Collaboration restrictions for Webex Meetings in Control Hub

Overview

You can restrict all users from joining meetings outside your organization, or restrict access to certain in-meeting features to make sure that users follow your organization's policies. When users try to use a disabled feature, an indicator appears to let them know about the restriction set by the organization.

Collaboration restrictions only support Webex Meetings and Webex Webinars. These restrictions don't apply to Webex Events (classic), Webex Training, and Webex Support.

These settings apply only to users who are on the Webex Meetings client version 42.3 or higher and Webex App client version 43.6 or higher.

Users can bypass these restrictions by joining internal and external meetings with their personal email addresses, or as guests. To avoid users bypassing these restrictions, follow the steps in Restrict Collaboration Features for Windows, Mac, Android, and iOS devices to add a token to company devices to make sure that accounts used with the devices follow the restrictions set by your organization.

When applying collaboration restrictions, if the user logs in with a different organization ID from the registry, Control Hub follows the most restrictive policy. Both, the user policy and the organization policy are checked. But if the user logs in with the same organization ID in the registry, then Control Hub follows the logged in user’s policy.

Collaboration restrictions at a group or user level

If you want to set up policies for specific groups or on a per user basis instead of the whole organization, you can do so by creating meetings settings templates.

Allow or block external users from joining meetings in your organization

You can allow or block users outside of your organization from joining meetings hosted by users in your organization.

1	Sign in to Control Hub, and go to Services > Meeting.
2	Click Settings.
3	Under Meetings, select one of the following next to Internal: Allow all external users—Users outside of your organization can join meetings hosted by users in your organization. Allow external users with approved email domains—Users with email domains that you approved can join meetings hosted by users in your organization. Block all external users—Users outside of your organization can't join meetings hosted by users in your organization.
4	If you selected Allow external users with approved email domains, enter an approved email domain and click Add. You can also toggle Apply these settings to Personal Room Meetings only on, to apply the internal meeting policy.

Block users from joining external meetings in Control Hub

When you block users from joining external meetings, they can't join meetings that are hosted from Webex sites outside of your organization. But you can allow users to join meetings on certain Webex sites, by adding those Webex sites to an approved list setting.

New behavior changes

Previously, you could allow users to join external meetings and any collaboration features that you restricted would still work. For example, if you restricted chat during meetings, users could still use the chat panel in external meetings that were in the approved list.

This behavior has now changed with a recent update. The approved list is now a list of sites that users can join external meetings in with the collaboration restrictions that you set. For example, if you restricted chat, then users won't be able to use the chat panel in external meetings.

1	Sign in to Control Hub, and go to Services > Meeting.
2	Click Settings.
3	Under Meetings, select one of the following next to External: Allow all external sites—Users are allowed to join all external meetings. Allow approved external sites—Users can only join external meetings from approved Webex sites. Block all external sites—Users aren't allowed to join external meetings from any Webex site.
4	If you selected Allow approved external sites, enter a Webex sitename and click Add.

What to do next

If you allow users to join external meetings, you can select which collaboration features users have available to them during external meetings.

Restrict collaboration features in Webex Meetings

These settings apply to users joining internal and external meetings. If you want to restrict your in-meeting features, then you can create and use a custom session type or a meeting settings template.

Session types support only internal meeting policies. Session types are applicable only when the user is the meeting host.

Meeting settings templates support internal and external meeting policies. Meeting settings templates are applicable when the user is the meeting host or participant.

Click Settings.

Toggle the features you want to enable or disable for users during internal or external meetings:

Breakout sessions

Setting	Description	Available on the Webex Suite meeting platform?
Broadcast messages	Allows a meeting host to broadcast a written message to participants in one or all breakout sessions.	Yes

Collaboration tools

Setting	Description	Available on the Webex Suite meeting platform?
Annotation	If you are a restricted user and annotation is disabled, others can't annotate your sharing. Annotation is blocked for you. When others are sharing, you can view what's being shared, but you can't annotate. If the restricted user is the meeting host, then nobody in the meeting can annotate.	Yes
Breakout sessions	Broadcast messages—Users have access to broadcast messages.	Yes
Polling	If disabled, the restricted user cannot use the polling feature.	No
Q&A	If disabled, the restricted user cannot use the Q&A feature.	No

In meeting

Setting

Description

Available on the Webex Suite meeting platform?

Chat

If disabled, the restricted user cannot send or receive chat messages. If the restricted user is the meeting host, then nobody in the meeting can chat.

Yes

Closed captioning

If disabled, the restricted user cannot use the Closed captioning feature.

Yes

Enforce virtual background

Requires that users have a virtual background in order to turn their video on.

Yes

File transfer

If disabled, the restricted user cannot share files, and cannot view or download shared files.

Yes

Participant list

If disabled, the restricted user cannot view the participant list. If the restricted user is the meeting host, then nobody in the meeting can view the participant list.

Yes

Take presenter

If disabled, users cannot take the presenter role.

Yes

Notes

If disabled, the restricted user cannot use the Notes feature.

Webex Assistant

If disabled, Webex Assistant is not available in the meeting.

This only applies to the host.

Yes

Recording

Setting	Description	Available on the Webex Suite meeting platform?
Cloud recording	If disabled, the restricted user cannot record a meeting to the cloud.	Yes
Local recording	If disabled, the restricted user cannot record a meeting to their local computer.	Yes

Remote control

Turn on remote control—Users can remotely control another computer during the meeting, and allow anyone to remotely control their computers.

Setting	Description	Available on the Webex Suite meeting platform?
Application remote control	If unchecked, the restricted user cannot remotely control another user's application.	No
Desktop remote control	If unchecked, the restricted user cannot remotely control another user's desktop.	Yes
Web browser remote control	If unchecked, the restricted user cannot remotely control another user's web browser.	No

Sharing

Enable sharing—Allow users to share their screen. Toggle this and/or the following sharing features off to increase security.

Setting	Description	Available on the Webex Suite meeting platform?
Application sharing	If unchecked, the restricted user cannot share an application.	Yes
Desktop sharing	If unchecked, the restricted user cannot share their desktop.	Yes
File and whiteboard sharing	If unchecked, the restricted user cannot share files or the whiteboard.	Yes
Web browser sharing	If unchecked, the restricted user cannot share their web browser, but they can view others' shared web browsers.	No
Camera sharing	If unchecked, the restricted user cannot share video from their camera.	Yes

Telephony

Call in (host only)
- Toll—Allow incoming toll calls only.
- Toll and toll free—Allow incoming calls which are either toll or toll-free.
- Global call in—Allow a local phone number to call in to Webex meetings. The local numbers that are available depend on the configuration in your Webex site.
- Calling Line Identification (CLI)—Allow additional security for your meetings. CLI is a form of caller ID that sends a caller's phone number to the system before the call is answered. For more information, see Enable CLI Authentication for Webex Meetings, Webinars, and Training.
  - Check Use authentication PIN if you want to require a PIN when using CLI.
Call back (host only)—If toggled on, these options apply to the host. But if toggled off, they are disabled for everyone.
If Call back is toggled on, you can check the box next to Global call back. If this option is checked, all attendees will be prompted to enter their phone numbers after they join the meeting, and Webex calls back each attendee to connect them to the meeting.
VoIP—Allow host and participants to use VoIP.
Other teleconference service (host only)—If toggled off, the host cannot use a third-party teleconference service.

Video

Enable video—Allow participants to turn on video.
- Standard definition (360p)—User's video can only stream up to 360p.
- High definition (720p)—User's video can stream up to 720p.

In the Internal Webex Meetings section, toggle on

Override participant settings when hosting to allow participants to share the same meeting policy as the host.

Administrators can enable meeting settings override and use existing settings templates to enforce meeting policies for specific hosts. This means that when the host initiates a meeting, all participants follow the host's policy rather than their own.

Restrict collaboration features for Windows, Mac, Linux, Android, and iOS devices

If you want to restrict these collaboration settings devices in your organization, you can edit the system files so that those settings apply to anyone who uses the device to join a meeting outside your organization.

To do this, you have to first find and copy your organization ID in Control Hub. After getting the organization ID, follow the steps that apply to the devices that you want to edit.

Make sure to lock the organization ID in the registry so users can't change it themselves. If users change the organization ID, then the collaboration restrictions won't apply to their devices.

1	Sign in to Control Hub, and go to Management > Account.
2	Click the Copy icon in the Organization ID field.

What to do next

Now that you have your organization ID, choose one of the following methods to edit the devices.

Restrict collaboration features for Windows devices

You can choose from three options to set up collaboration feature restrictions for Windows devices:

Configure manually using a registry value—You can manually edit specific devices by adding the organization ID to the registry:
1. Open the registry and browse to the context where you want to apply this policy. One of:
  - HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\
  - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\
2. Create a new string value called OrganizationID.
3. Right-click the new value and then Modify...
4. Paste the organization ID in the Value data of the new string.
Configure using a Group Policy template—You can import a Group Policy administrative template (.adm) to apply the organization ID to the same registry values as above.
Configure using an MSI Installation—You can run a command to install webexapp.msi using the organization ID to edit this registry value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Webex\Policies\OrganizationID .

Configure using registry keys

Open the Registry Editor.
Add the organization ID to one of the following registry values:
- HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID

Configure using a Group Policy template

Import an .adm file.
In a group policy management tool, click either:
- Computer Configuration to apply the organization ID to HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
- User Configuration to apply the organization to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
In the navigation panel, click Administrative Templates > Classic Administrative Templates (ADM) > Cisco WebEx Meetings > Cisco WebEx Meetings General Settings.
Double-click Configure Organization ID in Cisco Webex.
Click Enabled, add your organization ID in the Options box, and then click Apply.

Configure using an MSI installation

Run the following command to install webexapp.msi with the ORGANIZATIONID parameter to configure HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Webex\Policies\OrganizationID:
```
msiexec /i webexapp.msi /log webexapp.log ORGANIZATIONID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
```

Restrict collaboration features for Mac devices

To set up collaboration restrictions on Mac devices, create a .plist file named com.cisco.webexmeetings.config.plist under /Library/Preferences/, and add the following key to the file:

Key name	Value	Description
OrganizationID	%OrganizationID%	Specify the organization ID that you copied from Control Hub for the collaboration restrictions.

Restrict collaboration features for mobile devices

To set up collaboration restrictions on Android and iOS mobile devices, you have to configure the organization ID using the Mobile Device Management AppConfig service.

This feature works only for mobile devices that use the Webex Meetings app on version 41.7 and later.

Configuration key	Value type	Description
OrganizationID	String	Specify the organization ID that you copied from Control Hub for the collaboration restrictions.

Restrict collaboration features for Google Chrome

To have your organization's policies apply to users who join from Google Chrome, you must add the Webex Meetings Policy plugin downloaded from the Chrome Web Store and then add a rule for your organization to the policy.

Users who are restricted from joining certain meetings will see the following message when they try to join a restricted meeting through Google Chrome.

1	Open Google Chrome's IT admin page at https://admin.google.com
2	Add the Webex Meetings Policy plugin extension by going to Chrome > Apps & extensions > Users & browsers > Add Chrome app or extension by ID.
3	Add the following extension by ID: `denhmfenjcamjiamkogegcjieeiahjgp`.
4	Add the following rule to the policy: `{` `"orgID": {` `"Value": "31b45abd-7528-46f6-8a8c-cf8c3514430b"` `}` `}`
5	Right-click the tab and select Force install.

Known issues

Known issues for Webex Assistant for Meetings

If a meeting has Closed Captioning and Webex Assistant enabled, users with those two features disabled can't turn both of them off during the meeting if they're given the host role.

Known issues for Webex devices

Users on Mac devices can grab the presenter role from users on Webex devices even if the Take presenter feature have been disabled.
Users with the Annotation feature disabled will still see annotations when they use Webex devices to join meetings.

Known issues with older client versions

We recommend that you upgrade the Webex Meetings client to the last version (WBS 42.7 or above) or at least to the latest lockdown version (WBS42.6) so users get the best experience with collaboration features. If users are on an older client version (such as WBS 42.3 or lower), some collaboration features may not be available or may work incorrectly.

Known issues with restricting Annotation and File and whiteboarding sharing features

When Annotation is restricted, but File and whiteboarding sharing isn't, users can still see annotations if the presenter shares a whiteboard and starts annotating.

Restrict collaboration features for Windows, Mac, Linux, Android, and iOS devices

To do this, you have to first find and copy your organization ID in Control Hub. After getting the organization ID, follow the steps to the devices you want to edit.

Make sure to lock the organization ID in the registry so users can't change it themselves. If users change the organization ID, then the collaboration restrictions won't apply to their devices.

1	Sign in to Control Hub, and go to Management > Account.
2	Click the Copy icon in the Organization ID field.

What to do next

Now that you have your organization ID, choose one of the following methods to edit the devices.

This is applicable only for meetings on the Webex Suite meeting platform.

Restrict collaboration features for Windows devices

You can choose from these options to set up collaboration feature restrictions for Windows devices:

Configure using registry keys

You can manually edit specific devices by adding the organization ID to one of these registry values:

Open the Registry Editor.
Add the organization ID to one of the following registry values:
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
- HKEY_LOCAL_MACHINE\SOFTWARE\Cisco Spark Native\OrganizationID

For meetings on the Webex Suite meeting platform, you can set the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\AllowOrganizationIDInHKCU with Value as 1 and Type as DWORD32, and apply the organization ID to one of these registry values:

HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
HKEY_ CURRENT_USER\SOFTWARE\Cisco Spark Native\OrganizationID

Configure using a Group Policy template

You can import a Group Policy administrative template .adm or .admx file to apply the organization ID to the same registry values as above.

Import an .adm file:

Download the group policy administrative template and add it to the group policy management tool.
In the group policy management tool, click either:
- Computer Configuration to apply the organization ID to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
- User Configuration to apply the organization to HKEY_ CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
In the navigation panel, click Administrative Templates > Classic Administrative Templates (ADM) > Cisco WebEx Meetings > Cisco WebEx Meetings General Settings.
Double-click Configure Organization ID in Cisco Webex.
Click Enabled, add your organization ID in the Options box, and then click Apply.

Import an .admx file:

Download the group policy administrative template and add it to the PolicyDefinitions folder.
In the group policy management tool, click either:
- Computer Configuration to apply the organization ID to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
- User Configuration to apply the organization to HKEY_ CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
In the navigation panel, click Administrative Templates > Cisco WebEx Meetings > Cisco WebEx Meetings General Settings.
Double-click Configure Organization ID in Cisco Webex.
Click Enabled, add your organization ID in the Options box, and then click Apply.

Configure using an MSI installation

You can run the following command to install webexapp.msi with the ORGID parameter to configure the organization ID to this registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Cisco Spark Native\OrganizationID.

For example:

msiexec /i c:\work\Webex.msi ACCEPT_EULA=TRUE EMAIL=xxxx@example.com ORGID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Configure using a priority order

You can set the priority order from high to low.

You can set the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\AllowOrganizationIDInHKCU with Value as 1 and Type as DWORD32.

The organization ID is retrieved with the following sequence with high to low priority:

HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID (configured manually or through group policy template)
HKEY_CURRENT_USER\SOFTWARE\Cisco Spark Native\OrganizationID
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID (configured manually or through group policy template)
HKEY_LOCAL_MACHIN\SOFTWARE\Cisco Spark Native\OrganizationID (configured through MSI installation)

Restrict collaboration features for Mac devices

You can choose from three options to set up collaboration feature restrictions for Mac devices:

Configure using mobile device management (MDM)

We recommend following the Webex App MDM Deployment procedure to add the organization ID to the preference domain Cisco-Systems.Spark.

Restrict collaboration features for Linux devices

To set up collaboration restrictions for the Webex Suite meeting platform on Linux devices, create a .json file named managedConfig.json and add the following key to the file:

Key name	Location	File content
OrganizationID	/etc/cisco-webex/managedConfig.json	`managedConfig.json` `{` `"organization-id": "xxxxxxxx"` `}`

Key name

Location

File content

OrganizationID

/etc/cisco-webex/managedConfig.json

managedConfig.json

{

"organization-id": "xxxxxxxx"

}

Restrict collaboration features for mobile devices

To set up collaboration restrictions on Android and iOS mobile devices, we recommend following the instructions in Enable security settings for mobile versions of Webex App.

Known issues

Known issues for Webex App

When applying collaboration restrictions, it may take up to 30 minutes for new policies to be applied for meetings on the Webex Suite meeting platform.
When a user pairs with a personal mode device, cloud recording policies for the user are applied to their personal device. But when a user is paired with a shared room device, cloud recording policies are determined by the meeting policy, and not the user policy. This is applicable for meetings on the Webex Suite meeting platform.
When using the Webex Suite meeting platform, if a Windows, Mac, or iOS user isn’t allowed to join a meeting, the user is asked to switch their account. By clicking Switch Account, the Webex App restarts and the user is taken back to the sign-in page. But, for Android users, clicking Switch Account doesn’t restart the Webex App instead, it closes the application.
When using meetings on the Webex Suite meeting platform, the meeting policy for Grab Presenter only applies if the user is the host.
When launching the Webex App through Safari or Firefox, if Video or VoIP is disabled, the user can still send or receive Video and VoIP.

Known issues for Webex devices

When administrators disable Whiteboards, Closed Captioning, or Recordings, these features are blocked on devices, but the error message doesn’t show the reason for the block for Webex App meetings on the Webex Suite meeting platform.

Features are blocked based on the user policy for personal mode devices.
Features are blocked based on the meeting policy for shared mode devices.

Known issues with older client versions

We recommend that you upgrade the Webex App for the Webex Suite meeting platform to the client version WBS 43.6 or above, so users get the best experience with collaboration features. If users are on an older client version, then some collaboration features may not be available or may work incorrectly.