00 · Header

T1 · Control Hub & Platform Foundations

Admin Roles & Partner Admin

Color-coded sequence: Admin → Control Hub → Identity → Services. A packet moves along the arrows. Reduced motion keeps every step visible.

People you add start with no administrative privileges. A full administrator can assign roles, and it may take up to 10 minutes before the new role is usable. Location administrator is exclusive. User and device administrator, and device administrator, cannot administer Webex Calling. A Webex Calling administrator can be assigned up to 250 locations.

Room T1-R05Version v0.1last-verified: 2026-10-14Difficulty L2Est. time 80–100 minPrereq T1-R01Reading 22 min

Key takeaways

On first setup, the administrator from the partner organization becomes the full administrator and can create more administrators. [cite:1]
Full administrators cannot simultaneously hold location administrator. The article prints that as “simultenously.” Read-only cannot be combined with a custom role or location administrator. [cite:1]
Organizations can have up to 100 groups with assigned administrator roles. One group can hold up to 20 different roles. You cannot manage administrator roles through the administrator CSV. [cite:1]
Full administrators cannot assign Advanced Troubleshooting Access to themselves. Another full administrator assigns it. The role can go to a full, read-only, or support administrator. [cite:1]
Location administrators cannot add or delete locations, cannot modify the PSTN connection, and cannot use bulk operations. Adding administrators to one location allows up to 5 users at a time. The delegation drop-down selects up to five locations. [cite:2]

01 · Executive summary

Five lines, then why it matters

Assign a person’s roles at Management > Users > the user > Summary > Administrator roles. Assign a group’s roles at Groups > Webex groups > the group > Assignments > Assign roles. [cite:1]
User and device administrators can assign the location administrator role and cannot assign other administrator roles. Device administrators register devices, generate activation codes, and manage workspaces. Neither can administer Webex Calling. [cite:1]
Compliance officers are the role with access to user-generated content and legal hold. Security activity administrators are the other role, with full administrators, marked for the admin actions audit log. [cite:1]
The earlier Webex Calling Detailed Call History API access role is marked Obsolete and remains operational until December 31, 2026. New assignments use a custom role. [cite:1]
A location administrator can delete hunt-group agents from other locations and can add new hunt-group users only from assigned locations. For a Webex Calling call queue they can add users from other locations, and they can allow join or unjoin only for agents in assigned locations. [cite:2]

Why it matters. Interview answers that say “admin” fail here. Partner launch, location scope, and the Calling restriction on device roles are three different keys.

02 · Architecture map

Who can change the organization, and who is fenced to locations

1Full
2Read-only
3Support
4User and device
5Device
6Location

Mermaid source (not rendered)

flowchart TB
  Full[Full administrator] --> Roles
  Roles --> Location[Location administrator exclusive]
  Roles --> Device[Device roles without Calling admin]

Studio asset still required: assets/diagrams/T1-R05/arch.svg

03 · Concept deep-dive

The matrix, then the location fence

The role article recommends more than one full administrator even in a small organization. Users you add have no administrative privileges at first. [cite:1] The retrieved body of fs78p5 did not print a header date. re-check that page’s date before you treat the matrix as frozen. The delegation article is dated August 05, 2026. [cite:2]

full administratorlocation administratorread-onlycompliance officer10 minutes250 locations

VISUAL placeholder · assets/images/T1-R05/hero.png · Studio draws one full-admin key and a separate location key that will not share a ring.

Prebuilt roles

Role	What the article says	Cite
Full administrator	Every aspect of how the organization is run: users, licenses, policy templates, organization settings. Cannot simultaneously hold location administrator. Has Webex site administrator and Meeting content administrator by default, and those cannot be modified or revoked.	[cite:1]
Read-only administrator	View and monitor all areas. No organizational changes. Cannot also be a custom role or location administrator.	[cite:1]
Support administrator	Analytics and reports, troubleshooting tools, and organization support cases.	[cite:1]
User and device administrator	Add and manage users, set up devices, assign location administrator. Cannot assign other administrator roles. Cannot administer Webex Calling.	[cite:1]
Device administrator	Register or deregister devices and phone numbers, activation codes, workspaces. Cannot administer Webex Calling.	[cite:1]
Compliance officer	Events API and eDiscovery for user-generated content. Legal hold overrides default retention.	[cite:1]
Security activity administrator	Helps full administrators monitor organization-setting changes and troubleshoot Calling and meeting logs. Audit log access is marked for this role and full administrator.	[cite:1]
Advanced troubleshooting access	Live Meeting page for full, read-only, and support administrators. Full administrators with it can join in-progress meetings. A full administrator cannot assign it to themselves.	[cite:1]

Matrix cells that are easy to over-claim

Access	Who the organization-role table marks	Cite
Add or delete users and assign licenses	Full: yes. Read-only: read-only. User and device: yes.	[cite:1]
Assign roles to users	Full: yes. Read-only: read-only. The other columns in that row are empty.	[cite:1]
Admin actions audit log	Full administrator and security activity administrator.	[cite:1]
User-generated content and legal hold	Compliance officers.	[cite:1]
Join in-progress meetings and live meetings	Advanced troubleshooting access.	[cite:1]
Webex site roles on Site Administration-managed sites	Cannot be assigned in Control Hub. Control Hub site roles are for Control Hub-managed sites.	[cite:1]
Customer read-only and Contact Center	A customer read-only administrator cannot access the Webex Contact Center administrative interfaces (Control Hub and Management Portal).	[cite:1]

Location administrator fence

Area	Restricted action the delegation table names	Cite
Users	Add, delete, and move users. Edit summary is also restricted.	[cite:2]
Locations	Add and delete locations. Edit call recording settings. Modify PSTN connection.	[cite:2]
Workspaces	Delete workspaces.	[cite:2]
Devices	Alert center support. Cannot add a device from the devices screen. Can add devices for individual users and workspaces.	[cite:2]
Calling features	Recordings are restricted on the feature list that includes auto attendant, call park, call pickup, call queue, and hunt group.	[cite:2]
PSTN and routing	Add, edit, delete, and export numbers.	[cite:2]
Bulk	Bulk operations are not available.	[cite:2]
Scale	Up to 5 users at a time on one location. Up to five locations in the delegation drop-down. A Webex Calling administrator can administer up to 250 assigned locations.	[cite:2]

Tip

Changing the organizational role of a user who already has a services role can affect that services role. Review services roles first. [cite:1]

Gotcha

A user with a directly assigned read-only or location administrator role will not inherit an incompatible role from a group. Remove the direct role, remove the user from the group, and add them to the group again. [cite:1]

Partner console

The customer role article points partner administrators who manage multiple organizations at Partner Hub, and it points delegated partner access at a separate external-administrator article. This room does not copy Partner Hub role names from a page it did not re-read. Article 16gmxfb is that pointer. [cite:1]

04 · Ecosystem

Ecosystem and sister technologies

Mini map of the neighbors named on this room’s sequence. Orientation sketch, not a new product claim.

Glossary

Full administrator: Access to every aspect of how the organization is run. Exclusive of location administrator. [cite:1]
Location administrator: Delegated administration of certain services in assigned locations. Exclusive of other administrator roles. [cite:1] [cite:2]
Advanced troubleshooting access: Live Meeting access. A full administrator cannot assign it to themselves. [cite:1]
Compliance officer: The organization role marked for user-generated content and legal hold. [cite:1]
Services role: A role such as a Webex site role that can be affected when the organizational role changes. [cite:1]
Obsolete CDR role: Webex Calling Detailed Call History API access, marked Obsolete, operational until December 31, 2026. [cite:1]
Partner Hub: The console the role article names for administrators who manage multiple customer organizations. [cite:1]
Provisioning administrator: In the contact-center table, a partner-organization role that can perform contact-center administrative activities a partner full administrator can perform, and cannot perform user management. [cite:1]

Mind map

Mermaid source (not rendered)

mindmap
  root((Roles))
    Full
    Location
    Device
    Compliance
    Partner Hub

Sister-technology matrix

Sister	What it is	Why it matters here	Config touchpoint	Typical failure	Cite
Users	People who start with no admin rights.	Roles are assigned after the person exists.	Summary > Administrator roles.	Expecting a synced user to be an admin.	[cite:1]
Groups	Webex groups that can carry roles.	Up to 100 such groups, up to 20 roles on one group.	Groups > Webex groups > Assignments.	An incompatible direct role blocking inheritance.	[cite:1]
Locations	The scope of a location administrator.	Up to 250 for a Calling administrator. Five at a time in the drop-down.	Location Admins pane, or Delegation.	Treating 250 as an org-wide location cap.	[cite:2]
Webex Calling	The service device roles cannot administer.	Activation codes are still a device-admin action.	Device management versus Calling settings.	A device admin trying to change a dial plan.	[cite:1]
PSTN connection	Location-level trunk or cloud PSTN.	Location administrators cannot modify it.	Location PSTN.	A site admin retargeting the gateway.	[cite:2]
Contact Center	A service with its own administrator table.	Customer read-only cannot open the interfaces.	Contact Center administrator role article, linked from the role page.	Giving read-only and expecting the Management Portal.	[cite:1]
Meetings sites	Control Hub-managed versus Site Administration-managed.	Site roles in Control Hub apply to Control Hub-managed sites.	Webex site administrator roles.	Assigning a Control Hub site role to a Site Administration site.	[cite:1]
Audit and compliance	Admin actions versus user content.	Different roles. Compliance is content. Security activity is the audit log.	Role matrix.	Calling a compliance officer a full admin.	[cite:1]

Integration edges

From	To	Mechanism	What moves	Cite
Full administrator	User	Summary > Administrator roles	One or more prebuilt roles. Up to 10 minutes.	[cite:1]
Full administrator	Webex group	Assignments > Assign roles	Up to 20 roles. Members gain and lose them with membership.	[cite:1]
Partner organization	New customer org	First setup	The partner administrator becomes the full administrator.	[cite:1]
Full administrator	Location administrator	Delegation checkbox, up to five locations	The exclusive location role.	[cite:2]
Location	Admins pane	Add	Up to 5 users at a time.	[cite:2]
Location administrator	Hunt group	Agent edit	Delete any assigned agent. Add users only from assigned locations.	[cite:2]
Full administrator	Custom CDR role	Custom role	Replacement for the obsolete Detailed Call History API role.	[cite:1]
Administrator list	CSV download	Filter, then export	Names, email, roles. The file cannot manage roles.	[cite:1]

Cross-platform bridges

Orientation only. The role article’s contact-center table distinguishes a customer organization, a partner organization, and any other organization. External administrators and the Contact Center Service Administrator are in that table. [cite:1] A CUCM role such as Standard CCM Admin is not in this article.

Future-integration hooks

Move users off the obsolete Calling Detailed Call History API role before December 31, 2026. [cite:1]
Canon planning: a role worksheet that lists who holds full administrator, who holds location administrator, and which of those location admins are at the 250 assignment count. Study sheet, not a Cisco roadmap.
re-check fs78p5 when a header date is visible. The body used here did not print one.

Ecosystem troubleshooting

Symptom	Likely sister-system cause	Check	Fix	Cite
A device admin cannot open Calling settings	The role cannot administer Webex Calling.	The assigned role.	Use a role the matrix allows for Calling administration.	[cite:1]
A location admin cannot change the PSTN connection	Modify PSTN connection is a restricted action.	The delegation table.	A full administrator changes the PSTN connection.	[cite:2]
Group role did not apply	A direct read-only or location role blocks an incompatible group role.	Direct assignment versus group membership.	Remove the direct role, remove the user from the group, add them again.	[cite:1]

05 · Flow

From a person with no rights to a usable role

Step	From	To	Protocol	Notes	Cite
1	Partner admin	New organization	First setup	That administrator becomes the full administrator.	[cite:1]
2	Full administrator	User summary	Control Hub	Management > Users > Summary > Administrator roles.	[cite:1]
3	Save	User session	Propagation	It may take up to 10 minutes.	[cite:1]
4	Full administrator	Group	Assignments	Groups > Webex groups > Assign roles. Up to 20 roles.	[cite:1]
5	Full administrator	Location admin	Delegation	Check Location admin. Select up to five locations.	[cite:2]
6	Location	Admins pane	Add	Up to 5 users at a time.	[cite:2]
7	Another full administrator	Advanced troubleshooting	Role assign	Not a self-assignment.	[cite:1]
8	Filter	CSV	Export	Wait for the download before changing the filter. The CSV cannot manage roles.	[cite:1]

06 · Config

Click paths

Sign in to Control Hub. Management > Users. Open the user. Summary tab, Administrator roles, select roles, Save. [cite:1]
If you are a partner, open the customer organization first, then that organization’s Users page. [cite:1]
Review services roles before you change the organizational role. [cite:1]
For a group: Groups > Webex groups > the group > Assignments > Assign roles > Save. [cite:1]
Find administrators: Management > Users > Filter, check the roles. Export from the top right. Do not change the filter until the CSV finishes. [cite:1]
Location admin from the user: Summary > Administrator roles > Delegation > Location admin > up to five locations > Done. The delegation article also shows the Profile tab path. [cite:2]
Location admin from the location: Management > Locations > the location > Admins > Add. Up to 5 users at a time. [cite:2]
Remove a location from an administrator by leaving Location admin checked and removing that location, or uncheck Location admin to remove the role. [cite:2]
Advanced troubleshooting access: another full administrator assigns it to a full, read-only, or support administrator. [cite:1]
For new Calling detailed-call-history API access, create the custom role and assign it from Users. The functional role stays operational until December 31, 2026. [cite:1]

Screenshot placeholder. The paths above are the articles.

07 · Limits

Numbers the articles state

Item	Value	Source	Verified?
Role propagation	Up to 10 minutes	[cite:1]	Quoted. re-check header date on fs78p5.
Groups with admin roles	Up to 100	[cite:1]	Quoted
Roles on one group	Up to 20	[cite:1]	Quoted
Locations in one delegation save	Up to five	[cite:2]	Quoted. Header August 05, 2026.
Administrators added to one location at a time	Up to 5 users	[cite:2]	Quoted
Locations for one Webex Calling administrator	Up to 250 assigned	[cite:2]	Quoted. Not an organization-wide cap.
Obsolete CDR role	Operational until December 31, 2026	[cite:1]	Quoted
Location admin plus another admin role	Not allowed	[cite:1]	Quoted

08 · Troubleshooting

Ten failures that follow from the articles

Symptom	Likely cause	Evidence	Fix	Cite
New user cannot open Control Hub settings	New users have no administrative privileges.	Administrator roles on the summary.	A full administrator assigns a role.	[cite:1]
Role was saved and access is still missing	Propagation can take up to 10 minutes.	Time since Save.	Wait, then sign in again.	[cite:1]
Location admin checkbox will not stick beside full admin	The roles are exclusive.	The other roles on the user.	Remove the other administrator roles first.	[cite:1]
Read-only plus a custom role is refused	Read-only cannot be combined with a custom role or location administrator.	The role combination.	Create a custom role that includes the view you need, without read-only.	[cite:1]
Device admin cannot change Calling	The article says they can’t administer Webex Calling.	Role name.	Assign a role that can.	[cite:1]
Full admin cannot grant themselves Advanced Troubleshooting Access	Self-assignment is blocked.	Who is signed in.	Another full administrator assigns it.	[cite:1]
Group role never appeared	A direct read-only or location role blocks inheritance.	Direct roles.	Remove the direct role, leave the group, rejoin the group.	[cite:1]
Exported admin CSV changed after a filter edit	Changing the filter before the download finishes writes the new filter into the current download.	Timing of the filter change.	Wait for the file.	[cite:1]
Location admin cannot add a location or change PSTN	Both actions are restricted.	The delegation table.	A full administrator performs them.	[cite:2]
Sixth location will not save in one delegation	The drop-down selects up to five locations.	The picker.	Save five, then add more. The Calling administrator ceiling is 250 assigned locations.	[cite:2]

09 · Self-question ladder

Twelve rungs

L0What privileges does a new user have?

None. [cite:1]

L0Who becomes full administrator on first setup?

The administrator from the partner organization. [cite:1]

L1Why is location administrator exclusive?

The role article says you can’t assign any other administrator role to a location administrator, and a full administrator can’t hold it at the same time. [cite:1]

L1How long can a new role take?

Up to 10 minutes. [cite:1]

L2Who can assign roles to users?

The matrix marks full administrator as yes, and read-only as read-only. User and device administrators can assign the location administrator role and cannot assign other administrator roles. [cite:1]

L2Who sees the admin actions audit log?

Full administrator and security activity administrator. [cite:1]

L3How many groups can carry admin roles?

Up to 100. One group can have up to 20 roles. [cite:1]

L3What is the location scale for a Calling administrator?

Up to 250 assigned locations. The drop-down in one save is up to five. One location can receive up to 5 administrators at a time. [cite:2]

L4Can a location administrator add a hunt-group agent from another site?

They can delete any assigned agent, including agents from other locations, and they can add new users only from their assigned locations. [cite:2]

L4Can a customer read-only administrator open Contact Center admin?

No. The table says they cannot access the Webex Contact Center administrative interfaces. [cite:1]

L5What replaces the obsolete Calling CDR role?

A custom role for the Detailed Call History CDR APIs, including stream and feed. The old role remains operational until December 31, 2026. [cite:1]

L5Can the administrator CSV change roles?

No. You can’t manage administrator roles through the CSV file. [cite:1]

11 · Quiz

Twelve questions

Q1MCQ

What admin rights does a new user start with?

Answer

None. [cite:1]

Q2MCQ

Can a full administrator also be a location administrator?

Answer

No. [cite:1]

Q3MCQ

How long can a new role take to apply?

Answer

Up to 10 minutes. [cite:1]

Q4MCQ

Can a device administrator administer Webex Calling?

Answer

No. [cite:1]

Q5MCQ

Who assigns Advanced Troubleshooting Access to a full administrator?

Answer

Another full administrator. Self-assignment is blocked. [cite:1]

Q6MCQ

How many groups can have administrator roles?

Answer

Up to 100. Up to 20 roles on one group. [cite:1]

Q7MCQ

How many locations can one Webex Calling administrator be assigned?

Answer

Up to 250. [cite:2]

Q8MCQ

How many locations does one delegation drop-down select?

Answer

Up to five. [cite:2]

Q9Scenario

A location administrator tries to add a location and change its PSTN connection.

Answer

Both are restricted. [cite:2]

Q10MCQ

When does the obsolete Calling detailed-call-history role stop being operational?

Answer

December 31, 2026. [cite:1]

Q11MCQ

Can the administrator CSV change roles?

Answer

No. [cite:1]

Q12Draw

Name the two roles marked for the admin actions audit log.

Answer

Full administrator and security activity administrator. [cite:1]

12 · Audio

Slots for Studio

Transcript slot

Studio fills this. The prompt is the spoken outline.

Transcript slot

Studio fills this. The prompt is the spoken outline.

Transcript slot

Studio fills this. The prompt is the spoken outline.

13 · Interview

Oral answers

30 seconds. New users have no admin rights. Full administrator runs the organization and cannot also be a location administrator. Device administrator and user-and-device administrator cannot administer Webex Calling. A new role can take up to 10 minutes.

2 minutes. I assign roles on the user summary or on a Webex group. One organization can have 100 groups with roles, and one group can hold 20 roles. Read-only does not combine with a custom role. A direct read-only or location role blocks an incompatible group role until I remove it and re-add the user to the group. Compliance officers get user content and legal hold. Security activity administrators share the audit log with full administrators. I cannot grant myself Advanced Troubleshooting Access.

30 seconds, locations. Location administrator is exclusive. I can pick up to five locations in the drop-down, add up to five people to one location at a time, and a Webex Calling administrator can hold up to 250 assigned locations. That 250 is not an organization-wide cap.

2 minutes, the fence. A location administrator cannot add or delete locations, cannot modify PSTN, cannot run bulk operations, and cannot add a device from the devices screen. They can add devices on a user or a workspace. On a hunt group they can delete any agent and add users only from their own locations. On a Calling call queue they can add users from other locations and can allow join or unjoin only inside their locations.

What you will say about the old CDR role. It is marked Obsolete and stays operational until December 31, 2026. New access is a custom role for the detailed call history APIs. Partner Hub role names stay in article 16gmxfb, which this pass did not re-read line by line.

14 · Citations

Assign organization account roles in Control Hub — help.webex — article fs78p5 — help.webex.com article fs78p5 — retrieved 2026-10-14. re-check header date; the retrieved body did not print one. New users have no admin privileges. Role exclusivity. 10 minutes. 100 groups, 20 roles. Calling restriction on device roles. Audit log, compliance, advanced troubleshooting, obsolete CDR role until December 31, 2026. Contact Center read-only row. CSV cannot manage roles.
Delegate location administration — help.webex — article 760wbi — help.webex.com article 760wbi — header August 05, 2026 — retrieved 2026-10-14. Exclusive location role. Restricted actions including PSTN and bulk. Up to 5 users at a time. Up to five locations in the drop-down. Up to 250 assigned locations for a Webex Calling administrator. Hunt group and call queue agent rules.

15 · Re-engineer later

Open questions: the header date on fs78p5, and the current Partner Hub role list in 16gmxfb, which this pass did not re-fetch.
Facts still TODO-verify: 0 in the body. Partner Hub role names are omitted rather than guessed. fs78p5 is re-check for its missing header date.
Assets missing: role screenshot, audio.
Ideas for v1.0: a one-page matrix copied from the article’s checkmarks, reviewed when the header date appears.
Next review: before December 31, 2026, for the obsolete CDR role, and whenever 760wbi changes the 250.

Sources and go deeper

Checked links were opened this month. A confirm row has no address because that page was not opened.

Wikipedia Webex (Wikipedia) last checked 2026-10
Vendor doc Webex Help Center last checked 2026-10
DevDocs Webex developer documentation last checked 2026-10
DevDocs Webex developer getting started last checked 2026-10
Community Webex community last checked 2026-10
SRND Cisco Collaboration design zone last checked 2026-10
RFC RFC 3261 SIP: Session Initiation Protocol last checked 2026-10
Port table IANA service name and port number registry last checked 2026-10
Port table Port reference for Webex Calling last checked 2026-10
Release notes What's new in Webex Calling last checked 2026-10
Vendor doc help.webex.com article fs78p5 last checked 2026-10
Vendor doc help.webex.com article 760wbi last checked 2026-10

sources.json for this page.

Admin Roles & Partner Admin

Five lines, then why it matters

Who can change the organization, and who is fenced to locations

The matrix, then the location fence

Prebuilt roles

Matrix cells that are easy to over-claim

Location administrator fence

Ecosystem and sister technologies

Glossary

Mind map

Sister-technology matrix

Integration edges

Cross-platform bridges

Future-integration hooks

Ecosystem troubleshooting

From a person with no rights to a usable role

Click paths

Numbers the articles state

Ten failures that follow from the articles

Twelve rungs

Role desk, no production org

Twelve questions

Slots for Studio

Oral answers

Sources and go deeper