and its corresponding backend service checks if auto-sync is enabled, to determine when to sync users or groups from Azure AD to Webex. Enable Auto Sync to allow the auto provision user and group synchronization. When you disable Auto Sync the Wizard App doesn't sync anything to Webex, but the existing configuration is preserved.


Log in to Control Hub as the full org admin.


Go to Organization Settings and then scroll down to the Directory Synchronization section.


Switch the toggle to the right to enable Auto Sync.

Disable it by switching the Auto Sync toggle to the left.


Log in to Control Hub as the full org admin.


Go to Organization Settings and then scroll down to the Directory Synchronization section.


Click Edit configuration.

Image showing the option to delete an Azure AD instance

Customize the attribute mapping by selecting an attribute from the left column that originates from Azure AD. The destination attribute in Webex Cloud is in the right column. See Azure AD Wizard App attributes mapping for more information about mapping attributes.

Image showing the custom attributes

On the Users and Groups tabs, add or remove users and groups from the synchronization scope.


On the More tab change your preferences if required.


Click Save to save the modified configuration.


Your updates are applied in the next synchronization. The Azure AD automatic sync mechanism handles the synchronization of users and user's groups.

Change how the Cisco Webex Identity instance name appears in the Azure AD enterprise application list.


Log in to Control Hub as the full org admin.


Go to Organization Settings and then scroll down to the Directory Synchronization section.


Click Edit instance name.

Image showing the option to delete an Azure AD instance

Enter the new instance name and then click Save.

When you delete the Azure AD Wizard App, it removes the configuration for Azure AD synchronization. The configuration is not retained by Webex or Azure AD. If you want to use Azure AD synchronization in the future, you'll need to do a full reconfiguration.

Before you begin


Log in to Control Hub as the full org admin.


Go to Organization Settings and then scroll down to the Directory Synchronization section.


Click Delete instance.

Image showing the option to delete an Azure AD instance

In the Delete Azure AD Instance? page, select Revoke Azure AD admin consent if you want to remove the consent agreement from Webex. If you select this option, you must enter your credentials and grant the permissions again.

Image showing the Delete window to delete an Azure AD instance

Click Delete.

You can provision a user to Webex immediately, independently of an Azure AD synchronization, and instantly check the result. This helps when troubleshooting problems during setup.


Log in to Control Hub as the full org admin.


Go to Organization Settings and then scroll down to the Directory Synchronization section.


Click Provision a user on demand.

Image showing the option to delete an Azure AD instance

Search for and select the user you want to provision, and click Provision.provision user on-demand screen


One of following results appear when it completes:

  • Provisioning success: The new user was successfully created in Webex.
  • Provisioning skipped: The provisioning was skipped for some reason, generally because the user already exists. The details appear on the Results summary page.
  • Provisioning failed: The provisioning failed. The details appear on the Results summary page.
provision user results screen

Click Re-try to provision the same user again, if it skipped or failed.


Click Provision another user to return to the provisioning page.


Click Done when you are finished.

The customers may have hundreds of domains verified in Azure AD. While they integrate with Control hub, if they want to import the verified domains from Azure AD to Control Hub. This can save many efforts in the maintenance or setup process.


Go to the Domain secion in the Organization Settings tab in Control Hub.


Click Add with Azure AD.


In the Add verified domains page, search and select the domains to add.

Image showing the UI to select the verified domains

Click Add. The verfied domains are a part of the verified domain list.

Image showing the added verified domains
Table 1. Azure to Webex Mappings

Azure Active Directory Attribute (source)

Webex User Attribute (target)




It is the unique ID of the user in Webex. It is an email formatted.



User's name that displays on the Webex application.







It is the user's UID in Azure ID. Generally, it is a 16-Bytes string. We do not recommend that you change this mapping.




addresses[type eq "work"].country

We recommend using Usagelocation mapping to addresses [type eq "work"].country. If you choose another attribute, you should ensure the attribute values are in compliance with the standards. For example, USA should be US. China should be CN, and so on.


addresses[type eq "work"].locality


addresses[type eq "work"].streetAddress


addresses[type eq "work"].region


addresses[type eq "work"].postalCode


phoneNumbers[type eq "work"].value


phoneNumbers[type eq "mobile"].value


phoneNumbers[type eq "fax"].value


How can I migrate to Azure AD Wizard App from Cisco Directory Connector provision?

During setup, the Wizard App detects whether your organization uses Directory Connector. If it is enabled, a dialog box where you can choose to use Azure AD and block Directory Connector. Click Block to confirm that you want to continue the Azure AD Wizard App configuration.

You can also choose to disable Directory Connector before configuring the Wizard App. After configuration, the Wizard App manages user profiles. However, the Wizard App only manages the users who were added to the synchronization scope; you cannot use the Wizard App to manage users synced by Directory Connector that were not part of the synchronization scope.

When does the user avatar update in Webex?

The user avatars are synced to Webex when the user is created in Webex Identity. This update relies on the user's avatar being updated in Azure AD. The Wizard App then retrieves the new avatar from Azure AD.