To make your organization more secure, you can block internal users from joining meetings outside of your organization, and block external users from joining meetings within your organization. You can also disable certain in-meeting features, such as chat, file transfers, screen shares, annotations, Q&A, polling, notes, and remote control.
Overview
You can restrict all users from joining meetings outside your organization, or restrict access to certain in-meeting features to make sure that users follow your organization's policies. When users try to use a disabled feature, an indicator appears to let them know about the restriction set by the organization.
Collaboration restrictions only support Webex Meetings and Webex Webinars. These restrictions don't apply to Webex Events (classic), Webex Training, and Webex Support. |
These settings apply only to users who are on the Webex Meetings client version 42.3 or higher and Webex App client version 43.6 or higher.
Users can bypass these restrictions by joining internal and external meetings with their personal email addresses, or as guests. To avoid users bypassing these restrictions, follow the steps in Restrict Collaboration Features for Windows, Mac, Android, and iOS devices to add a token to company devices to make sure that accounts used with the devices follow the restrictions set by your organization.
When applying collaboration restrictions, if the user logs in with a different organization ID from the registry, Control Hub follows the most restrictive policy. Both, the user policy and the organization policy are checked. But if the user logs in with the same organization ID in the registry, then Control Hub follows the logged in user’s policy.
Collaboration restrictions at a group or user level
If you want to set up policies for specific groups or on a per user basis instead of the whole organization, you can do so by creating meetings settings templates.
Allow or block external users from joining meetings in your organization
You can allow or block users outside of your organization from joining meetings hosted by users in your organization.
1 |
Sign in to Control Hub, and go to . |
2 |
Click Settings. |
3 |
Under Meetings, select one of the following next to Internal:
|
4 |
If you selected Allow external users with approved email domains, enter an approved email domain and click Add. You can also toggle Apply these settings to Personal Room Meetings only on, to apply the internal meeting policy. |
Block users from joining external meetings in Control Hub
When you block users from joining external meetings, they can't join meetings that are hosted from Webex sites outside of your organization. But you can allow users to join meetings on certain Webex sites, by adding those Webex sites to an approved list setting.
New behavior changes
Previously, you could allow users to join external meetings and any collaboration features that you restricted would still work. For example, if you restricted chat during meetings, users could still use the chat panel in external meetings that were in the approved list.
This behavior has now changed with a recent update. The approved list is now a list of sites that users can join external meetings in with the collaboration restrictions that you set. For example, if you restricted chat, then users won't be able to use the chat panel in external meetings.
1 |
Sign in to Control Hub, and go to . |
2 |
Click Settings. |
3 |
Under Meetings, select one of the following next to External:
|
4 |
If you selected Allow approved external sites, enter a Webex sitename and click Add. |
What to do next
Restrict collaboration features in Webex Meetings
These settings apply to users joining internal and external meetings. If you want to restrict your in-meeting features, then you can create and use a custom session type or a meeting settings template.
Session types support only internal meeting policies. Session types are applicable only when the user is the meeting host.
Meeting settings templates support internal and external meeting policies. Meeting settings templates are applicable when the user is the meeting host or participant.
1 |
Sign in to Control Hub, and go to . | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
2 |
Click Settings. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3 |
Toggle the features you want to enable or disable for users during internal or external meetings: Breakout sessions
Collaboration tools
In meeting
Recording
Remote control
Sharing
Telephony
Video
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
4 |
In the Internal Webex Meetings section, toggle on
Override participant settings when hosting to allow participants to
share the same meeting policy as the host.
Administrators can enable meeting settings override and use existing settings templates to enforce meeting policies for specific hosts. This means that when the host initiates a meeting, all participants follow the host's policy rather than their own. |
Restrict collaboration features for Windows, Mac, Linux, Android, and iOS devices
If you want to restrict these collaboration settings devices in your organization, you can edit the system files so that those settings apply to anyone who uses the device to join a meeting outside your organization.
To do this, you have to first find and copy your organization ID in Control Hub. After getting the organization ID, follow the steps that apply to the devices that you want to edit.
Make sure to lock the organization ID in the registry so users can't change it themselves. If users change the organization ID, then the collaboration restrictions won't apply to their devices. |
1 |
Sign in to Control Hub, and go to . |
2 |
Click the Copy icon in the Organization ID field. |
What to do next
You can choose from three options to set up collaboration feature restrictions for Windows devices:
-
Configure manually using a registry value—You can manually edit specific devices by adding the organization ID to the registry:
-
Open the registry and browse to the context where you want to apply this policy. One of:
-
HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\
-
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\
-
- Create a new string value called
OrganizationID
. - Right-click the new value and then Modify...
- Paste the organization ID in the Value data of the new string.
-
-
Configure using a Group Policy template—You can import a Group Policy administrative template (.adm) to apply the organization ID to the same registry values as above.
-
Configure using an MSI Installation—You can run a command to install webexapp.msi using the organization ID to edit this registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Webex\Policies\OrganizationID
.
Configure using registry keys
-
Open the Registry Editor.
-
Add the organization ID to one of the following registry values:
-
HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
Configure using a Group Policy template
-
Import an
.adm
file. -
In a group policy management tool, click either:
-
Computer Configuration to apply the organization ID to
HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
User Configuration to apply the organization to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
-
In the navigation panel, click
. -
Double-click Configure Organization ID in Cisco Webex.
-
Click Enabled, add your organization ID in the Options box, and then click Apply.
Configure using an MSI installation
-
Run the following command to install
webexapp.msi
with theORGANIZATIONID
parameter to configureHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Webex\Policies\OrganizationID
:msiexec /i webexapp.msi /log webexapp.log ORGANIZATIONID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
To set up collaboration restrictions on Mac devices, create a .plist
file named com.cisco.webexmeetings.config.plist
under /Library/Preferences/
, and add the following key to the file:
Key name |
Value |
Description |
---|---|---|
OrganizationID |
%OrganizationID% |
Specify the organization ID that you copied from Control Hub for the collaboration restrictions. |
To set up collaboration restrictions on Android and iOS mobile devices, you have to configure the organization ID using the Mobile Device Management AppConfig service.
This feature works only for mobile devices that use the Webex Meetings app on version 41.7 and later. |
Configuration key |
Value type |
Description |
---|---|---|
OrganizationID |
String |
Specify the organization ID that you copied from Control Hub for the collaboration restrictions. |
To have your organization's policies apply to users who join from Google Chrome, you must add the Webex Meetings Policy plugin downloaded from the Chrome Web Store and then add a rule for your organization to the policy.
Users who are restricted from joining certain meetings will see the following message when they try to join a restricted meeting through Google Chrome.

1 |
Open Google Chrome's IT admin page at https://admin.google.com |
2 |
Add the Webex Meetings Policy plugin extension by going to .![]() |
3 |
Add the following extension by ID: ![]() |
4 |
Add the following rule to the policy:
![]() |
5 |
Right-click the tab and select Force install. ![]() |
Known issues
Known issues for Webex Assistant for Meetings
If a meeting has Closed Captioning and Webex Assistant enabled, users with those two features disabled can't turn both of them off during the meeting if they're given the host role.
Known issues for Webex devices
- Users on Mac devices can grab the presenter role from users on Webex devices even if the Take presenter feature have been disabled.
- Users with the Annotation feature disabled will still see annotations when they use Webex devices to join meetings.
Known issues with older client versions
We recommend that you upgrade the Webex Meetings client to the last version (WBS 42.7 or above) or at least to the latest lockdown version (WBS42.6) so users get the best experience with collaboration features. If users are on an older client version (such as WBS 42.3 or lower), some collaboration features may not be available or may work incorrectly.
Known issues with restricting Annotation and File and whiteboarding sharing features
When Annotation is restricted, but File and whiteboarding sharing isn't, users can still see annotations if the presenter shares a whiteboard and starts annotating.
Restrict collaboration features for Windows, Mac, Linux, Android, and iOS devices
If you want to restrict these collaboration settings devices in your organization, you can edit the system files so that those settings apply to anyone who uses the device to join a meeting outside your organization.
To do this, you have to first find and copy your organization ID in Control Hub. After getting the organization ID, follow the steps to the devices you want to edit.
Make sure to lock the organization ID in the registry so users can't change it themselves. If users change the organization ID, then the collaboration restrictions won't apply to their devices. |
1 |
Sign in to Control Hub, and go to . |
2 |
Click the Copy icon in the Organization ID field. |
What to do next
This is applicable only for meetings on the Webex Suite meeting platform. |
You can choose from these options to set up collaboration feature restrictions for Windows devices:
Configure using registry keys
You can manually edit specific devices by adding the organization ID to one of these registry values:
-
Open the Registry Editor.
-
Add the organization ID to one of the following registry values:
-
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
HKEY_LOCAL_MACHINE\SOFTWARE\Cisco Spark Native\OrganizationID
-
For meetings on the Webex Suite meeting platform, you can set the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\AllowOrganizationIDInHKCU
with Value as 1
and Type as DWORD32
, and apply the
organization ID to one of these registry values:
-
HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
HKEY_ CURRENT_USER\SOFTWARE\Cisco Spark Native\OrganizationID
Configure using a Group Policy template
You can import a Group Policy administrative template .adm
or
.admx
file to apply the organization ID to the same registry values as
above.
Import an .adm
file:
- Download the group policy administrative template and add it to the group policy management tool.
-
In the group policy management tool, click either:
-
Computer Configuration to apply the organization ID to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
User Configuration to apply the organization to
HKEY_ CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
-
In the navigation panel, click
. -
Double-click Configure Organization ID in Cisco Webex.
-
Click Enabled, add your organization ID in the Options box, and then click Apply.
Import an .admx
file:
- Download the group policy administrative template and add it to the PolicyDefinitions folder.
-
In the group policy management tool, click either:
-
Computer Configuration to apply the organization ID to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
User Configuration to apply the organization to
HKEY_ CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
-
-
In the navigation panel, click
. -
Double-click Configure Organization ID in Cisco Webex.
-
Click Enabled, add your organization ID in the Options box, and then click Apply.
Configure using an MSI installation
You can run the following command to install webexapp.msi
with the
ORGID
parameter to configure the organization ID to this registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\Cisco Spark Native\OrganizationID
.
For example:
msiexec /i c:\work\Webex.msi ACCEPT_EULA=TRUE EMAIL=xxxx@example.com ORGID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Configure using a priority order
You can set the priority order from high to low.
You can set the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\AllowOrganizationIDInHKCU
with Value as 1
and Type as DWORD32
.
The organization ID is retrieved with the following sequence with high to low priority:
-
HKEY_CURRENT_USER\SOFTWARE\Policies\CiscoWebex\OrganizationID
(configured manually or through group policy template) -
HKEY_CURRENT_USER\SOFTWARE\Cisco Spark Native\OrganizationID
-
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\CiscoWebex\OrganizationID
(configured manually or through group policy template) -
HKEY_LOCAL_MACHIN\SOFTWARE\Cisco Spark Native\OrganizationID
(configured through MSI installation)
You can choose from three options to set up collaboration feature restrictions for Mac devices:
Configure using mobile device management (MDM)
We recommend following the Webex App MDM Deployment procedure to add the
organization ID to the preference domain Cisco-Systems.Spark
.
To set up collaboration restrictions for the Webex Suite meeting platform on Linux devices, create a .json
file named
managedConfig.json
and add the following key to the file:
Key name |
Location |
File content |
---|---|---|
OrganizationID |
/etc/cisco-webex/managedConfig.json |
|
To set up collaboration restrictions on Android and iOS mobile devices, we recommend following the instructions in Enable security settings for mobile versions of Webex App.
Known issues
Known issues for Webex App
- When applying collaboration restrictions, it may take up to 30 minutes for new policies to be applied for meetings on the Webex Suite meeting platform.
- When a user pairs with a personal mode device, cloud recording policies for the user are applied to their personal device. But when a user is paired with a shared room device, cloud recording policies are determined by the meeting policy, and not the user policy. This is applicable for meetings on the Webex Suite meeting platform.
- When using the Webex Suite meeting platform, if a Windows, Mac, or iOS user isn’t allowed to join a meeting, the user is asked to switch their account. By clicking Switch Account, the Webex App restarts and the user is taken back to the sign-in page. But, for Android users, clicking Switch Account doesn’t restart the Webex App instead, it closes the application.
- When using meetings on the Webex Suite meeting platform, the meeting policy for Grab Presenter only applies if the user is the host.
- When launching the Webex App through Safari or Firefox, if Video or VoIP is disabled, the user can still send or receive Video and VoIP.
Known issues for Webex devices
When administrators disable Whiteboards, Closed Captioning, or Recordings, these features are blocked on devices, but the error message doesn’t show the reason for the block for Webex App meetings on the Webex Suite meeting platform.
- Features are blocked based on the user policy for personal mode devices.
- Features are blocked based on the meeting policy for shared mode devices.
Known issues with older client versions
We recommend that you upgrade the Webex App for the Webex Suite meeting platform to the client version WBS 43.6 or above, so users get the best experience with collaboration features. If users are on an older client version, then some collaboration features may not be available or may work incorrectly.