Enable Entra ID in Control Hub

In Webex for Government, the Entra ID (Azure AD) Wizard App connects exclusively to the Entra ID Global Identity, which covers Consumer/Enterprise and GCC Moderate Entra ID (Azure AD) Customers. GCC High Customers must utilize the Control Hub application in the Microsoft Enterprise Gallery to provision users and groups to Webex. A wizard version supporting GCC High will be available in a future Control Hub release.

Some of the features described in this article aren’t yet available to all customers.

Azure AD 同期のセットアップを示す画像。

スケジューリングを始める前に

Ensure that you have access to an Entra ID account that has the authority to grant tenant-wide admin consent to an application.
1

Sign in to Control Hub with a full administrator account.

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

[設定 ] をクリック して構成を開始します。

4

Authenticate your Entra ID admin account.

If you are not a global or privilaged-role administrator in Entra ID, you can request access to grant permission to the Entra ID (Azure AD) Wizard App.

If you have full administrator privileges in Entra ID, you can review and grant access to requests by going to Identity > Applications > Enterprise applications. Under Activity, select Admin consent requests and click on Cisco Webex Identity Integration and select Review permissions and accept. This process grants general authentication to the Webex application.

Finally, click on the All (preview) tab, select Cisco Webex Identity Integration and click Review Application. Under Security > Permissions, click on Grant admin consent for Cisco to grant all the necessary permissions to enable Entra ID in Control Hub.

See Microsoft support for more information on this process.

5

Review the permissions and click Accept to grant the account authorization to access your Entra ID tenant.

Cisco Webex Identity is an Entra ID enterprise application in Entra ID. The Wizard App connects to this application to access Entra ID graph APIs. アクセスに必要な権限は、サポートと使用に必要な最小の権限です。

利用可能な権限を示す画像。
権限 使用法
Manage apps that this app creates or owns

Required to manage the Cisco Webex Identity app in Entra ID Enterprise, including:

  • Create/delete this app in Entra ID

  • Attribute mapping configuration

  • Renaming the app in Entra ID

  • Enable/disable auto provision

Read all audit log data Used to access the Cisco Webex Identity provision audit log to read provisioning history. This information is used for the sync summary and sync report function in the Wizard App.
Read all groups/Read all group memberships Reads the list of groups from Entra ID to allow successful configuration of the groups sync scope.
Updates to group memberships can take up to 12 hours to synchronize. If a new user hasn't auto-synced when the group synchronization occurs, you will need to wait another 12 hours for the new user to sync to their group.
すべてのユーザーのフルプロファイルを読み取る Used when adding users in the sync scope. For example, this permission allows the reading of user information by searching for a user and displaying the users in the table on the user page.
6

SMB顧客の場合、[同期のデフォルト] チェックボックスに チェックを入れ、[ 続行] をクリックして既定の設定を承認 します。エンタープライズの顧客の場合、次のステップに進み、構成を続行します。

デフォルトの設定に同意する場合は、以下を行います。
  • すべてのユーザーを Webex と同期します。
  • デフォルトの属性マッピングを受け入れる。
  • トグルを有効にして、すべてのユーザーのプロファイル画像を同期し、Webex サービスで表示します。
  • 構成が完了した後で、自動同期を有効にします。
Azure AD 同期デフォルト設定オプションを示す画像
7

For Enterprise customers (more than 1000 users), or the customers who want to configure the settings manually, click the Attributes tab, and map the attributes. [保存] をクリックします。

You can map other user attributes from Entra ID to Webex, or change existing user attribute mappings using the Attributes page. マッピングは、正しく設定されていることを確実にすることで、カスタマイズできます。ユーザー名としてマップする値は重要です。Webex はユーザーのメール アドレスをユーザー名として使用します。By default, the userPrincipalName (UPN) in Entra ID maps to the email address (username) in Control Hub.

最初のセットアップ中にマッピングを編集できます。その時点で、対応するインスタンスは完全に構築され、カスタマイズされたマッピング属性のインスタンスはありません。ただし、設定が完了したら 、[ 編集] をクリックして変更できます。
8

[ユーザー] タブをクリックして、同期範囲にユーザーを 追加 します。

You can input the username to search and add the user in the synchronization scope. ​​​​​​​You can also remove a user from the sync scope by clicking the right side Recycle Bin icon. [保存] をクリックします。

If you want to select all users from Entra ID, select Select all users. これを選択した場合、このオプションがグループを同時に同期するために、範囲でグループを選択する必要はありません。

すべてのユーザーの同期を示す画像

初期化には長い時間 が必要ですが、数百、数千のユーザーを持つ大企業の顧客には [すべてのユーザーを選択する] を使用することをお勧めしません。Control Hub の多くのユーザーを誤って同期してしまった場合、これらのユーザーの削除にも時間がかかります。

[保存] をクリックします。

9

On the Groups tab, you can search for individual groups and add them to Webex.

  • Click on the Sync group members tab to select all users with in the selected groups.
  • Click on the Sync children groups tab to select users in specific child groups.
グループの追加または削除を行う画面を示す画像

[保存] をクリックします。

By default, only the users in the selected groups will synchronize. Go to the More tab and select Sync group objects if you also want to synchronize the groups themselves.
10

[詳細] タブ では、いくつかの高度な同期オプションを構成できます。

  • Sync user avatars—turn this on to allow Webex App to sync all in-scope user's avatars to Webex. ユーザーのアバターが更新される場合、Webex ではユーザーのアバターが自動的に更新されます。更新をトリガーする更新通知に依存して、直ちに更新されない場合があります。

  • Sync group objects—turn this on so that the selected group objects on the Groups tab are synchronized to Webex.

  • Activate single sign-on—turn this on to configure OpenID Connect (OIDC) SSO for your organization.

    If your organization already has SSO enabled using one of the SAML options, you must disable the SAML option first before you can activate OIDC SSO in the Entra ID (Azure AD) Wizard App.

  • Identify and sync room objects—turn this on to sync room objects to Webex.

11

即座に同期を行うのか、または後の段階で行うのを許可するか決めます。[今すぐ許可する ] オプションを 選択すると、すべての設定が今後の同期に適用されます。[保存して後で 許可する] オプションを 選択した場合、自動同期を許可するまで同期は開始されません。

設定を保存するオプションを示す画像
12

The application communicates with Entra ID to set up the configuration and schedules the synchronization.

設定が正常されたことを示す画像
After the synchronization completes, one of the following results appears in the Job status field:
  • Active: the synchronization was successful.
  • Quarantine: the synchronization job was quarantined in Entra ID after multiple failures. See the Entra ID documentation for more information.
  • NotRun: this status appears only after first setup. The service has not yet run after first setup.

You can also click View summary to see additional information such as the time and date of the last synchronization, and the number of users synced, skipped, or failed:

Users

  • Synced: shows the number of users successfully synced to Webex.
  • Skipped: shows the number of users that were skipped in the last synchronization. For example, new users in Entra ID that were not added to the Entra ID (Azure AD) Wizard App sync scope. These users were not synced to Webex; add them in the sync scope to sync them to Webex.
  • Failed: shows the number of users that failed to sync. Check the Entra ID application provision audit log for more information about why these users failed to sync. If you need to sync these users immediately, you can provision users on demand.

グループ

  • Synced: shows the number of groups successfully synced to Webex and created in Control Hub.
  • To Be Synced: this status indicates that all of the users in a group have not yet been added. The users must first be successfully synced to Webex.

Migrate existing Cisco Webex Enterprise App configurations to Entra ID (Azure AD) Wizard App

If you already have set up a Cisco Webex Enterprise App in Entra ID, you can migrate all of your configurations over to the Entra ID (Azure AD) Wizard App automatically. You can manage Entra ID all in Control Hub without losing any of your previous configurations.

1

Sign in to Control Hub with a full administrator account.

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

[設定 ] をクリック して構成を開始します。

4

Authenticate the Entra ID admin account with the Entra ID configuration. 次の手順で説明される権限を持つアカウントを使用することを確認してください。

5

Review the permissions and click Accept to grant the account authorization to access your Entra ID tenant.

Cisco Webex Identity Synchronization is an Entra ID enterprise application in Entra ID. The Wizard App connects to this application to access Entra ID graph APIs. アクセスに必要な権限は、サポートと使用に必要な最小の権限です。

利用可能な権限を示す画像。
権限 使用法
Manage apps that this app creates or owns

Required to manage the Cisco Webex Identity app in Entra ID Enterprise, including:

  • Create/delete this app in Entra ID

  • Attribute mapping configuration

  • Renaming the app in Entra ID

  • Enable/disable auto provision

Read all audit log data Used to access the Cisco Webex Identity provision audit log to read provisioning history. This information is used for the sync summary and sync report function in the Wizard App.
Read all groups/Read all group memberships Reads the list of groups from Entra ID to allow successful configuration of the groups sync scope.
すべてのユーザーのフルプロファイルを読み取る Used when adding users in the sync scope. For example, this permission allows the reading of user information by searching for a user and displaying the users in the table on the user page.
6

Select Migrate existing app.

7

After accepting additional read-only permission requests, select the existing app that you want to migrate over to the Wizard App, and then select Proceed.

If the selected existing app doesn't provision users to the same Control Hub, the migration will fail.

8

After the migration completes, we recommend that you perform a dry run before enabling auto-sync to make sure there aren't any errors.

Perform a dry run

Before enabling auto-sync, we recommend that you perform a dry run first to make sure that there aren't any errors. Once the dry run completes, you can download a dry-run report to see detailed information. The available columns in the report are:

表 1. Dry-run report column descriptions
列名説明
Object TypeType of object in Entra ID, such as user or group.
Action TypeType of action that will be performed to the object during a synchronization. Possible action types are:
  • Matched—Object matches in Entra ID and Control Hub.
  • Add—Object will be added to Control Hub.
  • Deactivate—Object is in Control Hub, but the object has been removed in Entra ID or wasn't added to the sync scope. After synchronization, the object will be deactivated.
Azure IDID of the object in Entra ID.
Azure NameName of the object in Entra ID.
Webex NameName of the object in Webex.
理由Reason for why an action type will occur during a synchronization.
1

Sign in to Control Hub with a full administrator account.

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

Click on the three vertical dots next to the instance you want to sync, and then select Dry-run.

4

Once the dry run completes, click on Download summary to download the report as a CSV file.

自動同期を有効または無効にする

The Entra ID (Azure AD) Wizard App and its corresponding backend service checks if auto-sync is enabled to determine when to sync users or groups from Entra ID to Webex. Enable Auto Syncto allow the auto provision user and group synchronization. When you disable Auto Sync the Wizard App doesn't sync anything to Webex, but the existing configuration is preserved.

Typically, users are synced every 40 minutes per Microsoft policy.

1

フル組織管理者として Control Hub にログインします。

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

トグルを右に切り替えて自動同期を 有効にします。

自動同期トグルを左に切 り替 えて無効にします。

Edit the Entra ID (Azure AD) Wizard App configuration

1

Sign in to Control Hub with a full administrator account.

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

Click Edit configuration.

Azure AD インスタンスを削除するオプションを示す画像
4

Customize the attribute mapping by selecting an attribute from the left column that originates from Entra ID. Webex Cloud の接続先属性は右の列です。See Entra ID (Azure AD) Wizard App attributes mapping for more information about mapping attributes.

カスタム属性を示す画像
5

[ユーザーおよび グループ ] タブ で、同期範囲からユーザーおよびグループを追加または削除します。

Nested groups don't automatically synchronize to the cloud. Make sure to select any groups that are nested within the groups you want to synchronize.
6

[詳細] タブ で必要に応じて基本設定を変更します。

7

[保存 ] を クリックして、変更した構成を保存します。

更新は次の同期に適用されます。The Entra ID automatic sync mechanism handles the synchronization of users and user's groups.

Edit the Webex instance name

Change how the Cisco Webex Identity instance name appears in the Entra ID enterprise application list.

1

Sign in to Control Hub with a full administrator account.

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

Click Edit instance name.

Azure AD インスタンスを削除するオプションを示す画像
4

Enter the new instance name and then click Save.

Delete the Entra ID (Azure AD) Wizard App configuration

When you delete the Entra ID (Azure AD) Wizard App, it removes the configuration for Entra ID synchronization. The configuration is not retained by Webex or Entra ID. If you want to use Entra ID synchronization in the future, you'll need to do a full reconfiguration.

Don't delete the Cisco Webex application from within Entra ID.

1

Sign in to Control Hub with a full administrator account.

2

[組織の 設定] に 移動して、[ディレクトリ同期] セクションまで スクロール ダウンします。

3

Click Delete instance.

Azure AD インスタンスを削除するオプションを示す画像
4

Webex から 同意書を削除する場合は、[Azure AD インスタンスの削除? ] ページで、[Azure AD 管理者の同意を取り消す] を選択します。このオプションを選択した場合は、資格情報を入力して再度権限を付与する必要があります。

Azure AD インスタンスを削除する [削除] ウィンドウを示す画像
5

[削除] をクリックします。

Provision a user to Webex on-demand

You can provision a user to Webex immediately, independently of an Entra ID synchronization, and instantly check the result. これは、セットアップ中の問題をトラブルシューティングする場合に役立ちます。

1

Sign in to Control Hub with a full administrator account.

2

Go to Organization Settings and scroll down to the Directory Synchronization section.

3

Click Provision a user on demand.

Azure AD インスタンスを削除するオプションを示す画像
4

Search for and select the user you want to provision, and click Provision.

5

One of following results appear when it completes:

  • Provisioning success: The new user was successfully created in Webex.
  • Provisioning skipped: The provisioning was skipped for some reason, generally because the user already exists. The details appear on the Results summary page.
  • Provisioning failed: The provisioning failed. The details appear on the Results summary page.
6

Click Re-try to provision the same user again, if it skipped or failed.

7

Click Provision another user to return to the provisioning page.

8

Click Done when you are finished.

Import Entra ID verified domains to Control Hub

The customers may have hundreds of domains verified in Entra ID. While they integrate with Control hub, if they want to import the verified domains from Entra ID to Control Hub. これにより、保守またはセットアップの処理に費やされる多くの労力を節約できます。

1

コントロール ハブの [組織 設定] タブの [ ドメイン 秒] に移動します。

2

Click Add with Entra ID.

3

[検証 済みドメインの追加] ページ で、追加するドメインを検索して選択します。

4

[追加] をクリックします。

The verfied domains will appear in the verified domain list.

Entra ID (Azure AD) Wizard App attributes mapping

The Entra ID (Azure AD) Wizard App can support and synchronize any changes you make to your attribute expressions. For example, in Entra ID, you can map the displayName so that it displays both the surname and givenName attributes. These changes appear in the Wizard App.

You can find more information on mapping attribute expressions in Entra ID on the Microsoft help site.

Use the following table for information on specific Entra ID attributes.

Entra ID doesn't synchronize null values. If you set an attribute value to null in Entra ID, it isn't deleted or patched with a null value in Webex. See the limitations on the Microsoft help site for more information.

表 2. Azure から Webex へのマッピング

Entra ID Attribute (source)

Webex ユーザー属性 (ターゲット)

説明

userPrincipalName

userName

 It’s the unique ID of the user in Webex. 形式されたメールです。

displayName

displayName

 Webex アプリケーション上に表示されるユーザー名です。

surname

name.familyName

givenName

name.givenName

objectId

externalId

 It is the user's UID in Entra ID. 通常、16 バイトの文字列です。このマッピングの変更はお勧めしません。

jobTitle

title

usageLocation

addresses[type eq "work"].country

 使用率割り当てマッピングを使用して、アドレス [type eq "work"].country を使用することをお勧めします。別の属性を選択する場合は、属性値が標準に準拠している必要があります。例えば、米国は米国である必要があります。中国は CN 以下である必要があります。

city

addresses[type eq "work"].locality

streetAddress

addresses[type eq "work"].streetAddress

state

addresses[type eq "work"].region

postalCode

addresses[type eq "work"].postalCode

telephoneNumber

phoneNumbers[type eq "work"].value

mobile

phoneNumbers[type eq "mobile"].value

facsimileTelephoneNumber

phoneNumbers[type eq "fax"].value

manager

manager

Syncs manager information of users to Webex so that users can always see the correct manager information on a user's contact card.

When a user is created, Entra ID checks if the user's manager object is in Webex Identity or not. If no, the user's manager attribute is ignored. If there is a manager attribute, two conditions must be met for the attribute to show on the user's contact card:

  • The manager object is synced to Webex.
  • The member user is active in Webex App. Technically, it can trigger the backend event to query the user's manager attribute periodically. Therefore, when the user's manager information is added or changed, the user's manager attribute could update through the triggered service.

These conditions check the update to the user's manager attribute when a user's authentication token is expired.

Manager attribute changes won't be reflected on the user's contact card until after the user signs in for the first time after the change.

FAQ

How can I migrate to Entra ID (Azure AD) Wizard App from Cisco Directory Connector provision?

During setup, the Wizard App detects whether your organization uses Directory Connector. If it is enabled, a dialog box where you can choose to use Entra ID and block Directory Connector. Click Block to confirm that you want to continue the Entra ID (Azure AD) Wizard App configuration.

You can also choose to disable Directory Connector before configuring the Wizard App. After configuration, the Wizard App manages user profiles. However, the Wizard App only manages the users who were added to the synchronization scope; you cannot use the Wizard App to manage users synced by Directory Connector that were not part of the synchronization scope.

Can I configure single sign-on with Microsoft Entra?

You can configure a single sign-on (SSO) integration between a Control Hub customer organization and a deployment that uses Microsoft Entra ID as an identity provider.

When does the user avatar update in Webex?

The user avatars are synced to Webex when the user is created in Webex Identity. This update relies on the user's avatar being updated in Entra ID. The Wizard App then retrieves the new avatar from Entra ID.