# Unified CM to Webex Calling Dedicated Instance Systems: Cisco Unified CM to Webex Calling Dedicated Instance For Unified CM administrators and Cisco partners moving an on-premises cluster onto a Cisco-hosted Webex Calling Dedicated Instance. Canonical: https://warmtransfer.net/guides/cucm-to-webex-calling-dedicated-instance Last verified: 2026-10-01 Webex Calling Dedicated Instance is a dedicated cloud instance option of Webex Calling based on the Cisco Unified Communications Manager architecture[^50]. Cisco's Dedicated Instance migration best practice runs through project initiation, discovery and assessment, planning and implementation, freeze, cutover or go-live, and Day 2 operations[^24]. ## Before you start Dedicated Instance is orderable as an add-on for Webex Calling [Flex Plan 3.0](https://warmtransfer.net/knowledge/cisco-collaboration-flex-plan) through partners in specific countries[^46]. Dedicated Instance must be purchased before activation[^4]. The Dedicated Instance add-on includes Unified CM, Unity Connection and Expressway (for MRA and B2B), with IM and Presence optional and Session Management Edition optional for multi-cluster deployments[^44]. - Platform: Cisco's Dedicated Instance deployment models include hybrids in which some user personas or sites run on Dedicated Instance and others on Webex Calling multi-tenant[^54]. - PSTN: Dedicated Instance reaches the PSTN through a gateway or CUBE on the customer premises (local breakout), a partner-hosted local gateway, or a Cloud Connected PSTN provider[^58]. - Peering: Cisco requires Dedicated Instance peering at 2 sites within a region for network redundancy, and the customer must peer in every region where it has a UC footprint[^57]. - Survivability: If the existing Unified CM deployment uses SRST at remote sites, the same SRST can be extended to Dedicated Instance Unified CM[^59], and Dedicated Instance also supports Enhanced Survivable Nodes, Unified CM nodes deployed on premises for full on-premises failover[^53]. - Client: Webex App users are moved by changing their calling behaviour in Control Hub, and Jabber users by the defined login method and a change of home cluster[^10]. For inventory, the Pre-Migration Assistant in Control Hub gathers source cluster data and checks prerequisites, reporting nodes, versions, SIP trunks, devices, route groups, partitions, device pools and database replication health[^25]. Discovery should check the device inventory against the compatibility matrix for deprecated and end-of-support phones, with special restrictions noted for the 7925, 7940 and 7960[^15]. See also [Webex Calling Dedicated Instance applicability](https://warmtransfer.net/knowledge/webex-calling-dedicated-instance). See also [CUCM to Webex Calling migration](https://warmtransfer.net/knowledge/cucm-to-webex-calling). See also [Webex Calling PSTN options and selection](https://warmtransfer.net/knowledge/webex-calling-pstn-options). ## What changes by situation - Where do your users land? Every user and device moves to Dedicated Instance; Some personas or sites go to Dedicated Instance and others to Webex Calling multi-tenant. - Where does PSTN break out? A gateway or CUBE on your own premises; A local gateway hosted by your partner; A Cloud Connected PSTN provider. - How does your network reach the Dedicated Instance data centers? Webex Edge Connect through Equinix or Megaport; Partner Connect through your partner; Webex Virtual Connect. - What keeps branch sites calling if the path to the cloud fails? Extend existing SRST routers; Enhanced Survivable Nodes on premises; No local survivability. - Which soft client do your users run against Dedicated Instance? Webex App; Cisco Jabber. ## Step 1: Confirm the target platform **Every user and device moves to Dedicated Instance** ### Do Confirm that one cluster holds the whole estate: a fully deployed Dedicated Instance cluster supports up to 8 call processing servers, or approximately 50,000 devices[^47]. Confirm the commercial route: Dedicated Instance is orderable as an add-on for Webex Calling Flex Plan 3.0 through partners in specific countries[^46]. ### Verify Suggested check: compare the device count from your inventory against that cluster ceiling before ordering. Suggested check: confirm with your partner that the add-on can be ordered in every country where you have sites. ### Rollback Suggested rollback: nothing has been ordered at this point, so there is nothing to reverse. **Some personas or sites go to Dedicated Instance and others to Webex Calling multi-tenant** ### Do Assign each persona or site to one platform, following Cisco's deployment models in which some user personas or sites run on Dedicated Instance and others on Webex Calling multi-tenant[^54]. Plan for the interop SIP trunk between Webex Calling Dedicated Instance and the Webex Calling multi-tenant platform, which the customer must activate[^3]. Confirm that the Dedicated Instance portion fits one cluster, which when fully deployed supports up to 8 call processing servers, or approximately 50,000 devices[^47]. ### Verify Suggested check: confirm that every user and device group is assigned exactly one target platform. Suggested check: compare the device count assigned to the dedicated cluster against that cluster ceiling. ### Rollback Suggested rollback: nothing has been ordered at this point, so there is nothing to reverse. ## Step 2: Assess the source cluster ### Do Run the Pre-Migration Assistant in Control Hub, which gathers source cluster data and checks prerequisites, reporting nodes, versions, SIP trunks, devices, route groups, partitions, device pools and database replication health[^25]. Check the device inventory against the compatibility matrix for deprecated and end-of-support phones, noting the special restrictions for the 7925, 7940 and 7960[^15]. Record the source release: Cisco Unified CM Version 12.5 reached end of support on 31 August 2025[^75]. Check exposure to CVE-2026-20045, a Critical-rated vulnerability with CVSS base 8.2 in the web management interface of Unified CM, SME, IM and Presence, Unity Connection and Webex Calling Dedicated Instance[^76]. CVE-2026-20045 has no workarounds, and Cisco PSIRT reports attempted exploitation in the wild[^77]. It is fixed in Unified CM 14SU5 and 15SU4, or by the patch ciscocm.CSCwr21851_Remote_Code_Execution_v1, and Release 12.5 customers must migrate to a fixed release[^78]. ### Verify The Pre-Migration Assistant report includes database replication health[^25]. Suggested check: confirm that replication shows healthy before you plan the freeze. Suggested check: confirm that the inventory records a decision for every phone model that cannot move. ### Rollback Suggested rollback: this step only reads data, so there is nothing to reverse. ## Step 3: Activate the regions and accept Cisco's build ### Do - Activation runs in the First-Time Setup Wizard or later in Control Hub under Calling > Dedicated Instance > Status[^4]. - Dedicated Instance data center regions are AMER (Los Angeles, Ashburn), APJC (Singapore, Tokyo), AUS (Melbourne, Sydney), EU (Frankfurt, Amsterdam), UK (London, Manchester), KSA (Jeddah, Riyadh) and EMEA (London, Amsterdam)[^43]. - The EMEA Dedicated Instance region is marked as taking no new customer deployments[^42]. - WarmTransfer's reading of the sources is that, because region activation cannot be reversed and EMEA takes no new deployments, a new European customer would choose between the EU and UK regions before activation[^63]. - Activate all or a subset of purchased regions by entering Professional, Standard and Workspace device quantities per region[^1]. - The Voice Service Domain becomes editable only after at least one region is selected, and it must not exceed 10 characters[^2]. - Cisco sizes the Dedicated Instance cluster, and the number of Knowledge Workers and Common Area devices determines how many call processing nodes are deployed[^49]. - Provisioning sizes for 3 active devices per Knowledge Worker and accommodates the Flex agreement reserve of 15% or 20%[^6]. - Dedicated Instance customers are entitled to MRA licences for 100% of their Knowledge Worker count and B2B calling for 5% of it[^48]. - Do not rename configuration elements whose names begin with "x", because automation, serviceability and analytics integrations use them[^34]. ### Verify Cisco provides each Dedicated Instance region's service FQDN in the form `..wxc-di.webex.com`[^68]. Suggested check: confirm that the hosted applications appear in the admin portal for every region you activated. ### Rollback Once Dedicated Instance is activated in a region, the activation cannot be reversed or moved to another region[^5]. Suggested rollback: treat the region choice as final and review it before you submit. ## Step 4: Establish network peering **Webex Edge Connect through Equinix or Megaport** ### Do To order [Webex Edge Connect](https://warmtransfer.net/knowledge/webex-edge-connect), the customer buys a port with Equinix or Megaport, orders Edge Connect in CCW, submits the Edge Connect request portal, and Webex configures its edge routers in up to 10 business days before the customer configures its own router[^60]. Edge Connect for Dedicated Instance needs 2 connections, and selecting redundancy is mandatory when ordering[^61]. Edge Connect for Dedicated Instance requires 2 links (sources describe the same requirement as 2 connections and as 2 links); 4 links are optional, are used in pairs without crossing, and traffic prioritisation between links is not supported[^17]. Edge Connect 3.0 lets a customer consolidate multi-tenant Webex Calling, Dedicated Instance and Webex Meetings traffic over a single peering path[^52]. Peer at 2 sites in every region where you have a UC footprint[^57]. ### Verify Suggested check: confirm that both links are up in each region and that routes reach the application networks of that region. ### Rollback Suggested rollback: leave the new peering unused, because it runs alongside the existing network and does not change the on-premises cluster. **Partner Connect through your partner** ### Do In the Partner Connect model, the partner aggregates customer networks and extends connectivity to Dedicated Instance, with connection set-up in Webex data centers taking 10 business days[^73]. Partner connectivity options for Dedicated Instance are unavailable in the Kingdom of Saudi Arabia region[^74]. Peer at 2 sites in every region where you have a UC footprint[^57]. ### Verify Suggested check: have the partner confirm working connections at both sites in each region. ### Rollback Suggested rollback: leave the new peering unused, because it runs alongside the existing network and does not change the on-premises cluster. **Webex Virtual Connect** ### Do Webex Virtual Connect for Dedicated Instance has a maximum bandwidth of 250 Mbps and is not supported for Enhanced Survivability Node deployments[^33]. WarmTransfer's reading of the sources is that a customer planning Enhanced Survivability Nodes would peer with Edge Connect or Partner Connect rather than Virtual Connect[^62]. Peer at 2 sites in every region where you have a UC footprint[^57]. ### Verify Suggested check: confirm that projected busy-hour signalling and media fit under the bandwidth ceiling. Suggested check: confirm that the survivability choice does not depend on on-premises nodes. ### Rollback Suggested rollback: leave the new peering unused, because it runs alongside the existing network and does not change the on-premises cluster. ## Step 5: Configure DNS and exchange certificates ### Do - On-premises devices need the Dedicated Instance FQDN resolvable from internal DNS, done with conditional forwarders to the regional Dedicated Instance DNS servers[^67]. - Conditional forwarding is not needed for MRA registration because Cisco pre-provisions all the external DNS records MRA requires[^69]. - Cisco provides the domain and signs all Dedicated Instance UC application certificates with a public certificate authority[^70]. - Exchange CallManager.pem, ITLRecovery.pem and the intermediate and root CA certificates in both directions between the on-premises cluster and Dedicated Instance, so phones can move between clusters and back without a factory reset[^9]. - In Dedicated Instance, SNMP monitoring is not allowed except for Emergency Responder and InformaCast by service request, and there is no external SFTP access[^23]. ### Verify Suggested check: resolve the new cluster's service names from an on-premises host. Suggested check: confirm that each cluster's trust store shows the other cluster's certificates. ### Rollback Suggested rollback: remove the conditional forwarders. Suggested rollback: leave the exchanged certificates in place. We infer that a phone rollback to the on-premises cluster without factory resets depends on completing the 2-way certificate exchange before any production phone is moved[^64]. ## Step 6: Set up directory synchronisation and SSO ### Do SSO is not mandatory for Dedicated Instance itself but is mandatory for Webex Common Identity and Webex App use, and the SAML SSO process is the same as for on-premises Unified CM[^29]. For on-premises Unified CM, LDAP directory synchronization is a mandatory prerequisite for enabling SAML SSO[^79]. Cisco documents 2 SAML SSO modes for Unified CM: Cluster wide, which uses a single SAML agreement and one metadata file for the cluster, and Per Node, which uses separate metadata for each node[^80]. For SAML SSO, the clock difference between the IdP and the Unified Communications applications can be at most 3 seconds[^81]. ### Verify The SSO test must be run with an LDAP-synchronized user[^79]. Suggested check: confirm that synchronised users appear on the new cluster before you run the test. ### Rollback Suggested rollback: disable single sign-on and remove the sync agreement on the new cluster, which leaves the on-premises cluster untouched. ## Step 7: Build the trunks between clusters ### Do Cisco recommends setting up the intercluster trunk between the on-premises cluster and Dedicated Instance early, to support testing, cross-integration and phased migration[^20]. The customer must activate the interop SIP trunk between Webex Calling Dedicated Instance and the Webex Calling multi-tenant platform[^3]. ### Verify Suggested check: place test calls in both directions across the intercluster trunk. Suggested check: where some users run on the multi-tenant platform, also place calls between them and users on the new cluster. ### Rollback Suggested rollback: remove the route patterns that send calls across the intercluster trunk. ## Step 8: Connect the PSTN **A gateway or CUBE on your own premises** ### Do For on-premises breakout, the customer configures a SIP trunk from Dedicated Instance to a premises-based gateway and keeps its existing PSTN provider relationship[^55]. Cisco recommends secure (TLS and SRTP) trunks from Dedicated Instance Unified CM to the PSTN gateway or [CUBE](https://warmtransfer.net/knowledge/cisco-unified-border-element) for outbound PSTN calls[^71]. Prepare the gateway changes now, because cutover modifies gateway, SRST and hardware media configuration[^13]. ### Verify Cutover testing covers intra-site and inter-site calls, PSTN, MRA, 911, voicemail and other applicable features[^30]. Suggested check: place inbound and outbound test calls through a test gateway before cutover. ### Rollback Rollback mirrors the cutover method of procedure by reverting every executed action[^28]. Suggested rollback: point the gateway routing back at the on-premises cluster. **A local gateway hosted by your partner** ### Do Dedicated Instance can reach the PSTN through a partner-hosted local gateway[^58]. Cisco recommends secure (TLS and SRTP) trunks from Dedicated Instance Unified CM to the PSTN gateway or CUBE for outbound PSTN calls[^71]. ### Verify Cutover testing covers intra-site and inter-site calls, PSTN, MRA, 911, voicemail and other applicable features[^30]. Suggested check: complete inbound and outbound test calls jointly with the partner. ### Rollback Rollback mirrors the cutover method of procedure by reverting every executed action[^28]. Suggested rollback: have the partner point the gateway routing back at the on-premises cluster. **A Cloud Connected PSTN provider** ### Do Setting up CCP for Dedicated Instance means provisioning locations in Control Hub, selecting Cloud Connected PSTN and a CCP provider, ordering and importing numbers, creating Route Lists per location with Route Groups, and configuring the dial plan[^36]. Route Lists are lists of telephone numbers reached through Route Groups, and only customers with Dedicated Instance entitlements can see or configure them[^37]. With CCP, PSTN calls are routed from the Dedicated Instance cloud through the Webex Calling multi-tenant environment to the PSTN provider[^51]. ### Verify Suggested check: confirm that the route lists show the imported numbers. Suggested check: complete test calls in both directions for each location. ### Rollback Suggested rollback: until numbers port, leave inbound routing with the existing carrier so the on-premises path keeps working. ## Step 9: Build survivability **Extend existing SRST routers** ### Do If the existing Unified CM deployment uses SRST at remote sites, the same SRST can be extended to Dedicated Instance Unified CM[^59]. Cutover modifies gateway, SRST and hardware media configuration[^13]. ### Verify Suggested check: cut a test phone's path to the new cluster and confirm that it falls back to the local router. ### Rollback Rollback mirrors the cutover method of procedure by reverting every executed action[^28]. Suggested rollback: point the fallback router references back at the on-premises cluster. **Enhanced Survivable Nodes on premises** ### Do Dedicated Instance supports Enhanced Survivable Nodes, Unified CM nodes deployed on premises for full on-premises failover[^53]. Enhanced Survivability Nodes are licensed per region through an ESN Flex SKU, allow up to 8 ESN nodes per cluster, and the customer provisions the virtual resources and installs the Medium OVA publisher[^18]. Webex Virtual Connect is not supported for Enhanced Survivability Node deployments[^33]. ### Verify Suggested check: confirm that the node joins the cluster. Suggested check: cut a test phone's path to the cloud and confirm that it fails over to the local node. ### Rollback Suggested rollback: keep the on-premises cluster live until cutover is accepted. **No local survivability** ### Do Cisco requires Dedicated Instance peering at 2 sites within a region for network redundancy[^57]. ### Verify Suggested check: confirm that both peering paths are active in each region. Suggested check: confirm that the design record states that sites have no local call control fallback. ## Step 10: Plan emergency calling ### Do Cisco Emergency Responder is included in Dedicated Instance only in the Americas region[^45]. In the Dedicated Instance E911 model, on-premises phones are tracked by Cisco Emergency Responder and Webex App users by RedSky using HELD+[^16]. Cisco provides the proxy information and LUA script, while the customer or partner sets up the RedSky account and configures ELINs and parameters[^27]. ### Verify Cutover testing covers intra-site and inter-site calls, PSTN, MRA, 911, voicemail and other applicable features[^30]. Suggested check: place a test emergency call from each phone type and each soft client during testing. ### Rollback Suggested rollback: keep the existing emergency location service live until cutover is accepted. ## Step 11: Freeze and move the data ### Do - Cisco recommends a freeze phase of 2 to 3 weeks, during which data is moved from the source to the target Dedicated Instance and validated for cutover[^19]. - For Unified CM data, Cisco names Bulk Administration Tool export and import with scripting, or external tools such as Yarnlab Wrangler, as the migration tools[^7]. - Cisco's Control Hub article on migrating Unified CM data to Webex Calling states in its overview that the steps apply to Dedicated Instance also, and limits each migration task to 1000 users and 1000 devices[^66]. - WarmTransfer's reading of the sources is that, because Cisco's Dedicated Instance best-practice article names BAT with scripting, Wrangler and COBRAS as the freeze-phase tools, the Control Hub multi-tenant migration task should not be assumed to be the primary path for moving a cluster into Dedicated Instance[^65]. - For Unity Connection voicemail data, Cisco recommends COBRAS from the Cisco Unity Tools collection[^11]. - COBRAS backs up Unity Connection user, call handler, interview handler, public distribution list, schedule and routing rule information[^41], and it can import voice mail messages as well as greetings and voice names[^39]. - COBRAS can restore onto a different version or product than the one backed up, and supports partial restores and merges of several backups[^38]. - Use Briefcase Mode, which restores a backup onto another server without changing the source system; Hot Mode moves users between Connection servers 8.5 or later in a digital network and changes the source[^40]. - Cisco Emergency Responder data is moved to Dedicated Instance by manual or bulk export and import[^8]. - A Unified CM partition is a logical group of route patterns, directory numbers, translation patterns, transformation patterns, URIs and hunt pilots that divides the route plan into logical subsets[^82]. - A caller can reach a destination only if the destination's partition is in the caller's calling search space[^83]. - Plan the imported lines and route patterns around the cutover, which bulk-updates line and route pattern configuration between active and null partitions[^13]. ### Verify Suggested check: compare object counts on the new cluster with the counts in the export. Suggested check: review the voicemail restore logs for failed users. ### Rollback COBRAS Briefcase Mode restores a backup onto another server without changing the source system[^40]. Suggested rollback: keep the on-premises cluster as the system of record until cutover is accepted. ## Step 12: Pilot phones and soft clients **Webex App** ### Do During the freeze, repoint a test group of phones to the Dedicated Instance TFTP, manually or through DHCP option 150, and test both migration and rollback once certificates are consolidated[^31]. For Webex soft clients, configure UC Manager Profiles in Control Hub for each region's Voice Service Domain[^72]. Move the pilot users by changing their calling behaviour in Control Hub[^10]. ### Verify Suggested check: confirm that pilot users register both on the corporate network and remotely. Suggested check: confirm that the test phones register on the new cluster and return to the on-premises cluster. ### Rollback Suggested rollback: set the pilot users' calling behaviour back to the on-premises cluster. Suggested rollback: point the test phones back at the on-premises TFTP server. **Cisco Jabber** ### Do During the freeze, repoint a test group of phones to the Dedicated Instance TFTP, manually or through DHCP option 150, and test both migration and rollback once certificates are consolidated[^31]. Move the pilot users with the defined login method and a change of home cluster[^10]. The Dedicated Instance MRA service is deployed across all regions as part of service activation[^56]. Dedicated Instance MRA capacity is initially deployed at 20% and can be expanded to 100% through a TAC ticket[^22]. ### Verify Suggested check: confirm that pilot users sign in both on the corporate network and remotely. Suggested check: confirm that the test phones register on the new cluster and return to the on-premises cluster. ### Rollback Suggested rollback: restore the pilot users' home cluster to the on-premises cluster. Suggested rollback: point the test phones back at the on-premises TFTP server. ## Step 13: Cut over ### Do - Open a proactive, scheduled TAC ticket for the cutover window[^26]. - Move devices by changing DHCP option 150 on all affected subnets and resetting the phones on the on-premises Unified CM[^12]. - Bulk-update line and route pattern configuration between active and null partitions, update home cluster settings and advertisements on both systems, and modify gateway, SRST and hardware media configuration[^13]. ### Verify Checking which phones are registered on the new Dedicated Instance cluster is the recommended way to control cutover progress[^32]. Cutover testing covers intra-site and inter-site calls, PSTN, MRA, 911, voicemail and other applicable features[^30]. ### Rollback Rollback mirrors the cutover method of procedure by reverting every executed action, and the procedure should have a deadline so rollback fits inside the maintenance window[^28]. We infer that a phone rollback to the on-premises cluster without factory resets depends on completing the 2-way certificate exchange before any production phone is moved[^64]. ## Step 14: Hand over to Day 2 operations ### Do After go-live, request changes such as DNS entries, firewall updates, firmware uploads, cloud connectivity, UC application management and DI-MT interop trunks from Cisco through service requests[^14]. Dedicated Instance MRA capacity is initially deployed at 20% and can be expanded to 100% through a TAC ticket[^22]. Configuration elements in Dedicated Instance whose names begin with "x" must not be renamed because automation, serviceability and analytics integrations use them[^34]. ### Verify Suggested check: confirm that the operations team can open each service request type it will need. ### Rollback Suggested rollback: decommission the on-premises cluster only after the rollback window has closed. ## Applicability Applies to: Cisco Webex Calling Dedicated Instance, Cisco Webex Edge Connect, Cisco Webex Control Hub, Cisco COBRAS, and Cisco Unified Communications Manager. Deployments: on-premises, multi-tenant, and dedicated instance. Sources checked 2026-10-01. Cisco Emergency Responder is included in Dedicated Instance only in the Americas region[^45]. The EMEA Dedicated Instance region is marked as taking no new customer deployments[^42]. Partner connectivity options for Dedicated Instance are unavailable in the Kingdom of Saudi Arabia region[^74]. ## What remains uncertain Which countries can order Dedicated Instance, which Flex Plan 3.0 SKUs apply, and what they cost is not covered by the sources below. How numbers port to a Cloud Connected PSTN provider for Dedicated Instance, and how to port them back as a rollback, is not covered by the sources below. Emergency calling design for Dedicated Instance outside the Americas is not covered by the sources below. Migration of contact center, paging, fax, recording and other third-party integrations into Dedicated Instance is not covered by the sources below. Migration of IM and Presence data into Dedicated Instance is not covered by the sources below. The Unified CM version that Cisco runs in a given Dedicated Instance, and whether a given source version exports cleanly with BAT, is not covered by the sources below. Whether COBRAS Hot Mode can run between an on-premises Unity Connection server and the Dedicated Instance one is not covered by the sources below. Eligibility criteria for Webex Virtual Connect are not covered by the sources below. How branch sites behave during a WAN or peering outage when no survivability is deployed is not covered by the sources below. Decommissioning Enhanced Survivable Nodes after a rollback is not covered by the sources below. ## Sources [^1]: At activation the administrator activates all or a subset of purchased regions by entering Professional, Standard and Workspace device quantities per region. Source: [Activate Dedicated Instance](https://help.webex.com/en-us/article/nefkee9/Activate-Dedicated-Instance), Region selection section. Checked 2026-10-01. [^2]: The Dedicated Instance Voice Service Domain becomes editable only after at least one region is selected, and it must not exceed ten characters. Source: [Activate Dedicated Instance](https://help.webex.com/en-us/article/nefkee9/Activate-Dedicated-Instance), Voice Service Domain field description. Checked 2026-10-01. [^3]: The customer must activate the interop SIP trunk between Webex Calling Dedicated Instance and the Webex Calling multi-tenant platform. Source: [Activate Dedicated Instance](https://help.webex.com/en-us/article/nefkee9/Activate-Dedicated-Instance), Activation steps, interop SIP trunk note. Checked 2026-10-01. [^4]: Dedicated Instance must be purchased before activation; activation runs in the First-Time Setup Wizard or later in Control Hub under Calling > Dedicated Instance > Status. Source: [Activate Dedicated Instance](https://help.webex.com/en-us/article/nefkee9/Activate-Dedicated-Instance), Activation overview and First-Time Setup Wizard sections. Checked 2026-10-01. [^5]: Once Dedicated Instance is activated in a region, the activation cannot be reversed or moved to another region. Source: [Activate Dedicated Instance](https://help.webex.com/en-us/article/nefkee9/Activate-Dedicated-Instance), Region selection section. Checked 2026-10-01. [^6]: Dedicated Instance provisioning sizes for three active devices per Knowledge Worker and accommodates the Flex agreement reserve of 15% or 20%. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Planning and implementation, Build DI environment, sizing considerations. Checked 2026-10-01. [^7]: For Unified CM data, Cisco names Bulk Administration Tool export and import with scripting, or external tools such as Yarnlab Wrangler, as the migration tools. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Freeze phase, data migration tools, For UCM. Checked 2026-10-01. [^8]: Cisco Emergency Responder data is moved to Dedicated Instance by manual or bulk export and import. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Freeze phase, data migration tools, For CER. Checked 2026-10-01. [^9]: Before migration, CallManager.pem, ITLRecovery.pem and the intermediate and root CA certificates are exchanged in both directions between the on-premises cluster and Dedicated Instance, so phones can move between clusters and back without a factory reset. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Certificates consolidation. Checked 2026-10-01. [^10]: Webex App users are moved by changing their calling behaviour in Control Hub, and Jabber users by the defined login method and a change of home cluster. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Webex App and Jabber migration planning; freeze phase endpoint migration. Checked 2026-10-01. [^11]: For Unity Connection voicemail data, Cisco recommends COBRAS from the Cisco Unity Tools collection. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Freeze phase, data migration tools, For Unity. Checked 2026-10-01. [^12]: On cutover day, devices are moved by changing DHCP option 150 on all affected subnets and resetting the phones on the on-premises Unified CM. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Cutover day / go-live, device migration. Checked 2026-10-01. [^13]: Cutover also bulk-updates line and route pattern configuration between active and null partitions, updates home cluster settings and advertisements on both systems, and modifies gateway, SRST and hardware media configuration. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Cutover day / go-live, configuration updates and infrastructure changes. Checked 2026-10-01. [^14]: After go-live, changes such as DNS entries, firewall updates, firmware uploads, cloud connectivity, UC application management and DI-MT interop trunks are requested from Cisco through service requests. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Day 2 operations, service request types. Checked 2026-10-01. [^15]: Discovery should check the device inventory against the compatibility matrix for deprecated and end-of-support phones, with special restrictions noted for the 7925, 7940 and 7960. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Discovery and assessment, device inventory review. Checked 2026-10-01. [^16]: In the Dedicated Instance E911 model, on-premises phones are tracked by Cisco Emergency Responder and Webex App users by RedSky using HELD+. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), E911 configuration, deployment model. Checked 2026-10-01. [^17]: Webex Edge Connect for Dedicated Instance requires two links; four links are optional, are used in pairs without crossing, and traffic prioritisation between links is not supported. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Network connectivity and peering, Webex Edge Connect. Checked 2026-10-01. [^18]: Enhanced Survivability Nodes are licensed per region through an ESN Flex SKU, allow up to 8 ESN nodes per cluster, and the customer provisions the virtual resources and installs the Medium OVA publisher. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Enhanced Survivability Network (ESN), licensing and responsibilities. Checked 2026-10-01. [^19]: Cisco recommends a freeze phase of two to three weeks, during which data is moved from the source to the target Dedicated Instance and validated for cutover. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Freeze phase, duration and objectives. Checked 2026-10-01. [^20]: Cisco recommends setting up the intercluster trunk between the on-premises cluster and Dedicated Instance early, to support testing, cross-integration and phased migration. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Intercluster integration, best practice. Checked 2026-10-01. [^21]: For Dedicated Instance directory synchronisation, synchronisation should be enabled within 18 hours of creating the agreement. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Directory synchronization, critical timing. Checked 2026-10-01. [^22]: Dedicated Instance MRA capacity is initially deployed at 20% and can be expanded to 100% through a TAC ticket. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Planning and implementation, Build DI environment, sizing considerations. Checked 2026-10-01. [^23]: In Dedicated Instance, SNMP monitoring is not allowed except for Emergency Responder and InformaCast by service request, and there is no external SFTP access. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Network connectivity and peering, network and security requirements. Checked 2026-10-01. [^24]: Cisco's Dedicated Instance migration best practice runs through project initiation, discovery and assessment, planning and implementation, freeze, cutover or go-live, and Day 2 operations. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Migration framework overview. Checked 2026-10-01. [^25]: The Pre-Migration Assistant in Control Hub gathers source cluster data and checks prerequisites, reporting nodes, versions, SIP trunks, devices, route groups, partitions, device pools and database replication health. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Discovery and assessment, Pre-Migration Assistant. Checked 2026-10-01. [^26]: Cisco's cutover preparation is to open a proactive, scheduled TAC ticket for the cutover window. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Cutover day / go-live, preparation. Checked 2026-10-01. [^27]: For Dedicated Instance E911, Cisco provides the proxy information and LUA script, while the customer or partner sets up the RedSky account and configures ELINs and parameters. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), E911 configuration, responsibilities. Checked 2026-10-01. [^28]: Rollback mirrors the cutover method of procedure by reverting every executed action, and the procedure should have a deadline so rollback fits inside the maintenance window. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Cutover day / go-live, rollback procedure. Checked 2026-10-01. [^29]: SSO is not mandatory for Dedicated Instance itself but is mandatory for Webex Common Identity and Webex App use, and the SAML SSO process is the same as for on-premises Unified CM. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Single Sign-On (SSO), requirements. Checked 2026-10-01. [^30]: Cutover testing covers intra-site and inter-site calls, PSTN, MRA, 911, voicemail and other applicable features. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Cutover day / go-live, testing execution. Checked 2026-10-01. [^31]: During the freeze, a test group of phones is repointed to the Dedicated Instance TFTP, manually or through DHCP option 150, and both migration and rollback are tested once certificates are consolidated. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Freeze phase, test activities, phone configuration testing. Checked 2026-10-01. [^32]: Checking which phones are registered on the new Dedicated Instance cluster is the recommended way to control cutover progress. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Cutover day / go-live, verification. Checked 2026-10-01. [^33]: Webex Virtual Connect for Dedicated Instance has a maximum bandwidth of 250 Mbps and is not supported for Enhanced Survivability Node deployments. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Network connectivity and peering, Webex Virtual Connect. Checked 2026-10-01. [^34]: Configuration elements in Dedicated Instance whose names begin with 'x' must not be renamed because automation, serviceability and analytics integrations use them. Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Planning and implementation, configuration note. Checked 2026-10-01. [^35]: For Dedicated Instance locations without E911, emergency calls can be sent to the Webex Calling organisation when the calling number matches a Route List entry. Source: [Cloud Connected PSTN for Dedicated Instance](https://help.webex.com/en-us/article/nw3ygtq/Cloud-Connected-PSTN-for-Dedicated-Instance), Emergency calling section. Checked 2026-10-01. [^36]: Setting up CCP for Dedicated Instance means provisioning locations in Control Hub, selecting Cloud Connected PSTN and a CCP provider, ordering and importing numbers, creating Route Lists per location with Route Groups, and configuring the dial plan. Source: [Cloud Connected PSTN for Dedicated Instance](https://help.webex.com/en-us/article/nw3ygtq/Cloud-Connected-PSTN-for-Dedicated-Instance), Configuration workflow. Checked 2026-10-01. [^37]: Cloud Connected PSTN for Dedicated Instance uses Route Lists, lists of telephone numbers reached through Route Groups, and only customers with Dedicated Instance entitlements can see or configure them. Source: [Cloud Connected PSTN for Dedicated Instance](https://help.webex.com/en-us/article/nw3ygtq/Cloud-Connected-PSTN-for-Dedicated-Instance), How it works, Route Lists. Checked 2026-10-01. [^38]: COBRAS can restore onto a different version or product than the one backed up, and supports partial restores and merges of several backups. Source: [Design Guide for Cisco Unity Connection 14 - Disaster Recovery System and COBRAS](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/14/design/guide/b_14cucdg/b_14cucdg_chapter_01100.html), COBRAS section. Checked 2026-10-01. [^39]: COBRAS can import voice mail messages as well as greetings and voice names. Source: [COBRAS Utilities (help)](http://www.ciscounitytools.com/Applications/General/COBRAS/Help/COBRAS.htm), Revision history and restore options. Checked 2026-10-01. [^40]: COBRAS Briefcase Mode restores a backup onto another server without changing the source system, while Hot Mode moves users between Connection servers 8.5 or later in a digital network and changes the source. Source: [COBRAS Utilities (help)](http://www.ciscounitytools.com/Applications/General/COBRAS/Help/COBRAS.htm), Briefcase Mode and Hot Mode sections. Checked 2026-10-01. [^41]: COBRAS backs up Unity Connection user, call handler, interview handler, public distribution list, schedule and routing rule information. Source: [Design Guide for Cisco Unity Connection 14 - Disaster Recovery System and COBRAS](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/14/design/guide/b_14cucdg/b_14cucdg_chapter_01100.html), COBRAS section. Checked 2026-10-01. [^42]: The EMEA Dedicated Instance region is marked as taking no new customer deployments. Source: [Dedicated Instance data center locations](https://help.webex.com/en-us/article/nx91ljh/Dedicated-Instance-datacenter-locations), EMEA table heading. Checked 2026-10-01. [^43]: Dedicated Instance data center regions are AMER (Los Angeles, Ashburn), APJC (Singapore, Tokyo), AUS (Melbourne, Sydney), EU (Frankfurt, Amsterdam), UK (London, Manchester), KSA (Jeddah, Riyadh) and EMEA (London, Amsterdam). Source: [Dedicated Instance data center locations](https://help.webex.com/en-us/article/nx91ljh/Dedicated-Instance-datacenter-locations), Regional data center tables. Checked 2026-10-01. [^44]: The Dedicated Instance add-on includes Unified CM, Unity Connection and Expressway (for MRA and B2B), with IM and Presence optional and Session Management Edition optional for multi-cluster deployments. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Dedicated Instance add-on application list. Checked 2026-10-01. [^45]: Cisco Emergency Responder is included in Dedicated Instance only in the Americas region. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Dedicated Instance add-on application list. Checked 2026-10-01. [^46]: Dedicated Instance is orderable as an add-on for Webex Calling Flex Plan 3.0 through partners in specific countries. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Regional availability paragraph. Checked 2026-10-01. [^47]: A fully deployed Dedicated Instance cluster supports up to 8 call processing servers, or approximately 50,000 devices. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Capacity paragraph. Checked 2026-10-01. [^48]: Dedicated Instance customers are entitled to MRA licences for 100% of their Knowledge Worker count and B2B calling for 5% of it. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Mobility and access paragraph. Checked 2026-10-01. [^49]: Cisco sizes the Dedicated Instance cluster: the number of Knowledge Workers and Common Area devices determines how many call processing nodes are deployed. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Deployment and sizing paragraph. Checked 2026-10-01. [^50]: Webex Calling Dedicated Instance is a dedicated cloud instance option of Webex Calling based on the Cisco Unified Communications Manager architecture. Source: [Introduction to Dedicated Instance](https://help.webex.com/en-us/article/dk3o5r/Introduction-to-Dedicated-Instance), Overview. Checked 2026-10-01. [^51]: With CCP, PSTN calls are routed from the Dedicated Instance cloud through the Webex Calling multi-tenant environment to the PSTN provider. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), PSTN options, Cloud Connected PSTN. Checked 2026-10-01. [^52]: Edge Connect 3.0 lets a customer consolidate multi-tenant Webex Calling, Dedicated Instance and Webex Meetings traffic over a single peering path. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), Peering, Edge Connect 3.0. Checked 2026-10-01. [^53]: Dedicated Instance supports Enhanced Survivable Nodes, Unified CM nodes deployed on premises for full on-premises failover. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), Survivability, Enhanced Survivable Nodes. Checked 2026-10-01. [^54]: Cisco's Dedicated Instance deployment models include hybrids in which some user personas or sites run on Dedicated Instance and others on Webex Calling multi-tenant. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), Deployment models 2 and 3. Checked 2026-10-01. [^55]: For on-premises breakout, the customer configures a SIP trunk from Dedicated Instance to a premises-based gateway and keeps its existing PSTN provider relationship. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), PSTN options, Local Gateway. Checked 2026-10-01. [^56]: The Dedicated Instance MRA service is deployed across all regions as part of service activation. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), Remote and mobile users. Checked 2026-10-01. [^57]: Cisco requires Dedicated Instance peering at two sites within a region for network redundancy, and the customer must peer in every region where it has a UC footprint. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), Peering requirements. Checked 2026-10-01. [^58]: Dedicated Instance reaches the PSTN through a gateway or CUBE on the customer premises (local breakout), a partner-hosted local gateway, or a Cloud Connected PSTN provider. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), PSTN options section. Checked 2026-10-01. [^59]: If the existing Unified CM deployment uses SRST at remote sites, the same SRST can be extended to Dedicated Instance Unified CM. Source: [Dedicated Instance – customer deployment models](https://help.webex.com/en-us/article/ny65x1bb/Dedicated-Instance-%E2%80%93-customer-deployment-models), Survivability, SRST. Checked 2026-10-01. [^60]: To order Edge Connect, the customer buys a port with Equinix or Megaport, orders Edge Connect in CCW, submits the Edge Connect request portal, and Webex configures its edge routers in up to 10 business days before the customer configures its own router. Source: [Dedicated Instance Edge Connect](https://help.webex.com/en-us/article/13d11e/Dedicated-Instance-edge-connect), Ordering process. Checked 2026-10-01. [^61]: Edge Connect for Dedicated Instance needs two connections, and selecting redundancy is mandatory when ordering. Source: [Dedicated Instance Edge Connect](https://help.webex.com/en-us/article/13d11e/Dedicated-Instance-edge-connect), Redundancy requirements. Checked 2026-10-01. [^62]: A customer planning Enhanced Survivability Nodes would peer with Edge Connect or Partner Connect rather than Virtual Connect, since Virtual Connect is not supported for ESN (inferred). Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Network connectivity and peering, Webex Virtual Connect. Checked 2026-10-01. [^63]: Because region activation cannot be reversed and EMEA takes no new deployments, a new European customer would choose between the EU and UK regions before activation (inferred). Source: [Dedicated Instance data center locations](https://help.webex.com/en-us/article/nx91ljh/Dedicated-Instance-datacenter-locations), EMEA, EU and UK tables; read with act-region-final. Checked 2026-10-01. [^64]: A phone rollback to the on-premises cluster without factory resets depends on completing the two-way certificate exchange before any production phone is moved (inferred). Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Certificates consolidation; freeze phase test activities. Checked 2026-10-01. [^65]: Because Cisco's Dedicated Instance best-practice article names BAT with scripting, Wrangler and COBRAS as the freeze-phase tools, the Control Hub multi-tenant migration task should not be assumed to be the primary path for moving a cluster into Dedicated Instance (inferred). Source: [Best practices in preparation and migration process to Webex Calling - Dedicated Instance](https://help.webex.com/en-us/article/tf6kpq/Best-practices-in-preparation-and-migration-process-to-Webex-Calling-Dedicated-Instance), Freeze phase, data migration tools; read with cisco-help-x974bd-migrate-ucm-data-to-wxc Overview. Checked 2026-10-01. [^66]: Cisco's Control Hub article on migrating Unified CM data to Webex Calling states in its overview that the steps apply to Dedicated Instance also, and limits each migration task to 1000 users and 1000 devices. Source: [Migrate Unified CM data to Webex Calling](https://help.webex.com/en-us/article/x974bd/Migrate-Unified-CM-to-Webex), Overview; migration task section. Checked 2026-10-01. [^67]: On-premises devices need the Dedicated Instance FQDN resolvable from internal DNS, done with conditional forwarders to the regional Dedicated Instance DNS servers. Source: [Dedicated Instance network and security requirements](https://help.webex.com/en-us/article/nquhruk/Dedicated-Instance-Network-and-Security-Requirements), DNS requirements, conditional forwarding. Checked 2026-10-01. [^68]: Cisco provides each Dedicated Instance region's service FQDN in the form ..wxc-di.webex.com. Source: [Dedicated Instance network and security requirements](https://help.webex.com/en-us/article/nquhruk/Dedicated-Instance-Network-and-Security-Requirements), DNS requirements. Checked 2026-10-01. [^69]: Conditional forwarding is not needed for MRA registration because Cisco pre-provisions all the external DNS records MRA requires. Source: [Dedicated Instance network and security requirements](https://help.webex.com/en-us/article/nquhruk/Dedicated-Instance-Network-and-Security-Requirements), DNS requirements, MRA note. Checked 2026-10-01. [^70]: Cisco provides the domain and signs all Dedicated Instance UC application certificates with a public certificate authority. Source: [Dedicated Instance network and security requirements](https://help.webex.com/en-us/article/nquhruk/Dedicated-Instance-Network-and-Security-Requirements), Certificates. Checked 2026-10-01. [^71]: Cisco recommends secure (TLS and SRTP) trunks from Dedicated Instance Unified CM to the PSTN gateway or CUBE for outbound PSTN calls. Source: [Dedicated Instance network and security requirements](https://help.webex.com/en-us/article/nquhruk/Dedicated-Instance-Network-and-Security-Requirements), Security requirements, PSTN gateway trunks. Checked 2026-10-01. [^72]: For Webex soft clients, administrators configure UC Manager Profiles in Control Hub for each region's Voice Service Domain. Source: [Dedicated Instance network and security requirements](https://help.webex.com/en-us/article/nquhruk/Dedicated-Instance-Network-and-Security-Requirements), DNS requirements, UC Manager Profiles. Checked 2026-10-01. [^73]: In the Partner Connect model, the partner aggregates customer networks and extends connectivity to Dedicated Instance, with connection set-up in Webex data centers taking 10 business days. Source: [Dedicated Instance Partner Connect](https://help.webex.com/en-us/article/74f47cb/Dedicated-Instance-Partner-Connect), Overview and timeline. Checked 2026-10-01. [^74]: Partner connectivity options for Dedicated Instance are unavailable in the Kingdom of Saudi Arabia region. Source: [Dedicated Instance Partner Connect](https://help.webex.com/en-us/article/74f47cb/Dedicated-Instance-Partner-Connect), Regional availability note. Checked 2026-10-01. [^75]: Cisco Unified CM Version 12.5 reached end of support on 31 August 2025. Source: [Cisco Unified Communications Manager (CallManager) - Support](https://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/series.html), Supported versions list, Version 12.5 entry (End-of-Support Date). Checked 2026-09-30. [^76]: CVE-2026-20045 (cisco-sa-voice-rce-mORhqY4b) is a Critical-rated vulnerability, CVSS base 8.2, in the web management interface of Unified CM, SME, IM and Presence, Unity Connection and Webex Calling Dedicated Instance. An unauthenticated attacker can gain OS access and escalate to root. Source: [Cisco Unified Communications Products Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b), Summary; Affected Products. Checked 2026-09-30. [^77]: CVE-2026-20045 has no workarounds, and Cisco PSIRT reports attempted exploitation in the wild. Source: [Cisco Unified Communications Products Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b), Workarounds; Exploitation and Public Announcements. Checked 2026-09-30. [^78]: CVE-2026-20045 is fixed in Unified CM 14SU5 and 15SU4, or by the patch ciscocm.CSCwr21851_Remote_Code_Execution_v1; Release 12.5 customers must migrate to a fixed release. Source: [Cisco Unified Communications Products Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b), Fixed Software table. Checked 2026-09-30. [^79]: LDAP directory synchronization is a mandatory prerequisite for enabling SAML SSO on Unified CM, and the SSO test must be run with an LDAP-synchronized user. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites, Directory setup; Run SSO test step. Checked 2026-09-30. [^80]: Unified CM SAML SSO offers two modes: Cluster wide, which uses a single SAML agreement and one metadata file for the cluster, and Per Node, which uses separate metadata for each node. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), SAML SSO configuration, SSO Mode. Checked 2026-09-30. [^81]: For SAML SSO, the clock difference between the IdP and the Unified Communications applications can be at most 3 seconds. Source: [SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/SAML_SSO_deployment_guide/15/cucm_b_saml-sso-deployment-guide-release-15/cucm_m_saml-sso-configuration-1251.html), Prerequisites, NTP setup. Checked 2026-09-30. [^82]: A Unified CM partition is a logical group of route patterns, directory numbers, translation patterns, transformation patterns, URIs and hunt pilots that divides the route plan into logical subsets. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Partitions](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010000.html), Configure Partitions, Partitions Overview. Checked 2026-09-30. [^83]: A calling search space is a prioritized list of partitions. A caller can reach a destination only if the destination's partition is in the caller's calling search space. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Partitions](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_010000.html), Configure Partitions, Calling Search Spaces overview. Checked 2026-09-30.