If you want to completely manage users, Webex services, and licenses all in one place, you can choose to update managing a Webex site from Site Administration to Control Hub.
About updating from Site Administration to Control Hub
Updating a site from Site Administration to Control Hub won’t require an update of client versions. Some sites won't be enabled for this feature until the partners that manage those organizations are ready.
Webex is becoming a unified platform for managing meetings, messaging, calling, and other modes of collaboration. That's why we want to move the management of all Webex meetings sites from Site Administration to Control Hub.
We have a tool in Site Administration to help you through this change, so if your site is already eligible to update to Control Hub, you can get started by clicking on Update Administration in the navigation menu.
For a demonstration on how updating your site to Control Hub works, see this video.
To help plan your site update, review the Site assessment readiness section.
The benefits of managing sites in Control Hub include:
Unified license assignments across all Webex services, such as Meetings, Messaging, and Calling.
Consistent security policies across all Webex services.
Common sign-in experience for all end users between different Webex services.
Modern administrator controls, such as Directory Connector, SCIM, and active directory groups.
License templates to assign multiple licenses to users automatically.
You can't use Site Administration to manage a meetings site after updating to Control Hub.
Before updating your site to Control Hub, we highly recommend that you review the following items first to make the update go as smoothly as possible:
- First, review this document and ensure that your organization follows the best practices that are recommended in the Prepare your Control Hub organization section.
- Next, sign in to Webex Administration and click Update administration. In the site readiness phase, you shouldn't take any recommended action in the file from the review users section and shouldn't disable any features called out in the review features section yet. By following these instructions, the site readiness assessment becomes a read-only operation just to assess the changes you need to do before updating to Control Hub.
- Under the Review users section, click on Export user CSV file and download the CSV file, which is called
This file will list all the users that need attention and will have a recommended action for each user. The number of users in this file gives you an idea of how many user-related issues you have to work on before you can update the site.
- Under the Review features section, look at any features listed with a red X in the consequences column. This will inform you on your site’s readiness from a feature-conflict perspective.
- Do not go to Step 2 and do not click the Update to Control Hub button yet.
Once you've reviewed the user CSV file and looked at what features you may have to reconfigure, continue reading the rest of the sections in this article to prepare your site and organization on how to update to Control Hub.
Note: If your site has API integrations done by your company or through third-party solutions, such as learning management solutions, make sure you review the Prepare site API integrations to work with Control Hub section.
The experience of managing sites in Control Hub is similar to managing in Site Administration. User management in Control Hub has more modern underlying technologies, so there are a few differences in managing sites in Control Hub. This section focuses on differences called out when updating your site.
For a more detailed overview of the differences between Site Administration and Control Hub, see this article.
We have a centralized user management system underlying Control Hub, where users are distinct and unique within the whole organization (and all of Webex). In Site Administration, the user profile is distinct per meeting site.
- Single Sign On (SSO) with automatic account creation
In Site Admin you have an “auto account creation” feature that creates users when they authenticate themselves by SSO.
This feature isn't available in Control Hub because there are more robust ways to add new users. You must disable this feature in Site Administration before you update your site to Control Hub.
Many organizations that use SSO may prefer to centrally manage their users in external directory tools such as Microsoft® Active Directory and Microsoft Azure, as well as requiring authentication with external identity providers.
Read more about:
- Mandatory profile data and tracking codes
Site Administration allows you to specify required profile fields for new users (previous screenshot). You can extend this to require tracking codes for user creation (screenshot below). If you configure these additional requirements, you cannot add users to the site without them.
Control Hub only needs a display name and email address to create a user.
All other user fields are optional when you create a new user in Control Hub, so we do not enforce additional profile data for Control Hub managed sites.
You must disable mandatory profile fields and tracking codes before you update your site to Control Hub.
- Password management and lockout
Site Administration has a feature that temporarily locks users out if they fail to sign in after a number of tries.
Control Hub has the following options to prevent unauthorized access:
Automatic timeout after the first few failed attempts.
A CAPTCHA mechanism (Completely Automated Public Turing test to tell Computers and Humans Apart).
Legitimate users have a self-service option to change their forgotten passwords.
- Hosts must be in your Control Hub organization
In Site Admin you can assign a host license to any user. When you're managing the site in Control Hub, you can only assign host licenses (& attendee role) to users in the same Control Hub organization.
- Self sign-up for Host account
In Site Admin you can choose to allow users to request a (host) account on the site. You can also allow users with an account to request additional services on the site. (see screenshots).
When you are managing a meeting site in Control Hub, users cannot request their own host account for that site.
Control Hub has a centralized, automated way for you to assign meeting licenses to new users instead. Read https://help.webex.com/n3ijtao.
You can also manage user licenses by API or in bulk using CSV.
If you want users to request their host accounts, you can configure the site help/support with pointers to contact admins or link to other tools.
You must disable “Allow host account signup” and “Allow users to request additional services” in Site Administration before you update your site to Control Hub.
Control Hub has other license management options, like auto-assignment templates. You can get a report of inactive hosts to help you remove licenses from those users, individually or in bulk, or by API.
If you need this automated deactivation option, and the other options in Control Hub are not suitable for you, then you should avoid updating your site to Control Hub at this time.
Before you update your meeting site to be managed in Control Hub, you should prepare your Control Hub organization.
Make sure there are no pending or blocking actions on the subscription. The update will fail if:
We strongly recommend verifying your domains and claiming your users. The following reading will help:
The Control Hub eBook: https://ebooks.cisco.com/story/controlhubessentials/
How to manage your domains: https://help.webex.com/cd6d84
Claim your users from other organizations (after verifying your domains): https://help.webex.com/nceb8tm. Claiming users is especially important to do because it ensures as many users as possible who should be in your organization are actually there.
Per the help doc above, claiming users can take up to 14 days. Make sure you plan accordingly to avoid deactivating the users in Site Administration before updating your meeting site to Control Hub.
If the meeting site is configured for SSO, then you must also configure SSO for your Control Hub organization.
Auto account creation for new users
If your Webex site enabled auto account creation in Site Admin, you can enable a similar feature in Control Hub with SAML auto account creation. Make sure to also set up an automatic license template so that new users will automatically get assigned licenses once their accounts are created in the Control Hub organization.
Organizations with directory sync
If your organization is configured for directory sync, then make sure all users that you want to be in your organization are present in the site. This should be done 24 hours before you start the site updating process so that users on the site can be linked to the new users in your Control Hub organization.
The update will fail if active users on the site can't be linked to Control Hub users.
XML APIs are now forward compatible with Control Hub managed sites. You can read about the details and caveats at XML API 41.11.0 Updates.
XML API service URLs' are unchanged after a site is updated from Site Admin to Control Hub managed. The same API URLs will continue to work. Authentications for API integrations via username and password that worked before updating the site will also continue to work. Those API integrations don't need to change to use an email address for authentication at the time of site update. This is a temporary stop-gap measure and the integrations should still update to use email address or Webex Oauth for authentication.
Organization full administrator role for API integrations
For admins whose credentials are used for API integrations, we recommend that you promote those admins to organization full administrators in Control Hub, ideally before updating the site to Control Hub. Administrators with only a Site Admin role may not be able to do some operations with XML APIs, such as changing a user's email address or display name.
You can also learn more about XML API integrations on Control Hub managed sites with this guide. This guide references Webex Integration token management and how to exchange these tokens for session tickets for use in XML APIs.
As a best practice, we recommend that you update a test site first to confirm that your API integrations will work unmodified after updating to Control Hub.
Bypass sites with SSO
In Site Admin SSO sites, many integrations use a local admin account to bypass SSO authentication. In Control Hub you can accomplish the equivalent by using an external full administrator account for this purpose. See this help article for more information.
If your API integration uses a SSO bypass account, make sure that this account is setup as an admin or external admin in the Control Hub organization; otherwise, the integration will fail after updating the site to Control Hub. Depending on what your integration is doing, admins may also need to be assigned a host account on the Control Hub site for the integration to work (this wasn't required for admins in Site Admin sites).
XML API differences in Control Hub
Most XML API integrations should work, without any changes, after updating your site. But there are some exceptions which are detailed in the following list:
- CreateUser—On Control Hub managed sites, this operation may also create a user in the site owning org before assigning a license. If the user already exists in another org, this operation will fail.
PMR ID parameterwon't take effect for users who don't already have an Active status in Control Hub.
createuserAPI takes longer to complete on Control Hub managed sites. For better performance, you can add an additional thread to parallelize
- SetUser—Could result in assigning or removing meetings site license from the user (depending on the API parameters or payload).
- DelUser—Removes meetings site license, but doesn't delete the user from the Control Hub organization.
- LstsummaryUser—Also returns the user's
- AuthenticateUser—On Control Hub managed sites, we recommend creation of session ticket via
AuthenticateUserrather than using username and password for each XML API. Use of SAML response in body content isn't supported with this call for Control Hub managed sites.
Control Hub has its own APIs, including People and License REST APIs for creating and licensing users at:
However, the REST APIs above don't support all the user management functions available in XML APIs. For example, you'll still need to use XML APIs to change session types and to configure tracking codes for users. People API doesn't support the assignment of Site Admin roles to users. If you want to assign Site Admin roles via an API, you're still required to use XML API.
You can use the People API to create organization administrators with full or read-only permissions, and these become administrators on all your Control Hub managed meeting sites.
Control Hub does have Webex site specific administrator roles, but the People API can't assign this role at this time.
- Enable licensing for external users who aren't in the same organization that owns the Control Hub managed site. We'll also enable licensing external users with APIs.
- Cisco’s long term direction is to use only REST APIs (for all operations on users and meeting sites). XML APIs for user management will continue to be supported until REST APIs can be used exclusively for all user management operations.
Some features need to be disabled before you can update a Webex site to Control Hub. You can see a list that shows you what feature needs to be disabled. Features that are marked with a red circle X icon must be done. Features marked with a yellow triangle exclamation point icon are just for your information and require no action.
For a demo on how to update your site to Control Hub, see this video.
Sign in to Webex Site Administration and go to.
(Read about SSO configuration on your Webex site at https://help.webex.com/g5ey83.)
Find and disable the Auto Account Creation option.
Find and disable the Allow host account signup option.
Find Require for account signup: and clear all the boxes for required user profile fields.
In the Host Profile column, change all the tracking code rows marked as Required to AdminSet or Optional.
Read more about tracking codes at https://help.webex.com/izu2ty.
All tracking code values for users are preserved when you update a site to Control Hub.
Before updating your site to be managed in Control Hub, make sure that:
- All users of the site who should be in your organization are actually in your Control Hub organization.
- All users of the site who shouldn't be in your organization are deleted from your organization.
- Users in the organization can be authenticated by your IdP if your organization is configured for SSO.
- You reviewed the Prepare your Control Hub organization section from earlier in this article.
For a demo on how to update your site to Control Hub, see this video.
To make sure we update your users to Control Hub successfully, you must fix the following types of user problems before you update the site to Control Hub:
Users in other Control Hub organizations
Users with mismatched email addresses in Site Admin and Control Hub
If you try to update the site to Control Hub while users have these problems, the update administration process could fail. The tool doesn't check to see if you've corrected the issues until after you start the final update.
Users in organizations with directory sync
If there are unlinked users who should be in your organization, but aren't added yet, you must first add them to your organization. This is especially critical for organizations that are configured for directory sync (through Directory Connector or Azure AD) because directory sync won't allow the site updating process to add users.
The site update will fail if any active users on the site can't be linked to a Control Hub organization. If your organization is configured for directory sync, make sure all users on the site that must be part of the Control Hub organization are added to Directory Connector or Azure AD first before starting the update.
Users in Webex for Government organization email domains
If you have users whose email address domains belong to a Control Hub organization that's in Webex for Government, then those users must be deactivated in Site Administration before updating the site
How to check for users that will block site update
Sign in to Site Administration, and open the Update Administration page.
Open the Review prerequisites for updating administration control, and click Export affected users in CSV.
Wait for the export to finish. This process can take a while depending on the start time and number of users in the site. There's a few minutes delay for this operation during the top of the hour.
Click Download CSV once the export finishes.
Your browser downloads
Open the CSV file and check the Recommended action column (the last column). Take the recommended action for each user in the file.
Users in other Control Hub organizations
You cannot update site users or administrators who are already in different Control Hub organizations to the Control Hub organization that you're updating to. The most common recommended action for these users will be to claim the users in Control Hub or deactivate the users. Those deactivated users will lose their service on the site.*
There is an exception to this rule: site administrators are eligible for updating to Control Hub if they belong to the partner organization that created or manages your Control Hub organization. We don't list these users in the
Claiming eligible users (your company's users) into your Control Hub organization (requires that your organization has verified the email domain of those users) will reduce the number of users that need to be deactivated before updating your site to Control Hub.
* We plan to enable meeting site licensing for users that aren't in your Control Hub organization in the upcoming months. If you don't want to deactivate users who are in external organizations (not in your Control Hub organization), you may want to wait for this enhancement before updating a site to Control Hub.
Users with mismatched email addresses
Some users may have a different email address in Site Admin and Control Hub. This is possible if the user’s email was changed in only one of the two places after the user was linked from this site to Control Hub.
Try these actions to fix users with mismatched email addresses:
Change the user's email address in Site Admin to match the Control Hub email address
Users can edit their Site Admin profiles: https://help.webex.com/nmig1kcb
Change the user's email address in Control Hub to match the Site Admin email address: https://help.webex.com/nsi3kgb.
Users can change their own email addresses in Control Hub organization: https://help.webex.com/nme40aeb
If you update your site to Control Hub without correcting user email address mismatches, the affected users must use their Control Hub email addresses to sign in to their meeting site. Those users may be unable to sign in if they try to sign in with the email address in Site Admin or if their Control Hub email address is no longer valid in their IdP (for SSO orgs). They won't block you from starting the update administration process, but it's better to fix the email addresses before starting the update.
How to deactivate users
When you deactivate users, they lose their host license or attendee privilege (depending on which role they had while Active). Deactivated users will still appear in the site CSV export file after updating the site to Control Hub.
For individual user deactivation in Site Administration:
Use the index, search, and filter controls to find the user.
Uncheck the Active box.
Submit the changes.
See Manage User Accounts in Cisco Webex Site Administration for more information.
For batch user deactivation in Site Administration:
Export the users to a CSV file.
Open the CSV file and modify the
Activecolumn values to
Nfor all affected users.
Import the modified CSV file.
The users you changed are now Inactive.
See Batch Import and Export Webex Users in Webex Site Administration for more detail.
Before you begin
There are some features you must disable, and you must check that all users are in a good state to be updated to Control Hub. If you are using API integrated applications, you need to update them to use the Webex API.
You can read about these prerequisites in the earlier parts of this article.
Make sure that all your administrators know that you are updating the site to Control Hub, and that they must not make any changes in Site Admin after you start.
Sign in to Site Administration and click Update Administration.
Review the prerequisites, especially the CSV list of users in states that could affect the success of the update.
Read about the features that need to be disabled and the differences you can expect in user management and host licensing (also documented in this article).
Click Update to Control Hub. This button is only activated after the steps above have been completed.
A pop-up window appears. This window shows that updating a site to Control Hub is permanent and you can't undo the update once it finishes. When the update finishes, this site will no longer be managed in Site Administration. If you're not prepared to fully manage this site in Control Hub, exit the wizard now.
The update starts a banner appears above Site Administration to let you know that a site update is in progress. If anything goes wrong, you'll see an error message with suggested action. Otherwise, you'll see a success message.
Site update takes approximately 2 minutes + 500 users/minute to complete. For example, if you started the site update at 5:20 and your site has 3000 users, you can expect the update to be done in around 8 minutes. But your results could vary.
Click Sign in to Control Hub.
After triggering the site update from Webex Site Administration, you can sign in to Control Hub to see the status of the site update.
The site update will take longer to update if it's triggered near the top of the hour. Site updates are paused for a few minutes before and after the top of every hour.
Sign in to Control Hub at https://admin.webex.com and open the Meetings page.
You can see a list of your meeting sites.
Click a site to see information about that site.
Look for the Site Update section, where you can read the Update status.
After the update is finished, you can download a list of all users in Site Administration and see which of those users were active or inactive on the site. Users that are shown as inactive in the user status column of Site Administration won't have access to the Control Hub managed site. Those users also won't be shown as having any access to the site in the user section of Control Hub.
It can take some time for the download button to appear (minutes for most organizations).
Review the list to check for any problems while updating.
You can no longer manage this site in Site Administration once the site update finishes. All management for this site must be done in Control Hub. Here are some steps to familiarize yourself with and try out management of your site in Control Hub:
Select a host, and verify their license and session types. Confirm that their scheduled meetings are effective.
Ask the user to check that they can schedule and host new meetings.
Add a new user to your organization. Grant them a host license, modify their session types, and verify that they can host meetings.
Select a user who was a full administrator in Site Administrator, and verify that they have the appropriate level of access to the updated site in Control Hub.
They should be able to read and modify the site; create, license, modify, and delete users.
If your site has API integrations, then switch to using the People APIs. Confirm that the updated integration is working as expected.
Read more about managing meeting sites in Control Hub at https://help.webex.com/naqlzeu.
Users will have a single, unified sign-in experience to the Webex App and all Control Hub managed sites.
If the username doesn't match the user's email address in Site Administration, then those users will have an impact with the sign-in experience. Old usernames can no longer be used, and those users must use their email address to sign in.
User credentials are associated with their Control Hub identity. Those same credentials apply to all Control Hub managed sites in that same organization and to the Webex App.
If the Control Hub organization has SSO configured, then that SSO governs the sign-in experience to the Webex App and all Control Hub managed sites.
The sign in-experience to the Webex App isn't affected as a result of updating to Control Hub.
When users sign in to a Webex Meetings site, the sign-in screen will look different. Users must enter their email address to sign in even if their organization is configured for SSO.
Admins can enable the Remember me option in Control Hub so that users don't have to enter their email address again each time they sign in.
Depending on each user's history, the number of sites they had an account on, etc.:
If users were linked to existing users in Webex Identity/Control Hub, then users will use that same password for all Webex sites that are updated to Control Hub.
If users were created in Webex Identity/Control Hub due to site linking, then their first linked site's credentials apply (if the org wasn't configured with SSO). Users are redirected to sign in to that site. If users have multiple sites with multiple credentials, the site URL should help them determine which credentials to use.
Users are allowed to reset their password in Control Hub organizations (if password isn't managed via SSO). If users forgot their password, they can just click on Forgot your username or password? at the sign-in screen to reset their password. Users can also reset their password by following these instructions:
If an end user’s email address changed and that user had a different email address in Site Admin and Control Hub at the time of site update, that user may experience problems when trying to sign in. The user may not know that they now need to use their Control Hub email address to sign in or the email address in Control Hub may no longer be valid in their organization's SSO IdP. This type of situation is best avoided by updating the email addresses of users in Control Hub as changes are made to the email addresses of the same users in Site Admin.
Re-sign in required for users on Webex Meetings mobile app for iOS:
- If you update a non-SSO site to Control Hub, then your users will have to re-sign in to the Webex Meetings mobile app for iOS. Although the Meetings for iOS app won't require users to re-sign in for up to two months after the site update, we suggest that users re-sign in manually to preemptively avoid that situation.
Empty "user to review" CSV file
If your site is large and has more than 1000 users whose email addresses are different in Site Admin than in Control Hub, then you could experience an empty "user to review" CSV file in the site update wizard. This causes the site update to not work because you won't be able to resolve the users with issues. This issue is being worked on and we plan to resolve it in the coming weeks.
Settings that currently don't carry over when updating to Control Hub
- The Allow attendee to join audio portion of Personal Conference before host setting doesn't carry over to Control Hub sites if it's enabled in Site Administration. We'll be making changes to ensure this setting will carry over.
Workaround: Contact Cisco to get the toggle
ONfor your site and then enable that setting again.
User issues that cause the update to fail
- Users with email addresses that are linked to users in a Webex for Government organization will cause the update to fail if those users aren't deactivated before starting the update.
Common issues that cause the update to fail and recommended actions
If your site fails to update to Control Hub, check the following table to see if one of these comon errors are the cause and what you can do to fix it.
|Errors that cause update to fail||Recommended action|
|The site type is invalid.||Contact your Webex Support team to validate that the site is user-linked.|
|The site has no subscription associated with it.||Sites must be associated with a subscription before it can be updated to Control Hub.|
|There is an issue with the organization ID.||Site linked organization ID isn't the same as the subscription organization ID. Contact your Webex Support team.|
|The following subscription has pending operations in Control Hub: (SubID).||Retry site update after pending operation is completed.|
|There are conflicts in the single sign-on (SSO) settings.||If site is SSO enabled, then make sure that: |
|The site license information in Site Administration doesn't match the site license information in Control Hub.||Inconsistent license information between Site Admin and Control Hub. Contact your Webex Support team.|
|Some usernames or email addresses in Site Administration conflict with usernames or email addresses in Control Hub.||A user's email in Site Admin is used by another user in Control Hub. Change one of the email addresses or usernames.|
|We had a problem updating your site.||An internal error prevented this site from being updated. Contact your Webex Support team.|
|We had a problem updating the Webex users.||An internal error prevented this site from being updated. Contact your Webex Support team.|
Q. Is there a date for when Cisco will no longer support Site Administration?
A. Yes. We plan to deprecate Webex Site Administration in Q4 of the 2023 calendar year (exact date to be determined). We recommend that you update your site management from Site Administration to Control Hub before the end of the first half of 2023.
Q. If a user is deleted in Control Hub and then the same email address is re-added to Control Hub and assigned a Meetings license to the same Webex site, can the user access their old recordings?
A. Yes, the user will have access to all of their old Meetings content if they're assigned a license to any of the previous Webex sites they were on. This applies to both Control Hub managed sites and sites that were updated to Control Hub.
Q. If a user was deactivated in Site Admin before the site update to Control Hub and then later was re-licensed to the same Webex site in Control Hub, will the user have access to their old recordings?
A. Yes, the user will still have access to their old recordings. Additionally, any user that was deactivated in Site Admin before the site update will be listed in the Meetings CSV export file in Control Hub.
Q. If a site doesn't have an SSO IdP set up, but the Control Hub organization does have an SSO IdP, what happens when the site updates to Control Hub?
A. The site will use the same SSO IdP as the Control Hub organization.
Q. If a site has a different SSO IdP set up than the SSO IdP in Control Hub, what happens when the site updates to Control Hub?
A. The site will switch over to use the same SSO IdP as the Control Hub organization.
Q. If a site does have an SSO IdP set up, but the Control Hub organization doesn't have an SSO IdP, what happens when the site updates to Control Hub?
A. You'll be blocked from updating your site. To unblock the site so you can update to Control Hub, either remove the SSO IdP from the Site Admin site or add an SSO IdP to the Control Hub organization.
Q. Can I still sign in to the site URL to access recordings and schedule meetings or events?
A. Yes, you can still sign in to the site URL where you can access recordings, schedule meetings, etc.
Q. Are user-specific settings modified during the site update from Site Administration to Control Hub?
A. No, user settings will remain unchanged. Those settings will be applicable as before the site update.
Q. Are my recordings or scheduled meetings affected by this site update?
A. Host recordings aren't affected. You'll still have access to them. Your scheduled meetings also aren't affected. There are no changes to them.