Why Control Hub Administration Matters
Webex Calling is only as reliable as the administrative foundation it runs on. Control Hub is the single pane of glass for every configuration decision that affects how users communicate — license assignment, location setup, number management, calling feature behavior, and device provisioning all flow through it. Get the architecture right and the deployment scales cleanly. Skip the foundational steps and you spend the rest of the engagement cleaning up problems that compound with every user you add.
The dependency chain matters. You cannot effectively provision users without locations. You cannot assign numbers without a PSTN provider tied to a location. You cannot configure call queues or auto attendants without users and numbers already in place. This article follows that dependency chain in order — locations first, then users, then calling features. Work through it in sequence and the deployment holds together. Work through it out of order and you create rework.
For the full deployment context that surrounds these Control Hub steps, see Webex Calling Cloud Deployment — Full Setup Walkthrough (Part 1).
Pillar 1: Architecting Locations
What Locations Actually Do
Locations in Webex Calling are not just organizational labels. They are the structural framework that ties together PSTN connectivity, emergency calling behavior, device provisioning, and calling feature scope. Every user and every workspace belongs to a location. Every number is assigned through a location. Every E911 address is anchored to a location.
Getting location architecture right before you provision a single user is the single most important setup decision in a Webex Calling deployment. Reassigning users to corrected locations after the fact is possible but time-consuming — and it affects emergency calling records, number assignments, and calling policies simultaneously.
Planning Your Location Structure
Each physical site where phones will be deployed should be its own location. A company with a headquarters, two regional offices, and a warehouse needs four locations — not one organization-wide location with everything dumped into it.
The planning questions to answer before you create a single location:
- How many physical sites exist, and do any sites have separate PSTN requirements?
- Does each site need its own main number, or do some sites share PSTN connectivity through a Local Gateway at another site?
- Are there regulatory or compliance reasons to separate users by location — for example, different emergency calling requirements across states or countries?
- Will any locations use Local Gateway while others use Cloud PSTN or Operator Connect?
Document the answers before you open Control Hub. The location structure you create in the first hour of setup is the structure you manage for the life of the deployment.
Creating a Location Manually
Navigate to Management > Locations in Control Hub. Select Add Location and complete the required fields:
- Location Name — use a name that’s meaningful to the organization and unambiguous across sites. “HQ,” “Chicago Office,” and “Denver Warehouse” are more useful than “Location 1,” “Location 2,” and “Location 3”
- Country/Region — this is not cosmetic. Country selection determines which PSTN providers are available, which number formats are valid, and which emergency calling frameworks apply. Set it correctly — changing it later requires rebuilding the location
- Time Zone — affects business hours schedules for auto attendants and call queues tied to this location. Set it to the local time zone of the physical site, not the organization’s headquarters time zone
- Language — sets the default language for system prompts and voicemail greetings for users at this location
- Address — the physical address used for E911 routing. Must be a valid, deliverable address that maps to the correct PSAP for this location
Once the location is created, you’ll assign a PSTN provider to it — either a Cisco Calling Plan, a Cloud Connected PSTN carrier, or a Local Gateway trunk. Until a PSTN provider is assigned, the location exists but cannot handle external calls. The full decision framework for PSTN options is covered in PSTN Options in Webex Calling.
Bulk Location Modification via CSV
For organizations with many locations or for migrations where location data already exists in a spreadsheet, Control Hub supports bulk modification through CSV export and import. Navigate to Management > Locations, export the current location list, modify the CSV with your changes, and re-import.
CSV bulk modification is useful for updating time zones, addresses, or names across many locations simultaneously. It is not a substitute for the initial PSTN configuration — PSTN provider assignment still requires manual configuration per location after the CSV import.
Tying a Location to a PSTN Provider
Each location needs a PSTN assignment before numbers can be ordered or ported into it. The path varies by PSTN type:
Cisco Calling Plans: Navigate to Calling > PSTN within the location settings. Select Cisco Calling Plans and choose the appropriate plan for the country. Number ordering and porting both happen from this same interface once the plan is assigned.
Cloud Connected PSTN (Operator Connect): Select Cloud Connected PSTN and choose your certified carrier from the list. The carrier’s provisioning portal handles number management — Control Hub reflects the assignments once the carrier completes provisioning on their end.
Local Gateway: Navigate to Calling > PSTN and select Local Gateway. The Local Gateway trunk must already be configured and registered to your Webex organization before it can be assigned to a location. One Local Gateway trunk can serve multiple locations if the routing design supports it.
Pillar 2: User Provisioning and Lifecycle Management
Choosing the Right Onboarding Method
The right provisioning method depends on deployment size, identity infrastructure, and ongoing operational requirements. There are three paths.
| Method | Best For | User Limit | Identity Source |
|---|---|---|---|
| Manual | Small deployments, admin accounts | Under 25 users | Entered directly in Control Hub |
| CSV Bulk Import | Mid-size deployments, one-time migrations | Up to 20,000 users | Spreadsheet import |
| Directory Sync (SCIM) | Medium to large deployments, ongoing lifecycle management | No practical limit | Azure AD, Okta, or SCIM-compliant IdP |
Manual User Provisioning
Manual provisioning is appropriate for small deployments and for service accounts or admin users that should not be managed by directory sync.
Navigate to Management > Users > Add Users. Enter the user’s email address — this must match a verified domain in your Webex organization. Complete the display name, assign the appropriate licenses, and map the user to their location.
License assignment at the user level covers three service categories:
- Messaging — Webex App messaging and spaces
- Meetings — Webex Meetings access and conferencing features
- Calling — Webex Calling Professional license, which enables extension, voicemail, and PSTN calling capability
All three can be assigned independently. A user who needs calling but not meetings gets a Calling license without a Meetings license. Assign only what the user actually needs — over-licensing at the user level is a common source of unnecessary cost at renewal.
CSV Bulk Import
For initial population of mid-size deployments or one-time migrations, CSV bulk import is the most practical approach. Navigate to Management > Users > Add Users > Import from CSV. Download the template, populate it with user data, and upload.
The CSV template includes columns for email address, first name, last name, display name, location assignment, and license flags. The location column must reference the exact name of an existing location — if the location name in the CSV doesn’t match a location in Control Hub exactly, the import fails for those rows.
Before importing, validate the CSV against a small test batch first — 5 to 10 users. Verify that location assignments are correct, display names are formatted consistently, and license flags are set appropriately. A clean test import catches formatting issues before they affect hundreds of users.
Import errors are reported per-row in the results file Control Hub generates after processing. Review every error before considering the import complete — partial imports where some users failed silently are a common source of post-deployment provisioning gaps.
Directory Synchronization via SCIM
For deployments of any meaningful scale with ongoing user lifecycle management requirements, directory sync via SCIM is the right approach. Users created, modified, or deactivated in your identity provider are reflected in Control Hub automatically — without manual intervention for each change.
Azure AD setup: In Azure AD, navigate to Enterprise Applications and search for Webex. Add the Webex app, navigate to Provisioning, and set the provisioning mode to Automatic. In Control Hub, generate a SCIM token under Management > Identity and enter it in the Azure AD provisioning configuration as the tenant URL and secret token.
The attribute mapping between Azure AD and Control Hub determines how user data is populated. The critical attributes are:
- userName — maps to the user’s email address in Control Hub, must match a verified domain
- displayName — maps to the user’s display name as it appears in the Webex directory
- givenName / familyName — first and last name
- department / title — optional but useful for directory accuracy
Test the sync with a scoped pilot group before enabling it for the full directory. In Azure AD, scope the provisioning to a test group, sync, and verify that users appear in Control Hub with correct attributes and location assignments before expanding scope.
Group-based license assignment: Rather than assigning licenses per-user during sync, use Azure AD dynamic groups to drive license assignment. Create groups that match your license profiles — for example, a group for full-license users (Messaging + Meetings + Calling) and a separate group for calling-only users. Assign licenses at the group level in Control Hub. Users added to the Azure AD group automatically receive the correct license combination in Webex.
Group-based licensing scales significantly better than per-user assignment and reduces the risk of provisioning gaps when users change roles or departments.
Mapping Users to Locations
Every user must be assigned to a location. This assignment determines their emergency calling address, the PSTN provider that handles their calls, and the calling policies that apply to them by default.
For manual and CSV provisioning, location assignment happens at the time of user creation. For SCIM provisioning, location assignment can be driven by an Azure AD attribute — map the user’s office location or department attribute to their Webex location using the attribute mapping configuration in the Azure AD provisioning setup.
Verify location assignments are correct before assigning numbers. A user assigned to the wrong location will have their calls routed through the wrong PSTN provider and their emergency calls dispatched to the wrong PSAP.
Pillar 3: Advanced Calling Features and Experience Overrides
The Override Hierarchy
Webex Calling applies calling feature settings in a defined hierarchy. Understanding this hierarchy is essential for managing calling behavior at scale without creating a configuration mess.
| Level | Scope | Where Configured | Override Behavior |
|---|---|---|---|
| Organization | All users in the org | Calling > Settings | Baseline defaults for all users |
| Location | All users at a location | Management > Locations > location settings | Overrides org-level for users at that location |
| Group Template | Users in a specific group | Management > Groups > calling template | Overrides location-level for group members |
| User | Individual user | Management > Users > user calling settings | Overrides all higher levels for that user |
Settings applied at a lower level in the hierarchy always take precedence over higher-level settings. An organization-level call forwarding policy can be overridden by a location policy, which can be overridden by a group template, which can be overridden by a user-level configuration.
In practice this means you should configure sensible defaults at the organization level, use location-level settings to handle site-specific requirements, and reserve user-level overrides for exceptions — not as the primary configuration mechanism. Organizations that configure everything at the user level end up with hundreds of individual settings to manage instead of a handful of policies.
Call Forwarding
Call forwarding settings for individual users are configured under Management > Users > select user > Calling > Call Forwarding.
The available forwarding types are:
- Always Forward — all calls forwarded to a specified destination regardless of availability
- When Busy — calls forward when the user is already on a call
- When No Answer — calls forward after a configurable ring duration if unanswered
- Selective Forwarding — calls from specific numbers forward to a specified destination
For user-level call forwarding configuration, admins can either configure the settings directly in Control Hub or allow users to manage their own forwarding through User Hub. The admin controls whether users can override forwarding settings — navigate to Calling > Settings at the organization level to set the forwarding self-service permissions.
Voicemail Configuration
Voicemail is enabled per user under Management > Users > select user > Calling > Voicemail. Key settings:
- Voicemail enabled/disabled — toggle voicemail on or off for the user
- Send unanswered calls to voicemail — configures the no-answer timeout before calls reach voicemail
- Voicemail to email — forwards voicemail recordings to the user’s email address as an audio attachment
- Storage — voicemail storage is cloud-based; no local storage configuration required
Voicemail PIN management is handled through User Hub by the user, or through Control Hub by an admin. PINs must meet the organization’s minimum complexity requirements, which are configured under Calling > Settings > Voicemail PIN Rules at the organization level.
One operational note: users who haven’t set up their voicemail greeting will present callers with a generic system greeting. For customer-facing numbers, verify that all users have recorded personalized greetings before go-live.
Hunt Groups
Hunt groups route incoming calls to a defined list of users using a configurable ring pattern. They’re the right tool for simple inbound call distribution — a main number that rings several people until someone answers — without the queue management overhead of a full call queue. For full production configuration of hunt groups, auto attendants, and call queues, see Webex Calling Hunt Groups, Auto Attendants, and Call Queues — Production Setup Guide.
Navigate to Calling > Features > Hunt Group > Add Hunt Group. Configuration steps:
- Assign the hunt group a name and a direct phone number or extension
- Select the routing pattern — Sequential (rings users in order), Simultaneous (rings all users at once), Uniform (distributes calls to the least recently called agent), or Weighted (distributes calls based on configured percentage weights)
- Add the users who are members of the hunt group
- Configure the no-answer behavior — how many rings before moving to the next agent, and what happens when all agents are unavailable
Hunt groups do not provide queue position announcements, estimated wait times, or agent state management. If those features are required, use a call queue instead.
Call Pickup Groups
Call pickup allows a user to answer a call ringing on a colleague’s phone by dialing a pickup code or pressing a designated button on a physical phone. It’s commonly used in open office environments where staff cover for each other without needing to transfer calls.
Navigate to Calling > Features > Call Pickup > Add Call Pickup Group. Add the users who should be able to pick up each other’s calls. The pickup code is generated automatically and can be communicated to users for manual dialing, or the code can be programmed as a line key on supported MPP phones.
In-Call Feature Access
Control Hub allows administrators to configure which in-call features are available to users during active calls and meetings. Navigate to Management > Users > select user > Calling > In-Call Features (or configure at the organization level under Calling > Settings).
Configurable options include:
- Move call to Webex Meeting — allows users to escalate an active voice call into a full Webex Meeting with video and screen sharing
- Screen sharing during calls — enables or disables screen sharing capability during active calls
- Remote Desktop Control — allows the remote party to request control of the user’s desktop during a call
- Call recording — enables on-demand or automatic call recording where licensing supports it
These settings are typically configured at the organization level with user-level exceptions for specific roles. Enable screen sharing and meeting escalation broadly for knowledge workers. Be more selective about remote desktop control — it’s a capability that warrants explicit authorization rather than a default-on setting.
Admin Best Practices and Ongoing Maintenance
Getting Control Hub configured correctly at deployment is necessary but not sufficient. The organizations that run clean Webex Calling deployments over time are the ones that treat ongoing administration as an operational discipline, not a set-and-forget exercise.
Audit unused numbers and licenses quarterly. Numbers that are assigned but not actively used sit on your billing statement indefinitely. Users who have left the organization but weren’t properly deprovisioned hold licenses that could be reallocated. Run a numbers audit from Calling > Numbers filtered by assignment status, and cross-reference your active user list against your licensed user count at least once a quarter. The full number management workflow is covered in Number Management in Webex Calling.
Schedule and monitor directory sync. If you’re running SCIM provisioning, verify the sync is running on schedule and check the error log regularly. Sync failures that go unnoticed create provisioning drift — users who should be deactivated remain active, users who should have been created aren’t. Set up email notifications for sync errors in your identity provider so failures surface immediately rather than during a support incident.
Use the Analytics and Troubleshooting tools proactively. Control Hub’s analytics section provides call quality data, usage metrics, and device health information. Don’t wait for users to complain — review call quality trends weekly for the first month after go-live and monthly after that. The Troubleshooting section under Monitoring allows you to search for specific calls by user, time range, or quality score and drill into the media path and quality metrics for individual calls. Use it.
Document your configuration decisions. The location structure, PSTN design, calling policy hierarchy, hunt group membership, and override exceptions you configured at deployment will not be obvious to the next person who manages the system. Maintain a living document that captures the reasoning behind non-default configurations — not just what the settings are, but why they’re set that way. It’s the difference between a maintainable system and one that nobody wants to touch.