# Troubleshooting Cisco Finesse agent sign-in Canonical: https://warmtransfer.net/knowledge/finesse-login-troubleshooting Last verified: 2026-10-02 Agents reach the Finesse desktop at https://:8445/desktop[^18]. The Finesse User sign-in request requires the user id, a state of LOGIN and the extension the user wants to sign in with[^40]. ## Reaching the desktop and console The Finesse administration console is reached only over HTTPS at https://:8445/cfadmin[^3]. The hostname in the Finesse URL must match the certificate Common Name to avoid an address mismatch error, so agents should use the FQDN rather than an IP address[^9]. If the self-signed certificate Common Name does not match the server hostname, the certificate must be regenerated so they match[^10]. With the default self-signed certificates, agents must accept the security certificates the first time they sign in to the Finesse desktop[^38]. Finesse does not support wildcard certificates[^32]. Updating the Finesse tomcat-trust certificate causes a temporary outage because it affects the Cisco Finesse Notification Service[^48]. Popup blockers must be disabled in supported browsers for all Finesse desktop features to work properly[^20]. ## Sign-in errors returned by Finesse | Error | Returned when | |---|---| | Invalid Device | The agent signs in with a device that does not exist or is offline[^25]. | | Invalid Device | The agent signs in with a multiline device that lacks the correct Unified CM maximum calls and busy trigger configuration[^24]. | | Invalid Device | On Unified CCX, the sign-in extension is not associated with the Unified CCX Resource Manager provider[^26]. | | Device Busy | The agent attempts to sign in with a device that is already in use[^19]. | | Parameter Missing | Several devices share the sign-in extension with shared ACD line usage enabled and the request omits activeDeviceId[^34]. | | Invalid Input | On Unified CCE, activeDeviceId is used with a CTI protocol version lower than 24[^1]. | | User Not Found | The agent ID is invalid or the agent record is not part of the CTI configuration[^59]. | WarmTransfer's reading of the sources is that an "agent already signed in" symptom most plausibly corresponds to the Device Busy error[^22]. If sign-in fails because of device errors, the Finesse desktop automatically retries sign-in and shows an alert with the remaining retries and time to the next attempt[^5]. ## Extension format With Unified CCE, Finesse does not support agent sign-in with an E.164 extension[^49]. With Unified CCX, Finesse supports E.164 sign-in extensions up to a maximum of 15 characters[^51]. ## Account lockout 5 consecutive wrong-password sign-in attempts block a Finesse agent or supervisor account for 5 minutes[^4]. While a Finesse agent or supervisor account is locked, further sign-in attempts reset the lockout period to 5 minutes, even when the credentials are correct[^30]. Finesse administrator accounts are locked for 30 minutes after 5 failed sign-in attempts[^2]. ## Unified CCX device configuration The UCCX JTAPI component does not support shared lines, so an agent's IPCC extension must not be shared or in a line group[^55]. UCCX JTAPI monitors only the first 4 lines on a phone, so the IPCC extension must be on lines 1 to 4[^53]. For UCCX agent sign-in, Maximum Number of Calls and Busy Trigger on the agent line should be set to 2 and 1 respectively[^54]. UCCX agent sign-in requires Allow Control of Device from CTI to be enabled on the phone, end user and directory number in Unified CM[^50]. Missing CTI roles such as Standard CTI Enabled on the UCCX RMCM application user cause agent sign-in failures[^57]. On UCCX Finesse 11.5 and earlier, the device-configuration sign-in error reads that the device for the extension is invalid[^52]. From 11.6, the same error tells the user that the device is not accessible and to contact the system administrator[^52]. On Unified CCX, Finesse configuration changes are allowed only on the primary server, and the administration console on the secondary server is read-only[^58]. On affected UCCX releases, Finesse can fail to sign in agents with "cannot authenticate with the notification service" after PG failover[^56]. The workaround is to restart the Notification Service and Tomcat, and the fixes are defects CSCvc94546 and CSCvb19751[^56]. ## Single sign-on on Unified CCE Unified CCE supports 3 authentication modes for Finesse users: SSO for all agents, hybrid with agents enabled selectively, and non-SSO[^46]. In hybrid mode, agents are enabled individually for SSO in the Unified CCE Administration Agent tool[^42]. When SSO is enabled, the certificates of all Cisco IdS nodes must be imported into the Finesse trust store[^43]. Cisco IdS and the IdP must be time-synchronised, preferably via NTP, for SSO to work[^44]. The Cisco IdS token mechanism changed in 12.6(2), so agents must sign out and back in to the Finesse desktop after Cisco IdS is upgraded[^45]. WarmTransfer's reading of the sources is that Finesse sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS/IdP clock skew, or agents not signing in again after an IdS upgrade[^23]. See also [Setting up single sign-on for UCCE and Finesse with Cisco Identity Service](https://warmtransfer.net/knowledge/ucce-sso-setup). ## Server-side failures and failover Finesse treats the CTI connection as lost when it misses 3 consecutive heartbeats at a 5-second interval or when the CTI socket fails[^14]. During CTI failover, Finesse is OUT_OF_SERVICE, does not process client requests or send events, and answers any request with 503 Service Unavailable[^12]. When Finesse loses its CTI server connection, it sends a SystemInfo notification with status OUT_OF_SERVICE to desktops still connected to the Notification Service[^15]. When Finesse Tomcat or the web application is down, the "finesse" user presence becomes UNAVAILABLE for desktops still connected to the Notification Service[^47]. With Agent PG 12.5(1) or later, CTI server or Agent PG failover takes roughly 35 to 75 seconds[^13]. See also [Troubleshooting UCCE peripheral gateways and CTI Server going offline](https://warmtransfer.net/knowledge/ucce-peripheral-gateway-troubleshooting). On Unified CCE, Finesse caches the agent's credentials for 30 minutes after a successful API request such as sign-in, so authentication can continue during an AWDB outage[^6]. If the primary AWDB is unreachable, Finesse tries the secondary AWDB and repeats this for every API request until it connects[^7]. ## Desktop failover behaviour Finesse desktop failover is triggered by any of these events: loss of connectivity to the Notification Service, unavailability of Tomcat, the REST API or the Notification Service, or loss of the CTI connection[^17]. Desktop failover logic prefers the publisher: when it finds the subscriber available, it checks the publisher once more before switching[^21]. During desktop failover, the client polls SystemInfo on the publisher every 20 seconds[^35]. If the Notification Service is the source of failure, the desktop makes 3 reconnection attempts before changing state[^33]. With the default layout, 2000 users and Agent PG 12.5(1), Finesse desktop failover takes roughly 50 to 110 seconds[^16]. If the browser crashes or is refreshed, Finesse waits 60 seconds before sending a forced logout request to the CTI server, which gives the browser time to reconnect[^11]. Finesse can take up to 120 seconds to detect that an agent has closed the browser[^8]. ## Service control and maintenance The Cisco Finesse Tomcat and Cisco Finesse Notification Service services are controlled with utils service start, stop and restart, and utils service list shows their state[^39]. Cisco notes that most service-related problems cannot be corrected by restarting a service[^36]. An administrator can move active Finesse nodes into maintenance mode with utils finesse maintenance initiate, and desktops reload in about 5 to 15 seconds per agent[^31]. ## Applicability Applies to: Cisco Finesse, Cisco Unified Contact Center Express, and Cisco Unified Contact Center Enterprise. Deployments: on-premises. Sources checked 2026-10-02. The CTI failover timing assumes Agent PG 12.5(1) or later[^13], and the desktop failover timing is documented for Agent PG 12.5(1)[^16]. The AWDB behaviour is specific to Unified CCE[^6][^7]. The UCCX error text differs between 11.5 and earlier and 11.6 and later[^52]. ## What remains uncertain This is inferred: no source documents a distinct "already signed in" desktop message, so its mapping to the Device Busy error is an inference rather than documented behaviour[^22]. We infer, rather than find documented, that sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS/IdP clock skew, or agents not signing in again after an IdS upgrade[^23]. Whether the agent and administrator lockout thresholds and durations can be configured is not covered by the sources below. The exact UCCX releases affected by the notification-service authentication defect are identified only by defect IDs CSCvc94546 and CSCvb19751[^56]. Unified CM line-position and shared-line requirements for Unified CCE agents are not covered by the sources below. ## Sources [^1]: On Unified CCE, using activeDeviceId with a CTI protocol version lower than 24 returns Invalid Input. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Invalid Input (Unified CCE only). Checked 2026-10-02. [^2]: Finesse administrator accounts are locked for 30 minutes after five failed sign-in attempts. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, account lockout section. Checked 2026-10-02. [^3]: The Finesse administration console is reached only over HTTPS at https://:8445/cfadmin. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, Sign In to the Administration Console. Checked 2026-10-02. [^4]: Five consecutive wrong-password sign-in attempts block a Finesse agent or supervisor account for five minutes. Source: [Cisco Finesse Agent and Supervisor Desktop User Guide, Release 15.0(1) - Common Tasks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/user/guide/cfin_b_1501_cisco-desktop-user-guide/cfin_m_1501_common-tasks.html), Sign In to Finesse Desktop, account lockout note. Checked 2026-10-02. [^5]: If sign-in fails because of device errors, the Finesse desktop automatically retries sign-in and shows an alert with the remaining retries and time to the next attempt. Source: [Cisco Finesse Agent and Supervisor Desktop User Guide, Release 15.0(1) - Common Tasks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/user/guide/cfin_b_1501_cisco-desktop-user-guide/cfin_m_1501_common-tasks.html), Sign In to Finesse Desktop, automatic sign-in retry note. Checked 2026-10-02. [^6]: After a successful API request such as sign-in, Finesse caches the agent's credentials for 30 minutes, which lets authentication continue during an AWDB outage. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), AWDB Failover section. Checked 2026-10-02. [^7]: If the primary AWDB is unreachable, Finesse tries the secondary AWDB and repeats this for every API request until it connects. Source: [Cisco Finesse Administration Guide, Release 12.6(2) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1262/admin/guide/cfin_b_1262_cisco-finesse-administration-guide/cfin_m_1261-cisco-finesse-failover-mechanisms.html), AWDB Failover section. Checked 2026-10-02. [^8]: Finesse can take up to 120 seconds to detect that an agent has closed the browser. Source: [Cisco Finesse Administration Guide, Release 12.6(2) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1262/admin/guide/cfin_b_1262_cisco-finesse-administration-guide/cfin_m_1261-cisco-finesse-failover-mechanisms.html), Desktop Behavior, browser close. Checked 2026-10-02. [^9]: The hostname in the Finesse URL must match the certificate Common Name to avoid an address mismatch error, so agents should use the FQDN rather than an IP address. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, certificate note under Sign In to the Administration Console. Checked 2026-10-02. [^10]: If the self-signed certificate Common Name does not match the server hostname, the certificate must be regenerated so they match. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, certificate note. Checked 2026-10-02. [^11]: If the browser crashes or is refreshed, Finesse waits 60 seconds before sending a forced logout request to the CTI server, allowing the browser to reconnect. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Desktop Behavior, browser crash and refresh. Checked 2026-10-02. [^12]: During CTI failover Finesse is OUT_OF_SERVICE, does not process client requests or send events, and answers any request with 503 Service Unavailable. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), CTI Failover section. Checked 2026-10-02. [^13]: With Agent PG 12.5(1) or later, CTI server or Agent PG failover takes roughly 35 to 75 seconds. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Failover timings, CTI server failover. Checked 2026-10-02. [^14]: Finesse treats the CTI connection as lost when it misses three consecutive heartbeats (five-second interval) or the CTI socket fails. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), CTI Failover section. Checked 2026-10-02. [^15]: When Finesse loses its CTI server connection it sends a SystemInfo notification with status OUT_OF_SERVICE to desktops still connected to the Notification Service. Source: [Failure Scenarios](https://developer.cisco.com/docs/finesse/failure-scenarios/), Failure Scenarios, CTI server connection lost. Checked 2026-10-02. [^16]: With the default layout, 2000 users and Agent PG 12.5(1), Finesse desktop failover takes roughly 50 to 110 seconds. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Failover timings, desktop failover. Checked 2026-10-02. [^17]: Finesse desktop failover is triggered by loss of connectivity to the Notification Service, unavailability of Tomcat, the REST API or the Notification Service, or loss of the CTI connection. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Desktop Behavior / desktop failover triggers list. Checked 2026-10-02. [^18]: Agents reach the Finesse desktop at https://:8445/desktop. Source: [Cisco Finesse Agent and Supervisor Desktop User Guide, Release 15.0(1) - Common Tasks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/user/guide/cfin_b_1501_cisco-desktop-user-guide/cfin_m_1501_common-tasks.html), Sign In to Finesse Desktop, step specifying the URL. Checked 2026-10-02. [^19]: Finesse returns the Device Busy error when an agent attempts to sign in with a device that is already in use. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Device Busy. Checked 2026-10-02. [^20]: Popup blockers must be disabled in supported browsers for all Finesse desktop features to work properly. Source: [Cisco Finesse Agent and Supervisor Desktop User Guide, Release 15.0(1) - Common Tasks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/user/guide/cfin_b_1501_cisco-desktop-user-guide/cfin_m_1501_common-tasks.html), Common Tasks, browser note (popup blockers). Checked 2026-10-02. [^21]: Desktop failover logic prefers the publisher: on finding the subscriber available it checks the publisher once more before switching. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Desktop failover, server selection logic. Checked 2026-10-02. [^22]: The 'agent already signed in' symptom most plausibly corresponds to the Finesse Device Busy error (device already in use); no source in this packet documents a distinct 'already signed in' desktop message (inferred). Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Device Busy (inference from). Checked 2026-10-02. [^23]: Finesse sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS/IdP clock skew, or agents not re-signing in after an IdS upgrade (inferred). Source: [Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html), Configure the Cisco Identity Service; Configuration Flow; prerequisites note (inference from). Checked 2026-10-02. [^24]: Finesse returns Invalid Device when an agent signs in with a multiline device that lacks the correct Unified CM maximum calls and busy trigger configuration. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Invalid Device. Checked 2026-10-02. [^25]: Finesse returns the Invalid Device error when an agent tries to sign in with a device that does not exist or is offline. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Invalid Device. Checked 2026-10-02. [^26]: On Unified CCX, Finesse returns Invalid Device when the sign-in extension is not associated with the Unified CCX Resource Manager provider. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Invalid Device (Unified CCX row). Checked 2026-10-02. [^27]: The CLI command utils finesse locked_out_users list shows users currently locked out of Finesse. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse CLI](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-cli.html), Cisco Finesse CLI, utils finesse locked_out_users list. Checked 2026-10-02. [^28]: Agent lockout can be disabled with the CLI command utils finesse set_property webservices enableAgentLockout false. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, account lockout section. Checked 2026-10-02. [^29]: Finesse account lockout applies to Finesse local authentication; for SSO users lockout behaviour is governed by the identity provider. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, account lockout section (note on authentication modes). Checked 2026-10-02. [^30]: While a Finesse agent or supervisor account is locked, further sign-in attempts, even with correct credentials, reset the lockout period to five minutes. Source: [Cisco Unified Contact Center Express Administration and Operations Guide, Release 15.0 - Cisco Finesse](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/crs/express_15_0/maintain_and_operate/guide/uccx_b_1501_admin-and-operations-guide/uccx_m_1501_cisco-finesse.html), Cisco Finesse chapter, account lockout note. Checked 2026-10-02. [^31]: An administrator can move active Finesse nodes into maintenance mode with utils finesse maintenance initiate, and desktops reload in about 5 to 15 seconds per agent. Source: [Cisco Finesse Administration Guide, Release 12.6(2) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1262/admin/guide/cfin_b_1262_cisco-finesse-administration-guide/cfin_m_1261-cisco-finesse-failover-mechanisms.html), Finesse Maintenance Mode section. Checked 2026-10-02. [^32]: Finesse does not support wildcard certificates. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, CA certificate note. Checked 2026-10-02. [^33]: If the Notification Service is the source of failure, the desktop makes three reconnection attempts before changing state. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Desktop failover, Notification Service reconnection. Checked 2026-10-02. [^34]: Finesse returns Parameter Missing when several devices share the sign-in extension with shared ACD line usage enabled and the request omits activeDeviceId. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType Parameter Missing. Checked 2026-10-02. [^35]: During desktop failover the client polls SystemInfo on the publisher every 20 seconds. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse Failover Mechanisms](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-failover-mechanisms.html), Desktop failover, polling logic. Checked 2026-10-02. [^36]: Cisco notes that most service-related problems cannot be corrected by restarting a service. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse CLI](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-cli.html), Cisco Finesse CLI, Services section note. Checked 2026-10-02. [^37]: Desktop sign-in retry is controlled by the desktop properties enableRetryLoginFeature, loginFailureRetryAttempts (default 3, max 10) and loginFailureRetryInterval (default 60 s, range 15-180 s). Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse CLI](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-cli.html), Cisco Finesse CLI, desktop properties (utils finesse set_property desktop). Checked 2026-10-02. [^38]: With the default self-signed certificates, agents must accept the security certificates the first time they sign in to the Finesse desktop. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, certificates section. Checked 2026-10-02. [^39]: The Cisco Finesse Tomcat and Cisco Finesse Notification Service services are controlled with utils service start, stop and restart, and utils service list shows their state. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse CLI](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-cli.html), Cisco Finesse CLI, Services section. Checked 2026-10-02. [^40]: The Finesse User sign-in request requires the user id, a state of LOGIN and the extension the user wants to sign in with. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Parameters table (id; state; extension). Checked 2026-10-02. [^41]: In SSO mode the agent enters a username, is redirected to the IdP, and then enters the extension on the Finesse sign-in page. Source: [Cisco Finesse Agent and Supervisor Desktop User Guide, Release 15.0(1) - Common Tasks](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/user/guide/cfin_b_1501_cisco-desktop-user-guide/cfin_m_1501_common-tasks.html), Sign In to Finesse Desktop in SSO mode. Checked 2026-10-02. [^42]: In hybrid mode, agents are enabled individually for SSO in the Unified CCE Administration Agent tool. Source: [Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html), Single Sign-On and the Agent Tool. Checked 2026-10-02. [^43]: When SSO is enabled, the certificates of all Cisco IdS nodes must be imported into the Finesse trust store. Source: [Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html), Configure the Cisco Identity Service. Checked 2026-10-02. [^44]: Cisco IdS and the IdP must be time-synchronised, preferably via NTP, for SSO to work. Source: [Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html), Cisco Identity Service for Single Sign-On Configuration Flow. Checked 2026-10-02. [^45]: Because the Cisco IdS token mechanism changed in 12.6(2), agents must sign out and back in to the Finesse desktop after Cisco IdS is upgraded. Source: [Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html), Cisco Identity Service for Single Sign-On, prerequisites note. Checked 2026-10-02. [^46]: Unified CCE supports three authentication modes for Finesse users: SSO for all agents, hybrid with agents enabled selectively, and non-SSO. Source: [Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html), Cisco Identity Service for Single Sign-On, SSO modes. Checked 2026-10-02. [^47]: When Finesse Tomcat or the web application is down, the 'finesse' user presence becomes UNAVAILABLE for desktops still connected to the Notification Service. Source: [Failure Scenarios](https://developer.cisco.com/docs/finesse/failure-scenarios/), Failure Scenarios, Tomcat server down; Web application down. Checked 2026-10-02. [^48]: Updating the Finesse tomcat-trust certificate causes a temporary outage because it affects the Cisco Finesse Notification Service. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_getting-started.html), Getting Started, certificate update note. Checked 2026-10-02. [^49]: With Unified CCE, Finesse does not support agent sign-in with an E.164 extension. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Notes under Parameters (extension), Unified CCE. Checked 2026-10-02. [^50]: UCCX agent sign-in requires Allow Control of Device from CTI to be enabled on the phone, end user and directory number in Unified CM. Source: [Troubleshoot Agent Log in Issues](https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/210485-uccx-agent-login-issues.html), Problem 1, cause 7 (CTI control). Checked 2026-10-02. [^51]: With Unified CCX, Finesse supports E.164 sign-in extensions up to a maximum of 15 characters. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Notes under Parameters (extension), Unified CCX. Checked 2026-10-02. [^52]: On UCCX Finesse 11.5 and earlier the device-configuration sign-in error reads that the device for the extension is invalid; from 11.6 it reads 'Device not accessible. Contact your system administrator.'. Source: [Troubleshoot Agent Log in Issues](https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/210485-uccx-agent-login-issues.html), Problem 2 and Problem 3 symptom statements. Checked 2026-10-02. [^53]: UCCX JTAPI monitors only the first four lines on a phone, so the IPCC extension must be on lines 1 to 4. Source: [Troubleshoot Agent Log in Issues](https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/210485-uccx-agent-login-issues.html), Problem 1, cause 4 (line position). Checked 2026-10-02. [^54]: For UCCX agent sign-in, Maximum Number of Calls and Busy Trigger on the agent line should be set to 2 and 1 respectively. Source: [Troubleshoot Agent Log in Issues](https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/210485-uccx-agent-login-issues.html), Problem 1, cause 6 (call settings). Checked 2026-10-02. [^55]: The UCCX JTAPI component does not support shared lines, so an agent's IPCC extension must not be shared or in a line group. Source: [Troubleshoot Agent Log in Issues](https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/210485-uccx-agent-login-issues.html), Problem 1, causes 1 and 2. Checked 2026-10-02. [^56]: On affected UCCX releases, Finesse can fail to sign in agents with 'cannot authenticate with the notification service' after PG failover; restarting Notification Service and Tomcat is the workaround and the fix is defects CSCvc94546 and CSCvb19751. Source: [Troubleshoot Common UCCX Finesse and CUIC Issues](https://www.cisco.com/c/en/us/support/docs/contact-center/unified-contact-center-express/217512-troubleshoot-common-uccx-finesse-and-cui.html), Problem: Authentication Failure of Finesse Notification Service after PG Failover. Checked 2026-10-02. [^57]: Missing CTI roles such as Standard CTI Enabled on the UCCX RMCM application user cause agent sign-in failures. Source: [Troubleshoot Agent Log in Issues](https://www.cisco.com/c/en/us/support/docs/customer-collaboration/unified-contact-center-express/210485-uccx-agent-login-issues.html), Problem 1, cause 5 (CTI permissions). Checked 2026-10-02. [^58]: On Unified CCX, Finesse configuration changes are allowed only on the primary server; the administration console on the secondary server is read-only. Source: [Cisco Unified Contact Center Express Administration and Operations Guide, Release 15.0 - Cisco Finesse](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/crs/express_15_0/maintain_and_operate/guide/uccx_b_1501_admin-and-operations-guide/uccx_m_1501_cisco-finesse.html), Cisco Finesse chapter, administration console note. Checked 2026-10-02. [^59]: Finesse returns User Not Found when the agent ID is invalid or the agent record is not part of the CTI configuration. Source: [User—Sign In to Finesse](https://developer.cisco.com/docs/finesse/user%E2%80%94sign-in-to-finesse/), Possible Errors table, ErrorType User Not Found. Checked 2026-10-02. [^60]: The CLI command utils webproxy cache clear (options include all, desktop, rest, shindig and authmode) clears cached Finesse static resources, which otherwise persist until Tomcat restarts. Source: [Cisco Finesse Administration Guide, Release 15.0(1) - Cisco Finesse CLI](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/finesse/finesse_1501/admin/guide/cfin_b_150_cisco-finesse-administration-guide/cfin_m_150_cisco-finesse-cli.html), Cisco Finesse CLI, webproxy cache commands. Checked 2026-10-02.