About Converting from Site Administration to Control Hub

This article is a draft that's in public preview. We're giving you a sneak peek at what to expect. This feature will only be available as a Beta release on version 41.6 and later eligible sites. When available, you can sign up for the program at beta.webex.com.

Webex is becoming a unified platform for managing meetings, messaging, calling, and other modes of collaboration. That's why we want to move the management of all Webex meetings sites from Site Administration to Control Hub.

We've started linking all customers' Meetings sites to Control Hub, to allow management from either place. This means that you should already have a Control Hub organization, but you may not have signed in yet.

Site Administration notifies you if your site is eligible for conversion to Control Hub. You can check on the Site Information page.

We have a tool in Site Administration to help you through this change, so if your site is already eligible for conversion, you can get started.

The benefits of managing sites in Control Hub include:

  • Unified license assignments across all Webex services, such as Meetings, Messaging, and Calling.

  • Consistent security policies across all Webex services.

  • Common sign-in experience for all end users between different Webex services.

  • Modern administrator controls, such as Directory Connector, SCIM, and active directory groups.

  • License templates to assign multiple licenses to users automatically.

You can't use Site Administration to manage a meetings site after site conversion; you must use Control Hub.

The experience of managing sites in Control Hub is similar to managing in Site Administration. User management in Control Hub has more modern underlying technologies, so there are a few differences in managing sites in Control Hub. This section focuses on differences called out in the site conversion tool.

For a more detailed overview of the differences between Site Administration and Control Hub, see this article.

User Management

We have a centralized user management system underlying Control Hub, where users are distinct and unique within the whole organization (and all of Webex). In Site Administration, the user profile is distinct per meeting site.

Single Sign On (SSO) with automatic account creation

In Site Admin you have an “auto account creation” feature that creates users when they authenticate themselves by SSO.

Screenshot of site admin showing SSO option to allow automatic account creation

This feature isn't available in Control Hub because there are more robust ways to add new users. You must disable this feature in Site Administration before you convert your site.

Many organizations that use SSO may prefer to centrally manage their users in external directory tools such as Microsoft® Active Directory and Microsoft Azure, as well as requiring authentication with external identity providers.

Read more about:

Control over users changing their names

In Site Admin you can prevent users on the site from changing their first name, last name, and display name (https://help.webex.com/nmig1kcb explains how users can do this if you allow it).

By unchecking the boxes shown below, you can prevent users from changing their names.

Screenshot of site administration showing options for mandatory profile options and user-configurable attributes

We do not have this feature in Control Hub because many organizations prefer to manage their user profiles in dedicated directory systems, such as Active Directory, and synchronize their directories with Webex. This prevents users from changing their profile via Webex.

If your organization is not synchronizing the user profile from an external directory, then users can change their profile. This affects their profile across your whole organization, including all meeting sites.

If you need to prevent users from changing their profiles, and you do not intend to synchronize a directory with Webex, then you should avoid converting to Control Hub at this time.

Mandatory profile data and tracking codes

Site Administration allows you to specify required profile fields for new users (previous screenshot). You can extend this to require tracking codes for user creation (screenshot below). If you configure these additional requirements, you cannot add users to the site without them.

Screenshot of site administration showing options for enforcing Tracking Codes

Control Hub only needs a display name and email address to create a user.

All other user fields are optional when you create a new user in Control Hub, so we do not enforce additional profile data for Control Hub managed sites.

You must disable mandatory profile fields and tracking codes before you convert your site.

Password management and lockout

Site Administration has a feature that temporarily locks users out if they fail to sign in after a number of tries.

Control Hub has the following options to prevent unauthorized access:

  • Automatic timeout after the first few failed attempts.

  • A CAPTCHA mechanism (Completely Automated Public Turing test to tell Computers and Humans Apart).

  • Legitimate users have a self-service option to change their forgotten passwords.

Site Admin also allows you to define password strength characteristics such as minimum length and required characters (see screenshot).

Control Hub also enforces password requirements, but we do not make them configurable at this time. You can integrate your Control Hub organization with an external identity provider (IDP) or directory management system that can control these characteristics of user identity.

Screenshot of site admin showing the security option for locking users out after some failed sign in attemptsScreenshot of site admin showing controls to change required password characteristics

If you need to define your password characteristics, and you do not wish to use an external identity provider, then you should avoid converting to Control Hub at this time.

Host Licensing

Hosts must be in your Control Hub organization

In Site Admin you can assign a host license to any user. When you're managing the site in Control Hub, you can only assign host licenses (& attendee role) to users in the same Control Hub organization.

Self sign-up for Host account

In Site Admin you can choose to allow users to request a (host) account on the site. You can also allow users with an account to request additional services on the site. (see screenshots).

Screenshot of site admin showing "Allow host account signup" optionScreenshot of site admin showing the control to allow users to request additional services

When you are managing a meeting site in Control Hub, users cannot request their own host account for that site.

Control Hub has a centralized, automated way for you to assign meeting licenses to new users instead. Read https://help.webex.com/n3ijtao.

You can also manage user licenses by API or in bulk using CSV.

If you want users to request their host accounts, you can configure the site help/support with pointers to contact admins or link to other tools.

You must disable “Allow host account signup” and “Allow users to request additional services” in Site Administration before you convert your site.

Deactivate inactive hosts

In Site Admin you have an option to automtically deactivate inactive hosts (see screenshot). This frees up the host license for another user.

Location of deactivate setting in Site Administration

We don't yet have an automated option for this in Control Hub managed sites.

Control Hub has other license management options, like auto-assignment templates. You can get a report of inactive hosts to help you remove licenses from those users, individually or in bulk, or by API.

If you need this automated deactivation option, and the other options in Control Hub are not suitable for you, then you should avoid converting your site to Control Hub at this time.

Before you convert your meeting site to be managed in Control Hub, you should prepare your Control Hub organization.

We strongly recommend verifying your domains and claiming your users. The following reading will help:

Your site may have API integrations from applications set up by your own company, your partners, or third party applications that your company uses, such as learning management system (LMS) integrations. This section outlines what API integrations will work when you convert your site, and what API integrations won't work.

We publish APIs for you to manage administrative and user features of your meetings sites. The APIs are documented at https://developer.cisco.com/docs/webex-xml-api-reference-guide/. We also publish Webex URL APIs to enable integrations with Webex Meeting services.

If your API integration uses username for authentication instead of email, then the integration won't work with Control Hub managed sites, so those integrations will fail if the site is converted from Site Admin to Control Hub. Control Hub managed sites only support email address-based authentication, either with passwords or SSO. You must change your API integration before converting if you want to keep it.

We're exploring a solution to enable API integrations using username based authentication to continue to work even after converting to Control Hub.

Control Hub has its own APIs, including People and License REST APIs for creating and licensing users at:

Most of those APIs also work on Control Hub managed sites, but there are some differences related to user management (e.g. user creation and licensing).

If your integration does user management, such as adding or removing hosts or attendees to Webex Meetings sites, then you need to prepare your integration to use new APIs. Previous API integrations may no longer work after converting your site to Control Hub managed sites.

Previous API calls won't work for Control Hub managed sites. The following XML API calls are the ones that require attention:

Table 1. APIs that Require Attention


API Issue After Site Conversion



If username is used for WebexID or hostWebExID and it doesn't match any email, then the API integration will fail after site conversion.

Use email rather than username


Not supported in Control Hub managed sites.

Switch to use People API after site is converted.


Not supported in Control Hub managed sites.

Switch to use People API after site is converted.


Works with most parameters, such as tracking codes and session types, but not all.

Doesn't work with assigning or changing a user's role, such as attendee to host.

If assigning a user's role, then use People API after the site is converted.


Not supported with username.

Use email

Username in securitycontext*

username as webExID in securitycontext isn't supported in Control Hub managed sites.

Use email

Session ticket

Session ticket before conversion may not be valid after conversion.

Assign session tickets after conversion.

SSO bypass by admins

If API integration is using SSO bypass for authentication and the email address of the admin isn't in the same organization as the site, you must deactivate that admin's account before site conversion.

If username is used, then the API integration will fail.

As a workaround, you can assign the admin as an external administrator in Control Hub after site conversion. You can use the same email address as the original email address in Site Administration.


All urlapi that use username for Webex identity (WID) will fail if username isn’t the same as email.

For example:

Use email rather than username

* As mentioned in the note at the beginning, we're working on a way on how to allow you to carry over API integrations that use username-based authentication for sites that convert from Site Administration to Control Hub.

** We’re planning on enabling user management XML APIs to work with Control Hub managed sites as a bridging feature, which allows your integrations to work when converting your site to Control Hub while giving you more time to transition your integrations to People API. This bridging feature will only be supported for one year once it’s available.

You can use the People API to create organization administrators with full or read-only permissions, and these become administrators on all your Control Hub managed meeting sites.

Control Hub does have Webex site specific administrator roles, but the People API can't assign this role at this time.

Read more about assigning user roles, including Webex Site Administrator Roles, at https://help.webex.com/fs78p5.

Prepare your API integrations to use the People and License APIs before you convert your site. Then you can switch your integration over to the new APIs after you convert the site.

Currently, apps and integrations need to be associated to a Control Hub user's credentials.

Future Plans

We plan to enable admin applications whose email address is independent of traditional users in a Control Hub organization, i.e, the identity of such integrations aren't tied to specific users. This is targeted for Q1 2022 and is subject to change. When this capability becomes available, users can create a new category of admin applications to integrate with Webex using a process similar to Webex integrations and bots at developer.webex.com.

Some features need to be disabled before you can convert a Webex site to Control Hub. You can see a list that shows you what feature needs to be disabled. Features that are marked with a red circle X icon must be done. Features marked with a yellow triangle exclamation point icon are just for your information and require no action.

  1. Sign in to Webex Site Administration and go to Configuration > Common Site Settings > SSO Configuration.

    (Read about SSO configuration on your Webex site at https://help.webex.com/g5ey83.)

  2. Find and disable the Auto Account Creation option.

  3. Click Update.

  4. Go to Configuration > Common Site Settings > Options.

    • Find and disable the Allow host account signup option.

    • Find Require for account signup: and clear all the boxes for required user profile fields.

    • Find Allow user to change below fields: and clear all the boxes.

  5. Click Update.

  6. Go to Configuration > Common Site Settings > Tracking Codes.

  7. In the Host Profile column, change all the tracking code rows marked as Required to AdminSet or Optional.

    All tracking code values for users are preserved when you convert a Webex site.

The site conversion tool converts your site's users to Webex users in your Control Hub organization.

Before you try to convert users, you should sign in to Control Hub (https://admin.webex.com) to perform some essential configuration.

If you haven't yet verified your domains or claimed your users from other Webex organizations, read Prepare your Control Hub Organization for Site Conversion, earlier in this article.

To make sure we convert your users successfully, you must fix the following types of user problems before you convert the site:

  • Unverified users

  • Unlinked users

  • Users in other Control Hub organizations

  • Users with mismatched email addresses in Site Admin and Control Hub

If you try to convert the site while site users have these problems, the conversion process could fail.

The tool does not attempt to convert Inactive users; so, if you cannot correct all users, you can deactivate the remaining users before you convert your site.

How to check for these user problems

  1. Sign in to Site Administration, and open the Convert Site page.

  2. Open the Review conversion prerequisites control, and click Export affected users in CSV.

  3. Wait for the export to finish, then click Download CSV.

    Your browser downloads users-to-review.csv.

  4. Open the CSV file and check the following columns:

    • User linking status: If the value is Not Linked, it means the user has not already been linked to Control Hub.

      Read What to do about Unlinked users below. You may not need to resolve this issue for all users, because it does not by itself prevent the conversion, but unlinked users could also have other problems that must be resolved before the conversion.

    • Site Admin Email Verified: If the value is N, then the user did not verify their email address (this information corresponds with the UnverifiedEmail column in the normal SiteUsers.csv export file).

      You must try to correct this problem, or deactivate these users, before you start site conversion. See How to fix Unverified users below.

    • ORG-NAME: The value should be the same as your Control Hub organization. A different value means that the user is already in another Control Hub organization, which prevents the site conversion.

      You must claim or deactivate these users.

    • Email different between Site Admin & Control Hub: If the value is Y, then the email address is mismatched or the user is not linked.

      Read Users with Mismatched Email Addresses (below)

  5. Evaluate what to do in each case (read the sections below).

    You can try to verify users, correct email addresses, or claim users into your Control Hub organization from another organization. If you cannot or choose not to correct these issues, you must deactivate the users in Site Admin before you convert your site.

Try to fix Unverified users

Here is how you can verify your meetings site users:

  • Verify the email domain/s in Site Administration. When you verify an email domain, you automatically verify all users with their email addresses in that domain.

  • Ask unverified users to sign in to the site (site url). Webex leads them through the email verification flow.

Remember that users who are unverified may never have signed in and may not need to host meetings.

After trying to get users verified, you must deactivate the remaining unverified users before you convert the site. You can check on the Convert Site page by (re)exporting the affected users and then reviewing the CSV file.

What to do about Unlinked users

The following types of users are not linked in Control Hub and are not eligible for site conversion:

  • Unverified users are not linked.

  • Inactive users are not linked​.

  • Users are not linked if all of the following are true:

    • The user's email domain is claimed in Control Hub.

    • The user does not exist in the organization that claimed the domain.

    • That organization is synchronizing its users from Active Directory.

      Under these conditions, Webex can't create new users in your organization unless you synchronize them from Active Directory.

No action is required with unlinked users to proceed with site conversion – just an awareness that these users will not have a role in the site after site conversion (not host or attendee or admin role).

If you fix the issues that prevented the users from being linked, the overnight sync job can link them to your Control Hub organization.

What to do about users in other Control Hub organizations

You cannot convert site users or administrators who are already in different Control Hub organizations.

There is an exception to this rule: site administrators are eligible for conversion if they belong to the partner organization that created or manages your Control Hub organization. We don't list these users in the users-to-review.csv file.

Here's what you can do if your site users are already in other Control Hub organizations:

  • Claim the users into your Control Hub organization (requires that your organization has verified the email domain of those users). Read https://help.webex.com/nceb8tm.

  • Deactivate users in Site Admin before you convert the site.

Users with Mismatched Email Addresses

Some users may have a different email address in Site Admin and Control Hub. This is possible if the user’s email was changed in only one of the two places after the user was linked from this site to Control Hub.

These users are marked with Y in the Email different between Site Admin & Control Hub column of the CSV file exported from the site conversion tool.

Try these actions to fix users with mismatched email addresses:

If you convert your site without correcting user email mismatches, the affected users must use their Control Hub email addresses to log in to their meeting site.

How to deactivate users

When you deactivate users, they lose their host license or attendee privilege (depending on which role they had while Active).

For individual user deactivation in Site Administration:

  1. Go to User Management > Edit User.

  2. Use the index, search, and filter controls to find the user.

  3. Uncheck the Active box.

  4. Submit the changes.

    See Manage User Accounts in Cisco Webex Site Administration for more information.

For batch user deactivation in Site Administration:

  1. Export the users to a CSV file.

  2. Open the CSV file and modify the Active column values to N for all affected users.

  3. Import the modified CSV file.

    The users you changed are now Inactive.

    See Batch Import and Export Webex Users in Webex Site Administration for more detail.

Before you begin

There are some features you must disable, and you must check that all users are in a good state to be converted. If you are using API integrated applications, you need to update them to use the Webex API.

You can read about these prerequisites in the earlier parts of this article.

Make sure that all your administrators know that you are converting the site to Control Hub, and that they must not make any changes in Site Admin after you start.


Sign in to Site Administration and click Convert Site.


Review the prerequisites, especially the CSV list of users in states that could affect the success of the conversion.


Read about the features that need to be disabled and the differences you can expect in user management and host licensing (also documented in this article).


Click Convert to Control Hub.


Review the messages about the changes you can expect.


Click Convert.

The conversion process starts and you can see a progress indicator. If anything goes wrong, you'll see an error message with suggested action. Otherwise, you'll see a success message.


Converting a site to Control Hub is permanent and you can't undo the conversion process once it finishes. When the site conversion finishes, this site will no longer be managed in Site Administration. If you're not prepared to fully manage this site in Control Hub, exit the wizard now.


Click Sign in to Control Hub.

After triggering the site conversion from Webex Site Administration, you can sign in to Control Hub to track conversion progress.

  1. Sign in to Control Hub at https://admin.webex.com and open the Meetings page.

    You can see a list of your meeting sites.

  2. Click a site to see information about that site.

  3. Look for the Site Conversion section, where you can read the Conversion status.

    If the conversion is finished, you can download a list of users that were converted.

  4. Review the list to check for conversion problems.

You can no longer manage this site in Site Administration once the site conversion finishes. All management for this site must be done in Control Hub. Here are some steps to familiarize yourself with and try out management of your site in Control Hub:

  1. Select a host, and verify their license and session types. Confirm that their scheduled meetings are effective.

    Ask the user to check that they can schedule and host new meetings.

  2. Add a new user to your organization. Grant them a host license, modify their session types, and verify that they can host meetings.

  3. Select a user who was a full administrator in Site Administrator, and verify that they have the appropriate level of access to the converted site.

    They should be able to read and modify the site; create, license, modify, and delete users.

  4. If your site has API integrations, then switch to using the People APIs. Confirm that the updated integration is working as expected.

Read more about managing meeting sites in Control Hub at https://help.webex.com/naqlzeu.