Managing roles in Control Hub

We recommend that you share administrative responsibilities within your organization. Even in small organizations, we recommend having more than one person holding the full administrator role, to ensure availability.

As a full administrator, you can assign various administrative roles to people in your organization, to streamline responsibilities and share accountability for managing the organization.

For example, a compliance officer can access user-generated content as necessary for legal/compliance purposes. This is likely to be a different person than a support administrator, who can access analytics and troubleshooting information.

This article describes how to manage administrative roles and lists the privileges associated with each role.

If you're managing multiple Webex organizations for your customers, see administrator roles in Partner Hub.

1

Sign in to Control Hub, go to Users, and choose a user.

If you're a partner, open the customer organization where you want to assign roles, and then access that organization's Users page.
2

In the Summary tab, go to Administrator roles.

There's a comma-separated list of the user's administrative roles, or None if they don't have any.
3

Select roles for the user.

For meetings site administrator roles, click Edit next to Webex Site administrator roles. Select roles for each Webex site that you want the user to manage.


 

If you change the Organizational role of a user who has an existing Services role, you could affect their existing services roles. Review the user's services roles if you change their organizational role.


 
The location administrator role is exclusive from other types of admin roles. You can't assign a location administrator role to a user who is already assigned other admin roles. To assign locations to the user, check Location admin and add the locations.

 
If a user is assigned the user and device administrator or the device administrator role, they can't administer Webex Calling.
4

Click Save.

Want to see how it's done? Watch this video demonstration on how to assign organization account roles in Control Hub.

If you want to see who has a particular role, or roles:

1

Sign in to https://admin.webex.com, and open the Users page.

2

Use the Filter control to select which roles you'd like to find.

This action updates the user list, to show only those users who have the selected roles.

You can export a full or filtered list of administrators in your organization as a CSV file to bulk manage them. The following table shows you the data that the CSV file exports.

Column Name

Description

First / Last name

The names (First<space>Last) of the exported administrators.

User ID/Email

The unique IDs (email addresses) of the exported users.

Admin Role

Comma separated lists of administrative roles held by the exported users.

1

Sign in to https://admin.webex.com, and open the Users page.

2

Filter the user list by the roles you want to see.

3

Click the Export button at the top-right.

The CSV file automatically downloads once it's ready.

 

If you are exporting a filtered list, wait until the CSV file is downloaded before you change the filter. Otherwise you get the updated filtered list in the current CSV file download.

Role types

Each role determines the privilege level you have in Control Hub. If you have full administrator privileges, you can assign one or more roles to any user in your organization.

When your account is first set up, the administrator from the partner organization becomes the full administrator for your organization, and can set up additional administrators.

Users that you add to your organization have no administrative privileges at first. Here's a list of the responsibilities you can assign:


 

The Webex Calling Detailed Call History API access role allows the user to have access to the REST API that collects data for Webex Calling Detailed Call History reports. See the Webex Calling Detailed Call History API documentation for details.


 

This table only lists organization-wide administrative roles. For more information on service-specific administrator roles, such as Webex site administrator and Webex Contact Center administrator, you can read about them in the sections below.

Access

Full administrator

Read-only administrator

Support administrator

User and device administrator

Device administrator

Compliance officers

Advanced troubleshooting access

Add/Delete users and assign licenses

Read-only

Assign roles to users

Read-only

Device management

Read-only

Company policy and templates

Read-only

Analytics and reports

Read-only

Troubleshooting

Read-only

Licenses and upgrades

Read-only

Organization settings

Read-only

App integrations

Read-only

Webex site management

Read-only

Admin actions audit log

Access to user-generated content

Legal hold

Access to join in-progress meetings

Access to live meetings

Product email notifications

View organization support cases

This role allows full administrators, read-only administrators, and support administrators to access the Live Meeting page in the Troubleshooting tab, and lets full administrators join meetings that are in progress with just the click of a button. If participants are having issues during meetings, administrators with this role can quickly find those meetings to join and help sort out the issues.

For more information about the Live Meeting page and the Admin Join feature, see Advanced Diagnostics and Troubleshooting in Control Hub.


 

Full administrators can assign the Advanced Troubleshooting Access role to another full administrator, read-only administrator, or support administrator within their organization. Full administrators can’t assign the Advanced Troubleshooting Access role to themselves. Another full administrator must assign the role to them.


 

You can only assign Webex site administrator roles to users in Control Hub-managed meeting sites. These roles can't be assigned in Control Hub to manage Site Administration-managed meeting sites.

Webex site administrators only have access to the users and settings for the Webex site that they're assigned to in Control Hub. You can assign a user as an administrator for more than one Webex site. Users that are assigned with the site administrator role must sign in to Control Hub once after being assigned the role before they can get admin access to the meeting sites.

If your organization has a lot of Webex sites to manage, assign users as Webex site, Webex user, or Webex read-only administrators to define ownership and to split up administrative responsibilities for each Webex site.

Webex site administrators and Webex user administrators can only manage Webex Meetings-related settings for users in customer organizations to which they're assigned.


 

Webex site administrators don't use a Webex Meetings license for the Webex site that they're assigned to, but they won't have any host privileges. If you want a Webex site administrator to have hosting privileges, assign a host license to them.

Meeting Content Administrator role

If you want to allow Webex site administrators to also access, retrieve, and manage meeting artifacts, such as recordings and transcriptions, through APIs or a web interface, you can toggle a switch to assign them as a Meeting Content admin. This role allows you to assign users with granular access to specific Webex sites instead of allowing them access to all sites.

To assign the Meeting Content admin role to a user:

  1. Sign in to Control Hub, go to Users, and choose a user.
  2. In the user's Profile tab, find Administrator roles.
  3. In the Services section, click Edit next to Webex site administrator roles.
  4. Toggle the Assign Meeting content admin for all eligible sites on.

     
    The user must be assigned one of the Webex site administrator roles for a site in order to have access to the Meeting Content admin role.
  5. Click Done.
  6. Click Save.
AccessWebex Site AdminWebex User AdminWebex Read-only AdminMeeting Content Admin

User Management

(User Settings. Can't add or delete users to Control Hub org.)

(User Settings. Can't add or delete users to Control Hub org.)

Read-only

(User Settings. Can't add or delete users to Control Hub org.)

Analytics and Reports

Read-only

Read-only

Read-only

Read-only

Licenses*

Read-only

Assign Roles*

Read-only

Read-only

Site Configuration*

Read-only

Read-only

Recordings and transcripts*


 

* For their assigned Webex sites only.

Webex Contact Center provides a dedicated Contact Center Service Administrator role that allows users to administer and manage the contact center service and licenses. This role can be assigned to external administrators, and users within the customer organization. For more information about Contact Center administrator roles, see this article.

The following table describes the contact center-specific privileges of all Control Hub administrator roles:

Customer Organization

External Organization

Partner Organization

Any Other Organization

Full Administrator

  • Can administer all features of contact center.

  • Can perform all user management activities for contact center such as:

    • Add or remove users in the customer organization.

    • Assign, edit, or remove contact center licenses from users.

    • Add or revoke the Contact Center Service Administrator role from external administrators.

Can perform all administrative activities similar to full administrators from a customer organization, with the following exception:

  • The administrator cannot add or revoke the Contact Center Service Administrator role from other external administrators.

Contact Center Service Administrator

NA

Can perform all administrative activities similar to full administrators from a customer organization, with the following exception:

  • The administrator cannot add or revoke the Contact Center Service Administrator role from other external administrators.

Provisioning Administrator

NA

  • Can perform all contact center administrative activities that a partner full administrator can perform.

  • Cannot perform any user management activities, and can only view the list of other external administrators in the organization.

NA

Read-only Administrator

Cannot access the Webex Contact Center administrative interfaces (Control Hub and Management Portal).

Can access the Webex Contact Center administrative interfaces (Control Hub and Management Portal) in read-only mode only.

The Webex Events administrator role has access to Webex Events (formerly Socio) and can grant access to others.

When the user with this role signs in to Control Hub, they can:

  • See the Services > Events page.
  • On that page, click the Launch Webex Events portal button to open Socio.

    (Administrators who do not have this specific role see an inactive button)

You can add anyone outside of your organization as an external administrator. Administrators from a partner organization are also considered external administrators in your organization. You can also manage external administrator privileges, and define them as external full administrators, external read-only administrators, and provisioning administrators. Provisioning administrators are added when a partner provisions your Webex services orders.


 

Anyone outside your organization that has access your organization’s Control Hub is shown in the Users section under the External Administrators tab.

Support staff that access your organization will generally have the role of read-only administrator. Read-only administrator access is automatically revoked after some time. You can grant or deny administrative access to anyone.

Assigning external administrators for "break glass" scenarios

You can assign external administrators as a way to access your organization in case of emergency sign-in issues, such as if SSO isn't working properly for a SSO-configured organization.

Access to Webex Meetings sites

The external admin must sign in to Control Hub once after being assigned the external full administrator role before they can get admin access to meeting sites.

Removing partner external administrators as a customer

You can remove external administrators from your organization at any time. But as long as an active selling relationship exists between your organization and the partner that you purchased services from, then that partner can regain access to your organization by assigning themselves the role of Provisioning Administrator, which means that the partner will always have access to your organization. The partner can’t assign themselves access as Full Administrator. If you don’t want for the partner you purchased services from to have access to your organization at all, then you must contact the partner.

AccessExternal full administratorExternal read-only administratorProvisional administrator
User ManagementRead-onlyX
Device ManagementRead-onlyX
Company Policy and TemplatesRead-onlyX
TroubleshootingRead-onlyX
Support Metrics and NotificationsRead-onlyX
Licenses and UpgradesRead-only

For the services the partner sold.

Assign rolesRead-onlyX
Provision ordersX

For the services the partner sold.

Add and delete sites

For the sites belonging to the subscription which the partner sold.

X

For the services the partner sold.

Add external administratorsXXX
LocationsRead-only

 

External administrators can't add additional external administrators to your organization.

Assign external administrators as full, read-only, or provisioning administrators in order to clearly define what their responsibilities are in your organization. Dividing administrative responsibilities can also ensure greater accountability within your organization.

You can add anyone outside your organization as an external administrator to help maintain your Webex services and users. External administrators can't add additional external administrators to your organization.


 

Users in free self-sign up organizations can be added as external administrators. But, users that are part of the consumer organization can't be added as an external administrator. Control Hub will indicate an error when you try to verify the emails of users who are in the consumer organization.

1

Sign in to Control Hub at https://admin.webex.com, and open the Users page.

2

Filter the user list by All external administrators to see the list of external admins.

3

Click Add external administrator.

4

Enter the administrator's email address and click Verify email.

5

If this user belongs to a partner organization that manages your subscription, choose Full administrator privileges or Provisioning administrator privileges. If they are from any other organization, choose:

  • Full administrator
  • Read-only administrator
  • Contact Center service administrator (if applicable)
  • Webex site administrator (if applicable). You can then choose to assign users as full, read-only, or user administrators for each Webex site.
6

Click OK.

You can choose what information is shared or withheld from external administrators.

As a full administrator of your organization, you can also adjust the administrator privileges for external administrators.

1

Sign in to Control Hub, then open the Users page.

2

Filter the user list by All external administrators to see the list of external admins.

3

Select the user you want to edit.

4

Choose one of the following:

  • To promote the administrator to a full administrator, under Administrator roles, check Full administrator privilege.

    If the administrator was set up with read-only privileges, you can promote them by going under Administrator roles and choosing Full administrator privilege.

  • To demote the administrator to a provisioning administrator, under Administrator roles, uncheck the Full administrator privilege check box.

    If the administrator was set up with read-only privileges and previously promoted to a full administrator, you can demote them by going under Administrator roles and choosing Read-only administrator privilege.

  • To completely revoke administrator privileges, under Revoke admin privilege, click Revoke admin privilege and then select Revoke privilege.


     

    Revoking administrator privileges deletes all record of the administrator, and they must be added again to reinstate them.