00 · Header

T1 · Control Hub & Platform Foundations

Identity & Directory Sync

Directory Connector is one Windows instance per Active Directory domain. SCIM 2.0 is a REST sync with no on-premises connector. Org SSO maps uid. Partner SSO maps mail. A dry run comes before the first full sync, and invite suppression requires SSO.

Expand all sections

01 · Executive summary

Five lines, then why it matters

• Directory Connector runs on Windows Server 2025, 2022, 2019, or 2016, requires TLS 1.2 and .NET Framework 4.5, and needs Active Directory forest functional level 2 or higher. [cite:1]
• The connector sign-in account is the same user as a full administrator in Control Hub. By default the service uses the local system account to read Active Directory. [cite:1]
• New accounts can be Active before first sign-in when you verify domains, integrate SSO, and suppress automatic email invites. Invite suppression requires the SSO integration. [cite:1]
• With more than one IdP, Webex supports SAML, OpenID Connect, and Webex Identity. An extra IdP stays inactive until a routing rule exists. Directory Sync or Entra ID blocks SAML just-in-time create and update. [cite:4]
• SCIM 1.1 synchronizes users only. SCIM 2.0 adds groups. The Entra ID Wizard is the path that also synchronizes rooms and avatars, through Microsoft Graph. [cite:3]

02 · Architecture map

Two pictures: where identity is born, and how a user becomes Active

• 1Directory Connector
• 2SCIM 2.0
• 3Entra ID Wizard
• 4SSO claim

flowchart LR
  AD[Active Directory domain] --> DC[Directory Connector]
  Entra[Entra ID] --> SCIM[SCIM 2.0]
  Entra --> Wizard[Entra ID Wizard]
  DC --> Org[Webex organization]
  SCIM --> Org
  Wizard --> Org
  IdP[SAML IdP] --> Org

Studio asset still required: assets/diagrams/T1-R02/arch.svg

03 · Concept deep-dive

Three provisioning paths, one uid

Control Hub is where you view users, assign licenses, download Directory Connector, and configure SSO when you want users to authenticate through an identity provider and you do not want to send Webex App email invitations. [cite:1] Directory synchronization is shown as disabled until you install the connector and a full synchronization succeeds. [cite:1]

What each path will synchronize

Directory Connector rules you can defend

SSO claim, then the multi-IdP gate

04 · Ecosystem

Ecosystem and sister technologies

Identity is the sister that Control Hub, Calling, and Contact Center all read. This section names the neighbors before the flow trusts a click-path. The hub ecosystem map is the cross-track picture.

Glossary

Directory Connector

The Windows software you download from Control Hub and install on a trusted Windows server. One instance serves one Active Directory domain. [cite:1]

Dry run

A test of the synchronization process. You must do a dry run before a full synchronization. [cite:1]

Full synchronization

The sync that turns directory synchronization on for a new installation, and the sync required for groups. [cite:1]

Incremental synchronization

A sync of changes. The dashboard action is disabled when synchronization is paused or disabled, when a full sync has not completed, or when a sync is in progress. [cite:1]

uid

The only required cloud attribute in Directory Connector attribute mapping. It must come from an Active Directory attribute in email format. [cite:1]

SCIM

The REST API that keeps the user list in sync when someone is created, updated, or removed in the Entra application. No on-premises connector. [cite:3]

Bearer token

The secret Entra provisioning uses. The manual retrieval path in the SCIM article says the token is valid for 365 days. [cite:3]

Routing rule

The rule that tells Webex which IdP to use when more than one is configured. Skipping it leaves the IdP inactive. [cite:4]

Hybrid Directory

Named among the Hybrid Services that data residency says are supported in the region, together with Hybrid Calendar, Hybrid Calling, Video Mesh, Hybrid Data Security, and Hybrid Messages. [cite:5]

Mind map

mindmap
  root((Identity))
    Directory Connector
    SCIM
    Wizard
    SSO
    Routing rules

Sister-technology matrix

Integration edges

Cross-platform bridges

Future-integration hooks

• Canon planning: when a lab tenant exists, capture a dry-run summary and a SCIM Test Connection result as text. That is a study asset, not a Cisco roadmap.
• The manually issued bearer token expires after 365 days. Put the renewal on a calendar before that day. [cite:3]
• re-check the SSO and SCIM articles when their header dates appear. This room’s retrieved copies did not print one.

Ecosystem troubleshooting

05 · Flow

From a domain account to a cloud uid

06 · Config

Click paths

1. Confirm a trial or paid subscription, then download Directory Connector from Control Hub so the installer is the current build. Upgrades after install are reported through the software. [cite:1]
2. Install on Windows Server 2025, 2022, 2019, or 2016. Confirm TLS 1.2 and .NET Framework 4.5. Confirm the forest functional level is 2 or higher. [cite:1]
3. Sign in with the same account as a full Control Hub administrator. Leave the service on the local system account, or set another account in Windows services if that account must read the domain. [cite:1]
4. Map uid to mail or userPrincipalName. Both must be email format. Map any other attribute only when you can still satisfy that format. [cite:1]
5. If room objects live in the directory, check Identify Room so room data stays separate from user data. [cite:1]
6. Run a dry run. Read the event view. Then start a full synchronization. Incremental sync is available after that full sync completes. [cite:1]
7. Optional Active-before-sign-in path: add and verify the email domains, optionally claim them, integrate SSO, then suppress automatic invites. Suppression requires SSO. [cite:1]
8. For organization SSO, set NameID format to transient and send uid. For partner SSO, send mail. [cite:2]
9. For a custom Entra SCIM 2.0 app: Enterprise applications, New application, Integrate any other application you don't find in the gallery, Provisioning mode Automatic, Visible to users set to No. [cite:3]
10. Copy the Organization ID from the customer view: organization name at the bottom left. Paste it into the tenant URL for the offer you use. Get the bearer token from Apps > Service apps, or from the manual idbroker URL while signed in as a full admin in an incognito window. Test Connection, then save a notification email. [cite:3]
11. Assign one test user before the rest. Only assigned users and groups are synchronized. [cite:3]
12. If you add a second IdP, add a routing rule or the IdP stays inactive. You need the Full Admin role. [cite:4]

Screenshot placeholder. The paths above are the articles.

07 · Limits

Numbers the articles state

08 · Troubleshooting

Ten failures that follow from the articles

09 · Self-question ladder

Twelve rungs

10 · Lab

Desk check, no production directory

• Goal: classify a provisioning design as Directory Connector, SCIM 1.1, SCIM 2.0, or Entra ID Wizard, using only the tables in this room.
• Prereq: this room. A production Active Directory and a production Entra tenant are out of scope.
• Step 1. A design asks one connector to sync two domains. Expected: rejected. One instance, one domain.
• Step 2. A design runs incremental sync on a brand-new connector. Expected: the action stays disabled until a full sync completes.
• Step 3. A design wants rooms and avatars from Entra without the Wizard. Expected: SCIM 2.0 does not list rooms or avatars.
• Step 4. Write the commercial tenant URL pattern and the government tenant URL pattern. Expected: webexapis.com and api-usgov.webex.com, both ending in /identity/scim/OrgId/v2.
• Step 5. A partner SSO claim is named uid. Expected: partner SSO uses mail.
• Evidence: a one-page sheet with the five decisions and the cite number beside each.
• Break it: map uid to an attribute that is not an email. Recovery: map mail or userPrincipalName and rerun the dry run.
• Reflection: which of your directories already stores a site prefix inside the extension attribute.

11 · Quiz

Twelve questions

12 · Audio

Slots for Studio

13 · Interview

Oral answers

30 seconds. Directory Connector is one Windows instance per Active Directory domain. The only required attribute is uid, and I map mail or userPrincipalName. I dry-run, then full-sync. Invite suppression waits for SSO.

2 minutes. Supported servers on the September 15, 2026 guide are Windows Server 2025, 2022, 2019, and 2016, with TLS 1.2 and .NET Framework 4.5, and forest functional level 2 or higher. The connector login is a full Control Hub admin. The service account that reads the directory defaults to local system. Groups need a full sync. Incremental sync stays off until that full sync exists. Organization SSO is SAML 2.0 with a transient NameID and a uid claim. Partner SSO sends mail.

30 seconds, SCIM. SCIM needs no on-premises connector. Commercial tenant host is webexapis.com. Government host is api-usgov.webex.com. SCIM 2.0 synchronizes users and groups. Rooms and avatars stay on the Entra ID Wizard.

2 minutes, collisions. If Directory Sync or Entra ID is already on, SAML just-in-time create and update will not run. A second IdP stays inactive until a routing rule exists. A userPrincipalName that is not the Control Hub email creates a new user. Entra will not push a null, so clearing an attribute in Entra leaves the Webex value. The manual bearer token lasts 365 days, and I mint it as a full admin in a private window.

What you will say about Calling. The extension stored in the directory is the bare extension. The routing prefix is added by Webex Calling, and the dial-plan article says the directory must not already contain it.

14 · Citations

1. Deployment Guide for Directory Connector — help.webex — article zqvufbb — help.webex.com article zqvufbb — header September 15, 2026 — retrieved 2026-10-14. One connector per domain. Windows Server 2025, 2022, 2019, 2016. TLS 1.2 and .NET Framework 4.5. Forest functional level 2 or higher. Full-admin sign-in. Local system account by default. uid required. Dry run before full sync. Groups need a full sync. Invite suppression requires SSO.
2. Single Sign-On Integration in Control Hub — help.webex — article lfu88u — help.webex.com article lfu88u — retrieved 2026-10-14. SAML 2.0. NameID transient. Organization claim uid. Partner claim mail. re-check the header date; the retrieved body used here did not print one.
3. SCIM 2.0 provisioning with a custom Webex app in Entra ID — help.webex — article 3211gv — help.webex.com article 3211gv — retrieved 2026-10-14. Tenant URLs. 365-day manual token. Supported-objects table for SCIM 1.1, the Wizard, and SCIM 2.0. Null values are not synchronized. Default userPrincipalName to userName. re-check the header date.
4. SSO with multiple IdPs in Webex — help.webex — article ngp4sr8 — help.webex.com article ngp4sr8 — header April 17, 2026 — retrieved 2026-10-14. SAML, OpenID Connect, and Webex Identity. Routing rule required to activate an added IdP. Directory Sync or Entra ID blocks SAML JIT create or update. Full Admin role.
5. Data residency in Webex — help.webex — article oybc4fb — help.webex.com article oybc4fb — header September 24, 2026 — retrieved 2026-10-14. Identities and keys stay in the organization GEO. Migration between GEO locations is not supported. Hybrid Directory is in the hybrid list.
6. Set up automatic license assignments in Control Hub — help.webex — article n3ijtao — help.webex.com article n3ijtao — header September 08, 2026 — retrieved 2026-10-14. Services are usable when the user becomes Active. Verified or claimed domains plus SSO and suppressed invites are the path for use before sign-in. An inactive user from an unverified domain stays unactivated until first sign-in.
7. Configure Webex Calling for your organization — help.webex — article njvdjf2 — help.webex.com article njvdjf2 — cited from the T2-R03 ledger for the Directory Connector prefix rule. Read the extension attribute before you add a routing prefix.
8. Migrate Unified CM to Webex Calling, introduction — help.webex — article nbedetf — help.webex.com article nbedetf — header January 14, 2026 — retrieved 2026-10-14. Entra ID Wizard replaces Directory Connector when the customer moves the directory to Entra ID. Webex Calling in that guide means multi-tenant.

15 · Re-engineer later

• Open questions: the header dates on lfu88u and 3211gv.
• Facts still TODO-verify: 0. Two header dates are re-check, not unverified claims.
• Assets missing: connector screenshot, architecture SVG file, three audio files.
• Ideas for v1.0: a dry-run text capture from a lab domain.
• Next review: when the SCIM supported-objects table changes, or when the 365-day token sentence changes.