00 · Header

T1 · Control Hub & Platform Foundations

Control Hub Foundations

The organization is the boundary. Control Hub is the console where users, roles, locations, services, and devices are made real. Every later room assumes this map.

Expand all sections

01 · Executive summary

Five lines, then why it matters

• Control Hub is the single dashboard Cisco documents for managing users, permissions, calling, meetings, messaging, and devices. [cite:1]
• The first sign-in can start a setup wizard; accepting terms creates the organization, and the activation email address is the sign-in identity used to set the administrator password. [cite:1]
• People you add start with no administrative privileges. A full administrator assigns prebuilt roles, and can also assign roles to groups. [cite:2]
• Locations organize users and workspaces by a physical address and are also where calling is anchored. [cite:3] [cite:4]
• Service settings live under Services; organization-wide branding, support redirection, and single sign-on are organization settings. [cite:1] [cite:5]

02 · Architecture map

What sits inside one organization

• 1Overview of active services
• 2Users, licenses, roles
• 3Locations as the place anchor
• 4Per-service settings
• 5Devices and workspaces
• 6Organization settings

flowchart TB
  subgraph org [Customer organization]
    OV[1 Overview]
    US[2 Users and roles]
    LO[3 Locations]
    SV[4 Services]
    DV[5 Devices]
    ST[6 Organization settings]
  end
  PH[Partner Hub]
  CI[Common Identity]
  PH -. manages many orgs .-> org
  CI --> US

Studio asset still required: assets/diagrams/T1-R01/arch.svg

03 · Concept deep-dive

The admin mental model

Cisco’s own overview calls Control Hub the central interface to manage the organization, users, services, and usage analytics, and says the first screen is an overview of services that are active or available. [cite:5] Treat that sentence as the product boundary: if a task is “change how Webex works for this customer,” the documented front door is this console, signed in at https://admin.webex.com when you are deleting or managing calling locations. [cite:4]

Objects you can point at

Prebuilt organization roles worth memorizing

The role article lists why you assign each prebuilt role. This table is a study compression of that article, not a second source. Privileges that are easy to over-claim in an interview are called out in the notes column.

Navigation you can defend in a design review

04 · Ecosystem

Ecosystem and sister technologies

Control Hub is the console. The sisters around it are identity, sign-in, licensing, and analytics. This section names those neighbors before the flow section trusts a click-path. Peer-vendor names are orientation labels, not feature parity. The hub ecosystem map is the cross-track picture; it does not replace this section.

Glossary

Control Hub

The central interface Cisco documents for the organization, users, services, and usage analytics. Calling location tasks sign in at https://admin.webex.com. [cite:5] [cite:4]

Webex identity

The identity service the SSO guides configure. An IdP assertion has to land on a user Webex already knows. The SSO article’s contents name “Configure Webex Identity Service.” [cite:10]

uid

The SAML claim org SSO maps. You may map userPrincipalName, an email alias, or another attribute to uid, and the IdP must match one of the user’s email addresses to that uid at sign-in. [cite:10]

Partner SSO

Service-provider SSO for customer orgs that partner manages. The IdP claim includes the mail attribute rather than uid. [cite:10]

Directory Connector

The on-premises connector you download from Control Hub to provision Active Directory users into the org. It has a Windows and Active Directory requirements section. [cite:9]

SCIM

A REST API that keeps the user list in sync when someone is created, updated, or removed in the Entra application. No on-premises connector. [cite:11]

SCIM tenant URL

Commercial Webex uses https://webexapis.com/identity/scim/OrgId/v2. Webex for Government uses https://api-usgov.webex.com/identity/scim/OrgId/v2. [cite:11]

Entra ID Wizard

The Control Hub wizard path that can synchronize groups, rooms, and avatars. SCIM 1.1 cannot. SCIM 2.0 can synchronize users and groups, and still not rooms or avatars. [cite:11]

License

What you administer to users from the Control Hub overview once a service is provisioned. SKU names for a given subscription stay in the licensing room. [cite:1]

Analytics window

A standard customer can access 3 months of analytics data. A Pro Pack customer can access 13 months. [cite:12]

SP-initiated SSO

The ADFS guide says not to test SSO from the IdP interface. It says Webex only supports service-provider-initiated flows, and the Control Hub SSO test is the test. [cite:13]

Partner Hub

The console named for administrators who manage multiple customer organizations. It is not the customer org’s Control Hub. [cite:2]

Mind map

mindmap
  root((Control Hub))
    Identity
      Directory Connector
      SCIM 2.0
      Entra ID Wizard
    Sign-in
      Org SSO uid
      Partner SSO mail
      SP-initiated test
    Licensing
      Overview assignment
    Analytics
      Standard 3 months
      Pro Pack 13 months
    Partner Hub

Studio asset still required: assets/diagrams/T1-R01/eco.svg

Sister-technology matrix

Integration map

One row is one edge. Webhook event names for user lifecycle are not in the articles read for this room.

Cross-platform bridges

Future-integration hooks

• Government SCIM already has its own host in the SCIM article. Read the Government identity pages on help.webex.com for differences beyond the SCIM host. Those pages change with the government cloud, so this commercial room leaves them there.
• When a user-lifecycle webhook catalog is cited, add it as another edge. Read the event names on developer.webex.com. They change when Cisco adds an event.
• Re-read the analytics selectable-range sentence after any Control Hub analytics release. The 27 January 2026 change is already in the past relative to this draft.
• Role assignment propagation (up to 10 minutes) stays a Control Hub fact, cited in the trouble section, and will matter the first time SSO and a new admin collide. [cite:2]

Ecosystem troubleshooting

These rows are sister-system causes. They do not replace the room’s own troubleshooting matrix.

05 · Flow

One admin change, end to end

This is not a SIP ladder. It is the control-plane path for “make Alex a user-and-device administrator and put a desk phone in the Austin workspace.” Numbers match the map.

06 · Config path

Stand up the mental model in the UI

Do these in a lab org, not production. Labels below are copied from help articles retrieved 2026-10-14. If the live menu differs, mark the step and do not “fix” the article from memory.

1. Email → browserOpen the administrator activation mail and set the password. The same address is the sign-in. [cite:1]
   Screenshot placeholder · step 1 · activation mail and first password screen.
2. Control Hub overviewConfirm which of Messaging, Meetings, and Calling are actually provisioned before you hunt for their settings. [cite:1]
   Screenshot placeholder · step 2 · overview service cards.
3. Management → Users → a second person → Administrator rolesAssign a second full administrator. Cisco recommends more than one full administrator even in small orgs. [cite:2]
   Screenshot placeholder · step 3 · role picker.
4. Management → Organization Settings → Help and supportRead the redirect toggle before you enable it. It changes where users go for help and blocks several TAC entry points for users. [cite:1]
   Screenshot placeholder · step 4 · support redirect.
5. Management → LocationCreate one location with country, address, announcement language, email language, and time zone. A new location is hosted in the regional data center that corresponds to the country chosen in the First Time Setup Wizard. [cite:4]
   Screenshot placeholder · step 5 · location form.
6. Management → WorkspacesAdd a workspace, set its location, and choose whether it gets a device. [cite:3]
   Screenshot placeholder · step 6 · workspace wizard.
7. DevicesAdd a device to that workspace and copy the activation code. Do not complete registration until the lab section. [cite:1]
   Screenshot placeholder · step 7 · activation code.
8. Users → Admin roles → Create a custom roleOnly if you need a privilege the prebuilt roles do not match. Custom roles are a separate article; location administrator still cannot be combined with them. [cite:8] [cite:2]
   Screenshot placeholder · step 8 · custom role permission groups.

07 · Limits, licensing, gotchas

Numbers that are safe to say out loud

Anything not in this table is not a limit yet. Older Cisco Live slides are not used here; this room’s figures come from help articles retrieved 2026-10-14.

08 · Troubleshooting

Symptom → evidence → fix

09 · Recursive self-question

Ladder — do not skip to L4

10 · Lab

Checklist — lab org only

Checks persist in this browser only.

• Goal: name every object in the map from a live Control Hub, and prove one role rule by attempting a combination the article forbids.
• Prereq: a trial or lab organization you are allowed to change. Production customer orgs are out of scope. Read the Calling license on the subscription in Control Hub. The name follows the order, and production customer orgs stay out of scope.
• Step 1. Sign in. Expected: overview lists services that are active or available. [cite:5]
• Step 2. Open your user. Expected: full administrator (or you cannot finish the lab). Record who else is full admin.
• Step 3. Create a test user with no role. Expected: the user has no administrative privileges. [cite:2]
• Step 4. Assign location administrator, Save, then try to add full administrator. Expected: the combination is refused or impossible. Capture the UI text.
• Step 5. Create a location with a real-looking lab address and a time zone. Expected: the location saves. Note the menu label you actually saw (Location vs Locations).
• Step 6. Create a workspace in that location and start adding a device until an activation code appears. Expected: a code is generated. Do not claim the device is registered. [cite:1]
• Evidence: screenshots of the overview, the failed role combination, the location, and the activation code with the code redacted in anything you keep.
• Break-it: turn on Redirect user support with a dummy URL in the lab org, then see the user help path. Recovery: turn the toggle off. [cite:1]
• Reflection: which role distinction surprised me, and which menu label disagreed with the article?

11 · Quiz

Twelve checks

12 · Audio slots

Studio fills these. Nothing plays in Phase 0.

13 · Interview

Oral-ready

1 · What is Control Hub?

30 seconds. It is the admin console for a Webex organization: people, roles, services, devices, and the overview of what is actually turned on. [cite:1]

2 minutes. Add the first-run story (wizard, terms, activation email becomes the admin sign-in), the object list (user, role, location, workspace, device, service), and the rule that new users are not admins. [cite:2] Offer to draw the map.

2 · How do you delegate without handing over the org?

30 seconds. Assign a narrower prebuilt role, or a custom role. Do not hand out full admin by habit. [cite:2]

2 minutes. Contrast support admin, device admin, and location admin. Mention the Calling blind spot and the non-combinable location role. Mention groups: up to 100 groups, 20 roles each, and removal from the group removes the grant. [cite:2]

3 · Where does calling configuration live?

30 seconds. Under the Calling service and on the location. A location without a number is flagged and cannot place or receive calls. [cite:4]

2 minutes. Separate “the service is provisioned” from “this admin is allowed to touch it.” Then point to T2-R02 for which PSTN option the location may pick. Do not invent PSTN detail in this answer.

4 · How is contact-center admin different?

30 seconds. There is a Contact Center Service Administrator role, and customer read-only admins do not get into contact-center administration. [cite:2]

2 minutes. Quote the partner exception: external full admins cannot grant that service-admin role to other external admins. Say WxCCE operations are a different track. [cite:2]

5 · What do you refuse to guess?

30 seconds. Maximum users, maximum locations, the live region matrix, and any SKU name not on the subscription.

2 minutes. Show the limits table. Explain why this room refuses an unstated cap, and the December 31, 2026 CDR-role deadline as a dated fact that needs a re-check. [cite:2]

14 · Citations

Ledger

Retrieved 2026-10-14 unless noted. Mirrors cites/T1-R01.md. No Drive links.

1. Get started with Control Hub — help.webex — article nkhozs6 — https://help.webex.com/article/nkhozs6/Get-Started-with-Control-Hub — retrieved 2026-10-14.
2. Assign organization account roles in Control Hub — help.webex — article fs78p5 / qrdsz8 (same article body) — https://help.webex.com/en-us/article/fs78p5/Assign-organization-account-roles-in-Control-Hub — retrieved 2026-10-14.
3. Locations in Control Hub — help.webex — article ajh6iy — https://help.webex.com/en-us/article/ajh6iy — retrieved 2026-10-14. Points at developer.webex.com workspace-locations and /v1/locations.
4. Configure Webex Calling for your organization — help.webex — article njvdjf2 — https://help.webex.com/en-us/article/njvdjf2/Configure-Webex-Calling-for-your-organization — retrieved 2026-10-14. Used here for location create/delete and the admin.webex.com sign-in, not for the full PSTN design (that is T2-R02).
5. Control Hub — help.webex — article nuylwki — https://help.webex.com/en-us/article/nuylwki/Control-Hub — retrieved 2026-10-14.
6. Devices page in Control Hub — help.webex — article z3elky — https://help.webex.com/article/z3elky/Devices-page-in-Control-Hub — retrieved 2026-10-14.
7. Workspace locations API — developer.webex — referenced from cite 3 as https://developer.webex.com/docs/api/v1/workspace-locations — page body not re-read in this pass. re-check the live schema before writing a client.
8. Custom roles in Control Hub — help.webex — article x7l1qbb — https://help.webex.com/en-us/article/x7l1qbb/Customized-roles-in-Control-Hub — retrieved 2026-10-14.
9. Deployment Guide for Directory Connector — help.webex — article zqvufbb — https://help.webex.com/article/zqvufbb — retrieved 2026-10-14. Windows and Active Directory requirements, download from Control Hub, suppress-invites requires SSO.
10. Single Sign-On Integration in Control Hub — help.webex — article lfu88u — https://help.webex.com/article/lfu88u — retrieved 2026-10-14. Org SSO uid must match an email address. Partner SSO uses mail, not uid.
11. SCIM 2.0 provisioning with a custom Webex app in Entra ID — help.webex — article 3211gv — https://help.webex.com/article/3211gv — retrieved 2026-10-14. Commercial and Government tenant URLs. Groups: No on SCIM 1.1, Yes on SCIM 2.0 and the Entra ID Wizard. Rooms and avatars: Wizard only.
12. Analytics for Your Cloud Collaboration Portfolio — help.webex — article n0rlwxe — https://help.webex.com/article/n0rlwxe — retrieved 2026-10-14. Standard customer 3 months. Pro Pack 13 months. The 27 January 2026 selectable-range sentence is re-check.
13. Configure single sign-on in Control Hub with Active Directory Federation Services (ADFS) — help.webex — article nyx7kubb — https://help.webex.com/article/nyx7kubb — retrieved 2026-10-14. Do not test SSO from the IdP. SP-initiated flows only. Use the Control Hub SSO test.
14. Assign administrator and external administrator roles in Partner Hub — help.webex — article 16gmxfb — help.webex.com article 16gmxfb — retrieved 2026-10-14. Header date on the fetch was July 30, 2026. Names partner full, partner administrator, partner read-only, and Help Desk Basic and Advanced. Provisioning administrator is implicit.
15. Migrate Unified CM to Webex Calling, introduction — help.webex — article nbedetf — help.webex.com article nbedetf.
16. Migration from BroadWorks and BroadCloud to Webex Calling — help.webex — article n1ku0vfb — help.webex.com article n1ku0vfb.
17. Delegate location administration — help.webex — article 760wbi — help.webex.com article 760wbi — retrieved 2026-10-14. Header August 05, 2026. A Webex Calling administrator can administer up to 250 assigned locations. The delegation drop-down selects up to five locations. Adding administrators to one location allows up to 5 users at a time. None of these is an organization-wide location cap.

15 · Re-engineer later

Stub

• Open questions: live menu string “Location” versus “Locations”; which custom-role permission exactly matches the admin audit log. Partner Hub customer-management roles are cited from 16gmxfb and are not an open comparison.
• Read the user cap on the subscription in Control Hub, and read the data-center list on the residency articles T3-R01 cites. Assigned-location limits are 760wbi. Trial SKUs, per-device activation error strings, API coverage for role assignment, and WxCCE/DI operational ownership stay on those live pages because each one changes on its own.
• Assets missing: assets/diagrams/T1-R01/arch.svg export, assets/diagrams/T1-R01/eco.svg export, assets/images/T1-R01/hero.png, screenshots for steps 1–8, three audio files under assets/audio/T1-R01/. The ecosystem mind map is already an inline SVG.
• Ecosystem gaps: CUCM attribute crosswalk, per-IdP SSO click-path beyond ADFS, user-lifecycle webhook names, Webex for Government identity differences beyond the SCIM host, Calling SKU strings.
• Ideas for v1.0: clickable role matrix that highlights Calling and contact-center columns; a “menu label I actually saw” lab log.
• Next review date: 2026-12-15, and again immediately after 2026-12-31 for the CDR API role sunset.