# Identity SSO and directory provisioning for UC Canonical: https://warmtransfer.net/knowledge/identity-sso-provisioning Last verified: 2026-09-24 Unified communications platforms require established user identities and directory synchronisation before voice services and single sign-on can function[^58][^39]. In Webex and Microsoft Teams environments, directory integrations manage user lifecycles, service entitlement, and authentication across cloud and hybrid topologies[^41][^9]. ## Entra ID Provisioning for Webex Setting up the Entra ID Wizard App in Control Hub requires the Full Administrator role in the Control Hub organisation[^48]. The setup also requires an Entra ID account with authority to grant tenant-wide admin consent to an application[^47]. The Entra ID Wizard App synchronises users in Entra ID groups as well as group objects, and it can optionally synchronise in-scope users' avatars to Webex[^53]. It manages only the users that were added to its synchronisation scope[^52]. By default, the Entra ID userPrincipalName attribute maps to the Webex userName, which serves as the user's primary identity in Webex[^54]. Users are typically synchronised every 40 minutes, a cadence Cisco attributes to Microsoft policy[^55]. Group objects are synchronised automatically every 12 hours[^49]. However, the Entra ID Wizard App cannot synchronise Entra ID distribution groups[^50]. Following a Wizard App synchronisation run, the Job status shows Active on success, or Quarantine when Entra ID has quarantined the job after multiple failures[^51]. When a synchronised user is deleted in Entra ID and moved to the recycle bin, Webex renames the user and marks the account Inactive[^11]. A user permanently deleted from Entra ID after the 30-day recycle-bin period is removed entirely from the Webex organisation[^13]. Synchronised users who are blocked from signing in to Entra ID or removed from the Webex app assignment are marked Inactive in Webex rather than deleted[^10]. If Entra ID synchronisation is disabled, users and groups that were previously synchronised become manageable directly within Control Hub[^46]. ## SCIM Protocol Standards and Custom Applications At the protocol level, RFC 7644 defines resource creation via POST (section 3.3), filtering (3.4.2.2), PATCH modification (3.5.2), bulk operations (3.7), the /Me alias (3.11), and service provider discovery via /ServiceProviderConfig, /ResourceTypes, and /Schemas (section 4)[^31]. Cisco labels provisioning through the prebuilt Cisco Webex Entra ID gallery app as legacy because it uses the older SCIM 1.1 protocol, pointing administrators to a custom SCIM 2.0 Entra app instead[^14]. The legacy gallery app uses a Tenant URL of the form `https://api.ciscospark.com/v1/scim/{OrgId}`, where OrgId is the Control Hub organisation ID[^17]. A bearer token obtained through the manual OAuth flow for this gallery app remains valid for 365 days[^18]. Configuring the Cisco Webex provisioning connector requires the Entra Application Administrator, Cloud Application Administrator, or Application Owner role, alongside a Webex account with admin permissions[^22]. Microsoft Learn describes the Cisco Webex provisioning connector as currently in Preview, and its limitations section notes that Cisco Webex is in Cisco's Early Field Testing phase[^20]. In this automatic provisioning setup, only assigned users and groups are synchronised, and users assigned with the Default Access role are excluded from provisioning[^21]. In the Microsoft connector user attribute mapping, userName is the only attribute that Cisco Webex requires and the only one marked as supported for filtering (matching)[^26]. Microsoft lists the connector as available in the Entra global service and US Government clouds, but not in China operated by 21Vianet[^23]. Group provisioning support is disputed: Microsoft's provisioning connector documentation lists provisioning of groups and group memberships as a supported capability, stating that group provisioning was added on 02/07/2023[^16]. For custom integrations, the SCIM 2.0 Webex app in Entra ID uses a Tenant URL of the form `https://webexapis.com/identity/scim/{OrgId}/v2`, or `https://api-usgov.webex.com/identity/scim/{OrgId}/v2` for Webex for Government[^33]. Entra ID does not synchronise null values to Webex; setting an attribute to NULL in Entra ID does not delete or patch the corresponding attribute in Webex[^12]. ## Single Sign-On Architecture and SAML 2.0 Before SAML SSO is configured in Control Hub, the Webex users must already exist, having been created locally or synchronised from an identity directory[^39]. Identity providers integrated with Control Hub SSO must conform to the SAML 2.0 specification, with Webex acting as the service provider (SP)[^36]. Sources disagree regarding supported initiation flows: Cisco guidance states that only Service Provider-initiated flows are supported and that SSO must not be tested from the IdP interface[^37], whereas Microsoft's Entra SSO tutorial for Cisco Webex Meetings states that the application supports both SP-initiated and IdP-initiated SSO, as well as just-in-time user provisioning[^24]. Control Hub SSO with Entra ID accepts SAML NameID formats transient (SAML 2.0), unspecified (SAML 1.1), and emailAddress (SAML 1.1)[^35]. The SAML assertion presented to Webex must include a uid attribute that matches an existing Webex user[^38]. Microsoft's Webex Meetings SSO tutorial maps both the SAML uid claim and email to the Entra source attribute user.mail[^25]. When downloading Webex SP metadata, Cisco recommends the self-signed certificate option, which requires renewal once every 5 years; a public-CA-signed certificate option requires frequent metadata updates unless the IdP supports trust anchors[^34]. Webex multi-IdP SSO configurations route users to specific identity providers through routing rules defined by domain or group membership[^30]. The first IdP configured automatically receives the Default routing rule; this default rule cannot be deactivated or deleted, though its target IdP can be modified[^28]. Multi-IdP configuration supports SAML, OpenID Connect, and Webex Identity as identity provider types, and requires the Full Admin role in Control Hub[^29]. ## On-Premises Directory Connector and Calling Lifecycles Cisco Directory Connector provides on-premises Active Directory synchronisation and is supported on Windows Server 2025, 2022, 2019, and 2016, requiring.NET Framework 4.5 for TLS 1.2 support[^7]. A separate Directory Connector instance is required for each Active Directory domain, and each instance must run on a host located within the domain it synchronises[^3]. The default incremental synchronisation interval is 30 minutes on versions 3.4 and earlier, and 4 hours on versions 3.5 and later[^1]. The latest release listed in Cisco's release notes (updated 2025-03-13) is 3.8.7000, dated April 4, 2024, which introduced an option to exclude an organizational unit from synchronisation[^2]. In Directory Connector attribute mapping, the only required field is uid, which is typically mapped to mail or userPrincipalName in email format[^6]. Users deleted through Directory Connector are retained in the Webex cloud identity service under a soft-delete state for 7 days before permanent deletion[^4]. Cisco recommends integrating the organisation's IdP for SSO if new Directory Connector-synchronised Webex App accounts need to be Active before users sign in for the first time[^5]. Voice provisioning introduces specific dial plan and licensing requirements across calling platforms:[^56][^59][^40] - **Webex Calling routing prefixes**: Cisco warns that if user extensions synchronised from Active Directory via Directory Connector already include the location routing prefix, Webex Calling appends the routing prefix again, producing duplicated prefixes[^59]. - **Webex Calling automatic licence assignment**: Automatic licensing templates require that a user is assigned to a location and provisioned with an extension, a telephone number, or both[^56]. For directory-synchronised users (Active Directory, Azure/Entra, Okta), auto-provisioning matches the directory work phone number against pre-provisioned numbers in Webex Calling and assigns that number's location[^57]. - **Dedicated Instance provisioning**: For Webex Calling Dedicated Instance, Unified CM and Unity Connection users can be synchronised from Webex Common Identity after accounts are first populated in Control Hub via Directory Connector or Entra ID[^9]. This synchronisation does not work with LDAP authentication because passwords are not synchronised, making SSO mandatory[^8]. Furthermore, all Unified CM end users must already be provisioned as Webex users before migration tasks run[^58]. - **Microsoft Teams Direct Routing**: Microsoft defines sequential steps to enable a user for Direct Routing: create the user in Microsoft 365 and assign a Teams Phone licence, confirm the user is homed online, configure the phone number and enable enterprise voice, configure direct-to-voicemail, and assign Teams Only mode[^40]. Microsoft provides two creation paths (create in on-premises Active Directory and sync to cloud, or create directly in Microsoft 365 admin center) and recommends selecting only one path to prevent routing issues[^43]. For users migrating from Skype for Business Server, a populated OnPremLineUri indicates the number was assigned on-premises; this attribute must be cleared on-premises and synchronised before the number can be managed online[^44]. - **Microsoft Teams licensing and identity**: Teams accounts are inherited from and synchronised with Microsoft 365, where account creation and licence assignment require the Microsoft 365 User admin role[^41]. Any Teams user requiring an individual telephone number must be licensed for both Microsoft Teams and Microsoft 365 Phone System; a Microsoft 365 E5 licence removes the requirement for a separate Teams Phone Standard licence[^42]. WarmTransfer's reading of the sources is that Webex Agentic MCP server connection scopes match those catalogued across platform meetings, workspaces, and contact centre services[^60]. ## See also - See also [CUCM to Webex Calling migration](https://warmtransfer.net/knowledge/cucm-to-webex-calling). - See also [Microsoft Teams Phone architecture and licensing](https://warmtransfer.net/knowledge/teams-phone-architecture). - See also [Webex published MCP servers for external AI clients](https://warmtransfer.net/knowledge/webex-mcp-servers). ## Applicability Applies to: Cisco Webex Calling, Cisco Webex, Cisco Webex Control Hub, Microsoft Entra ID provisioning (Cisco Webex connector), Microsoft Entra ID SSO (Cisco Webex Meetings gallery app), Cisco Webex Directory Connector, Cisco Webex Calling Dedicated Instance, Microsoft Teams Phone, and IETF SCIM 2.0. Deployments: cloud, hybrid, multi-tenant, dedicated instance, any, and on-premises-connector. Sources checked 2026-09-24. Directory Connector version 3.8.7000 is verified as the latest release listed in documentation updated 2025-03-13[^2]. Directory Connector is supported on Windows Server 2016, 2019, 2022, and 2025[^7]. The Cisco Webex provisioning connector is available in Microsoft Entra global service and US Government clouds, but is excluded from China operated by 21Vianet[^23]. Custom SCIM 2.0 endpoints are available for Webex and Webex for Government[^33]. ## What remains uncertain Entra Connect / cloud sync and hybrid identity prerequisites for Teams Phone voice users are not covered by the sources below. On-premises CUCM LDAP directory sync and LDAP authentication as the pre-migration baseline are not covered by the sources below. Which directory attributes (work phone / extension / location) land in Webex Calling via Wizard App or Directory Connector are not covered by the sources below. OAuth integration and service-app identity for Webex MCP servers resolving against Webex identity are not covered by the sources below. Webex SCIM 2 Users/Groups/Bulk API reference: scopes / roles / rate limits / Cisco extension schemas are not covered by the sources below. Configuring OpenID Connect IdPs in Webex multi-IdP SSO (PKCE / session sign-out options) is not covered by the sources below. Entra ID Wizard App scale limits (max users / groups in scope) and child-group constraints are not covered by the sources below. Group-based auto-licence template mapping for Entra ID Wizard App groups vs Directory Connector groups is not covered by the sources below. ## Sources [^1]: Directory Connector's default incremental synchronization interval is 30 minutes on versions 3.4 and earlier and 4 hours on versions 3.5 and later. Source: [Deployment Guide for Directory Connector](https://help.webex.com/en-us/article/zqvufbb/Deployment-Guide-for-Directory-Connector), Synchronization schedule section. Checked 2026-09-24. [^2]: The latest release listed in Cisco's Directory Connector release notes (page updated 2025-03-13) is 3.8.7000, dated April 4, 2024, which added an option to exclude an organizational unit from synchronization. Source: [Directory Connector release notes](https://help.webex.com/en-us/article/nqvsbmq/Directory-Connector-release-notes), Release 3.8.7000 entry. Checked 2026-09-24. [^3]: Directory Connector needs a separate instance for each Active Directory domain, and each instance must run on a host in the domain it synchronizes. Source: [Deployment Guide for Directory Connector](https://help.webex.com/en-us/article/zqvufbb/Deployment-Guide-for-Directory-Connector), Multiple domain synchronization requirements. Checked 2026-09-24. [^4]: Users deleted through Directory Connector are kept in the Webex cloud identity service for 7 days before they are permanently deleted. Source: [Deployment Guide for Directory Connector](https://help.webex.com/en-us/article/zqvufbb/Deployment-Guide-for-Directory-Connector), Soft delete / user deletion section. Checked 2026-09-24. [^5]: Cisco recommends integrating the organization's IdP for SSO if new Directory Connector-synced Webex App accounts should be Active before users sign in for the first time. Source: [Deployment Guide for Directory Connector](https://help.webex.com/en-us/article/zqvufbb/Deployment-Guide-for-Directory-Connector), Optional pre-deployment recommendations. Checked 2026-09-24. [^6]: In Directory Connector attribute mapping the only required field is uid, which is typically mapped to mail or userPrincipalName in email format. Source: [Deployment Guide for Directory Connector](https://help.webex.com/en-us/article/zqvufbb/Deployment-Guide-for-Directory-Connector), Attribute mapping section. Checked 2026-09-24. [^7]: Directory Connector is supported on Windows Server 2025, 2022, 2019 and 2016, and needs .NET Framework 4.5 for TLS 1.2 support. Source: [Deployment Guide for Directory Connector](https://help.webex.com/en-us/article/zqvufbb/Deployment-Guide-for-Directory-Connector), Requirements for Directory Connector. Checked 2026-09-24. [^8]: Dedicated Instance directory provisioning from Webex Common Identity does not work with LDAP authentication because passwords are not synchronized; SSO is required instead. Source: [Directory service integration through Webex Common Identity for Dedicated Instance](https://help.webex.com/en-us/article/nwuq22o/Directory-service-integration-through-Webex-Common-Identity-for-DedicatedInstance), Limitations. Checked 2026-09-24. [^9]: For Webex Calling Dedicated Instance, Unified CM and Unity Connection users can be synchronized from Webex Common Identity, after users are first populated in Control Hub through Directory Connector or Entra ID (Azure AD) integration. Source: [Directory service integration through Webex Common Identity for Dedicated Instance](https://help.webex.com/en-us/article/nwuq22o/Directory-service-integration-through-Webex-Common-Identity-for-DedicatedInstance), Overview and prerequisites. Checked 2026-09-24. [^10]: A synchronized user who is blocked from signing in to Entra ID, or removed from the Webex app assignment, is marked Inactive in Webex rather than deleted. Source: [Manage synchronized Entra ID users](https://help.webex.com/en-us/article/d3p9vfb/Manage-synchronized-Entra-ID-users), User lifecycle / blocked and unassigned users. Checked 2026-09-24. [^11]: When a synchronized user is deleted in Entra ID (moved to the recycle bin), Webex renames the user and marks the user Inactive. Source: [Manage synchronized Entra ID users](https://help.webex.com/en-us/article/d3p9vfb/Manage-synchronized-Entra-ID-users), User lifecycle / deleted users section. Checked 2026-09-24. [^12]: Entra ID does not synchronize null values to Webex, so setting an attribute to NULL in Entra ID does not delete or patch it in Webex. Source: [SCIM 2.0 provisioning with a custom Webex app in Entra ID](https://help.webex.com/3211gv/), Limitations / known issues. Checked 2026-09-24. [^13]: A user permanently deleted from Entra ID after the 30-day recycle-bin period is removed from the Webex organization. Source: [Manage synchronized Entra ID users](https://help.webex.com/en-us/article/d3p9vfb/Manage-synchronized-Entra-ID-users), User lifecycle / permanently deleted users. Checked 2026-09-24. [^14]: Cisco labels provisioning through the prebuilt Cisco Webex Entra ID gallery app as legacy because it uses the older SCIM 1.1 protocol, and points to a custom SCIM 2.0 Entra app instead. Source: [Legacy SCIM provisioning with the Cisco Webex Entra ID gallery app](https://help.webex.com/en-us/article/6ta3gz/Legacy-SCIM-provisioning-with-the-Cisco-Webex-Entra-ID-gallery-app), Page title and introductory note. Checked 2026-09-24. [^15]: Cisco's comparison table states that the SCIM 1.1 gallery app synchronizes users but not groups or avatars (disputed). Source: [Legacy SCIM provisioning with the Cisco Webex Entra ID gallery app](https://help.webex.com/en-us/article/6ta3gz/Legacy-SCIM-provisioning-with-the-Cisco-Webex-Entra-ID-gallery-app), Supported objects comparison table (SCIM 1.1 column). Checked 2026-09-24. [^16]: Microsoft's Cisco Webex provisioning connector lists provisioning of groups and group memberships as a supported capability, with group provisioning added on 02/07/2023 per its change log (disputed). Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Capabilities supported; Change log. Checked 2026-09-24. [^17]: The legacy Cisco Webex gallery app uses a Tenant URL of the form https://api.ciscospark.com/v1/scim/{OrgId}, where OrgId is the Control Hub organization ID. Source: [Legacy SCIM provisioning with the Cisco Webex Entra ID gallery app](https://help.webex.com/en-us/article/6ta3gz/Legacy-SCIM-provisioning-with-the-Cisco-Webex-Entra-ID-gallery-app), Configure provisioning > Tenant URL. Checked 2026-09-24. [^18]: A bearer token obtained through the manual OAuth flow for the Webex gallery app is valid for 365 days. Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Configuring automatic user provisioning to Cisco Webex, step 7. Checked 2026-09-24. [^19]: The same Entra gallery connector is labelled Preview/EFT by Microsoft and legacy by Cisco, so at least one vendor page is probably stale; the Cisco label is the likelier current one (inferred). Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Connector limitations (EFT) compared with Cisco legacy article title. Checked 2026-09-24. [^20]: Microsoft Learn describes the Cisco Webex provisioning connector as currently in Preview, and its limitations section says Cisco Webex is in Cisco's Early Field Testing phase. Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Introductory note; Connector limitations. Checked 2026-09-24. [^21]: In Entra ID automatic provisioning to Cisco Webex, only assigned users and groups are synchronized, and users assigned with the Default Access role are excluded from provisioning. Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Assigning users to Cisco Webex > Important tips. Checked 2026-09-24. [^22]: Configuring the Cisco Webex provisioning connector requires the Entra Application Administrator, Cloud Application Administrator or Application Owner role, plus a Webex account with admin permissions. Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Prerequisites. Checked 2026-09-24. [^23]: Microsoft lists the Cisco Webex provisioning connector as available in the Entra global service and US Government clouds but not in China operated by 21Vianet. Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), National cloud deployments table. Checked 2026-09-24. [^24]: Microsoft's Entra SSO tutorial for Cisco Webex Meetings says the app supports both SP-initiated and IdP-initiated SSO, and just-in-time user provisioning (disputed). Source: [Configure Cisco Webex Meetings for Single sign-on with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-tutorial), Scenario description. Checked 2026-09-24. [^25]: Microsoft's Webex Meetings SSO tutorial maps the SAML uid claim (and email) to the Entra source attribute user.mail. Source: [Configure Cisco Webex Meetings for Single sign-on with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-tutorial), Configure Microsoft Entra SSO, step 7 claims table. Checked 2026-09-24. [^26]: In the Microsoft connector's user attribute mapping, userName is the only attribute that Cisco Webex requires, and the only one marked as supported for filtering (matching). Source: [Configure Cisco Webex for automatic user provisioning with Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/saas-apps/cisco-webex-provisioning-tutorial), Configuring automatic user provisioning, step 12 attribute table. Checked 2026-09-24. [^27]: If an organization uses Directory Connector, all users must be provisioned through Directory Connector when multi-IdP SSO is configured, and SAML JIT provisioning cannot remove users from groups or delete users. Source: [SSO with multiple IdPs in Webex](https://help.webex.com/en-us/article/ngp4sr8/SSO-with-multiple-IdPs-in-Webex), Limitations / JIT provisioning notes. Checked 2026-09-24. [^28]: The first IdP configured automatically gets the Default routing rule, which cannot be deactivated or deleted, although its routed IdP can be changed. Source: [SSO with multiple IdPs in Webex](https://help.webex.com/en-us/article/ngp4sr8/SSO-with-multiple-IdPs-in-Webex), Routing rules > Default rule. Checked 2026-09-24. [^29]: The Webex multi-IdP configuration supports SAML, OpenID Connect and Webex Identity as identity provider types, and requires the Full Admin role in Control Hub. Source: [SSO with multiple IdPs in Webex](https://help.webex.com/en-us/article/ngp4sr8/SSO-with-multiple-IdPs-in-Webex), Requirements / Add an IdP. Checked 2026-09-24. [^30]: Webex multi-IdP SSO routes users to identity providers through routing rules configured by domain or group membership. Source: [SSO with multiple IdPs in Webex](https://help.webex.com/en-us/article/ngp4sr8/SSO-with-multiple-IdPs-in-Webex), Routing rules section. Checked 2026-09-24. [^31]: RFC 7644 defines resource creation with POST (section 3.3), filtering (3.4.2.2), PATCH modification (3.5.2), bulk operations (3.7), the /Me alias (3.11), and service provider discovery via /ServiceProviderConfig, /ResourceTypes and /Schemas (section 4). Source: [System for Cross-domain Identity Management: Protocol (RFC 7644)](https://www.rfc-editor.org/rfc/rfc7644), Sections 3.3, 3.4.2.2, 3.5.2, 3.7, 3.11, 4. Checked 2026-09-24. [^32]: RFC 7644, the SCIM 2.0 protocol, is a Standards Track RFC published in September 2015; the RFC Editor lists it as updated by RFC 9865 and RFC 9967 and not obsoleted. Source: [System for Cross-domain Identity Management: Protocol (RFC 7644)](https://www.rfc-editor.org/rfc/rfc7644), RFC Editor info page for RFC 7644 (Status, Updated by fields). Checked 2026-09-24. [^33]: The custom SCIM 2.0 Webex app in Entra ID uses a Tenant URL of the form https://webexapis.com/identity/scim/{OrgId}/v2, or https://api-usgov.webex.com/identity/scim/{OrgId}/v2 for Webex for Government. Source: [SCIM 2.0 provisioning with a custom Webex app in Entra ID](https://help.webex.com/3211gv/), Configure provisioning > Tenant URL. Checked 2026-09-24. [^34]: When downloading Webex SP metadata, Cisco recommends the Cisco self-signed certificate option, which needs renewal once every five years; a public-CA-signed option needs frequent metadata updates unless the IdP supports trust anchors. Source: [Configure single sign-on in Control Hub with Microsoft Entra ID](https://help.webex.com/en-us/article/mfu88u/Configure-single-sign-on-in-Control-Hub-with-Microsoft-Entra-ID), Download the Webex metadata / certificate selection step. Checked 2026-09-24. [^35]: Control Hub SSO with Entra ID accepts SAML NameID formats transient (SAML 2.0), unspecified (SAML 1.1) and emailAddress (SAML 1.1). Source: [Configure single sign-on in Control Hub with Microsoft Entra ID](https://help.webex.com/en-us/article/mfu88u/Configure-single-sign-on-in-Control-Hub-with-Microsoft-Entra-ID), SAML requirements / NameID format list. Checked 2026-09-24. [^36]: For Control Hub SSO, identity providers must conform to the SAML 2.0 specification, and Webex acts as the service provider. Source: [Single Sign-On Integration in Control Hub](https://help.webex.com/en-us/article/lfu88u/Single-Sign-On-Integration-in-Control-Hub), Overview / requirements. Checked 2026-09-24. [^37]: Cisco's Control Hub SSO guidance for Entra ID says only Service Provider-initiated flows are supported and SSO must not be tested from the IdP interface (disputed). Source: [Configure single sign-on in Control Hub with Microsoft Entra ID](https://help.webex.com/en-us/article/mfu88u/Configure-single-sign-on-in-Control-Hub-with-Microsoft-Entra-ID), Test the integration section. Checked 2026-09-24. [^38]: The SAML assertion to Webex must include a uid attribute whose value matches an existing Webex user. Source: [Configure single sign-on in Control Hub with Microsoft Entra ID](https://help.webex.com/en-us/article/mfu88u/Configure-single-sign-on-in-Control-Hub-with-Microsoft-Entra-ID), Troubleshooting / verify assertion. Checked 2026-09-24. [^39]: Before configuring SAML SSO in Control Hub, the Webex users must already exist, either created locally or synchronized from a directory. Source: [Configure single sign-on in Control Hub with Microsoft Entra ID](https://help.webex.com/en-us/article/mfu88u/Configure-single-sign-on-in-Control-Hub-with-Microsoft-Entra-ID), Before you begin. Checked 2026-09-24. [^40]: Microsoft's steps to enable a user for Teams Direct Routing are: create the user in Microsoft 365 and assign a Teams Phone licence, ensure the user is homed online, configure the phone number and enable enterprise voice, configure direct-to-voicemail, and assign Teams Only mode. Source: [Enable users for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-enable-users), Enable users for Direct Routing, introductory step list. Checked 2026-09-24. [^41]: Teams user accounts are inherited from and synchronized with Microsoft 365, where they are created, licensed and managed; creating accounts and assigning licences requires the Microsoft 365 User admin role. Source: [Teams Phone licensing](https://learn.microsoft.com/en-us/microsoftteams/teams-phone-licensing), Understanding identity management for Teams Phone > User accounts. Checked 2026-09-24. [^42]: Any Teams user who needs their own telephone number must be licensed for both the Microsoft Teams and the Microsoft 365 Phone System applications; a Microsoft 365 E5 licence removes the need for a separate Teams Phone Standard licence. Source: [Teams Phone licensing](https://learn.microsoft.com/en-us/microsoftteams/teams-phone-licensing), Licensing Teams Phone - for end users. Checked 2026-09-24. [^43]: Microsoft offers two ways to create Direct Routing users (create in on-premises Active Directory and sync to the cloud, or create directly in the Microsoft 365 admin center), and recommends choosing only one to avoid routing issues. Source: [Enable users for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-enable-users), Create a user and assign the license. Checked 2026-09-24. [^44]: For users migrating from Skype for Business Server, a populated OnPremLineUri means the number was assigned on-premises and synced to Microsoft 365; it must be cleared on-premises and synced before the number can be managed online. Source: [Enable users for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-enable-users), Ensure that the user is homed online. Checked 2026-09-24. [^45]: If provisioning sets Webex userName from userPrincipalName but the SAML uid claim is sourced from user.mail, users whose mail differs from their UPN are likely to fail SSO matching (inferred). Source: [Configure single sign-on in Control Hub with Microsoft Entra ID](https://help.webex.com/en-us/article/mfu88u/Configure-single-sign-on-in-Control-Hub-with-Microsoft-Entra-ID), uid requirement, combined with Wizard default mapping and Microsoft claims table. Checked 2026-09-24. [^46]: When Entra ID synchronization is disabled, users and groups that were previously synchronized become manageable directly in Control Hub. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Disable synchronization section. Checked 2026-09-24. [^47]: The Entra ID Wizard App setup needs an Entra ID account with authority to grant tenant-wide admin consent to an application. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Before you begin / prerequisites. Checked 2026-09-24. [^48]: Setting up the Entra ID Wizard App in Control Hub requires the Full Administrator role in the Control Hub organization. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Set up the Entra ID Wizard App in Control Hub > Before you begin / prerequisites. Checked 2026-09-24. [^49]: The Entra ID Wizard App synchronizes group objects automatically every 12 hours. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Group synchronization section. Checked 2026-09-24. [^50]: The Entra ID Wizard App cannot synchronize Entra ID distribution groups. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Group synchronization limitations. Checked 2026-09-24. [^51]: After a Wizard App synchronization, the Job status shows Active on success or Quarantine when Entra ID has quarantined the job after multiple failures. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Synchronization status / Job status field. Checked 2026-09-24. [^52]: The Entra ID Wizard App manages only the users that were added to its synchronization scope. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Directory Connector / scope note. Checked 2026-09-24. [^53]: The Entra ID Wizard App can synchronize users in Entra ID groups and group objects, and can optionally synchronize in-scope users' avatars to Webex. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Overview and avatar synchronization setting. Checked 2026-09-24. [^54]: By default the Entra ID userPrincipalName attribute maps to the Webex userName, which is the user's primary identity in Webex. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Attribute mapping table (default mappings). Checked 2026-09-24. [^55]: With the Entra ID Wizard App, users are typically synchronized every 40 minutes, a cadence Cisco attributes to Microsoft policy. Source: [Set up the Entra ID Wizard App in Control Hub](https://help.webex.com/en-us/article/heauzeb/Set-up-the-Entra-ID-Wizard-App-in-Control-Hub), Synchronization schedule note. Checked 2026-09-24. [^56]: For Webex Calling automatic licence assignment, a user must be assigned to a location and provisioned with an extension, a number, or both. Source: [Set up automatic license assignment templates for Webex Calling users](https://help.webex.com/en-us/article/n8iptxg/Set-up-automatic-license-assignment-templates-for-Webex-Calling-users), How Webex Calling automatic licensing works. Checked 2026-09-24. [^57]: For directory-synchronized users (Active Directory, Azure/Entra, Okta), Webex Calling auto-provisioning uses the user's directory work phone number to find a matching number pre-provisioned in Webex Calling, then assigns that number's location. Source: [Set up automatic license assignment templates for Webex Calling users](https://help.webex.com/en-us/article/n8iptxg/Set-up-automatic-license-assignment-templates-for-Webex-Calling-users), Directory synchronization method. Checked 2026-09-24. [^58]: All Unified CM end users must already be provisioned as Webex users, through Cisco Directory Connector or another mechanism, before the migration task runs. Source: [Migrate Unified CM data to Webex Calling](https://help.webex.com/en-us/article/x974bd/Migrate-Unified-CM-to-Webex), Before you begin / prerequisites. Checked 2026-09-04. [^59]: Cisco warns that where user extensions synchronised from Active Directory through Directory Connector already include the location routing prefix, Webex Calling adds the routing prefix again, producing duplicated prefixes. Source: [Configure Webex Calling for your organization](https://help.webex.com/en-us/article/njvdjf2/Configure-Webex-Calling-for-your-organization), Configure Webex Calling dial plan, step 2, note under Location Routing Prefix Length. Checked 2026-09-15. [^60]: Every scope named across the Meetings, Workspaces and both contact centre server pages appears in the Webex scope catalogue with a matching description, including a platform connection scope described as accessing servers hosted on the agentic platform (inferred). Source: [Connect to Webex Agentic MCP Servers](https://developer.webex.com/mcp/docs/webex-agentic-mcp-servers), server scope tables against the embedded scope catalogue. Checked 2026-09-05.